Support config reload of task durations, and reload of key and certificate.

Author: SlyngDK

cmd/server/main.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"flag"
 	"fmt"
 	"os"
@@ -49,6 +50,7 @@ func main() {
 		fmt.Printf("failed to load config: %s", err)
 		os.Exit(1)
 	}
+	config.CatchHUP(context.Background())
 
 	c, err := server.Main(config, Build, l)
 	if err != nil {

server/command.go

@@ -9,46 +9,11 @@ import (
 	"github.com/cego/nebula-provisioner/protocol"
 	"github.com/cego/nebula-provisioner/server/store"
 	"github.com/sirupsen/logrus"
-	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
 )
 
-func (srv *server) startUnixSocket(s *store.Store) error {
-	srv.l.Println("Starting http unix socket")
-	socketPath := srv.config.GetString("command.socket", "/tmp/nebula-provisioner.socket") // TODO Change default path
-	lis, err := net.Listen("unix", socketPath)
-	if err != nil {
-		return err
-	}
-
-	var opts []grpc.ServerOption
-	srv.unixGrpc = grpc.NewServer(opts...)
-
-	c := commandServer{
-		l:         srv.l,
-		store:     s,
-		ipManager: srv.ipManager,
-	}
-	protocol.RegisterServerCommandServer(srv.unixGrpc, &c)
-	go func() {
-		err := srv.unixGrpc.Serve(lis)
-		if err != nil {
-			srv.l.WithError(err).Error("Failed to start http unix socket")
-		}
-	}()
-	return nil
-}
-
-func (s *server) stopUnixSocket() error {
-	s.l.Println("Stopping http unix socket")
-	if s.unixGrpc != nil {
-		s.unixGrpc.GracefulStop()
-	}
-	return nil
-}
-
 type commandServer struct {
 	protocol.UnimplementedServerCommandServer
 

server/server.go

@@ -3,10 +3,12 @@ package server
 import (
 	"crypto/tls"
 	"fmt"
+	"net"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 
 	"github.com/cego/nebula-provisioner/protocol"
 	"github.com/cego/nebula-provisioner/server/store"
@@ -17,15 +19,17 @@ import (
 )
 
 type server struct {
-	l            *logrus.Logger
-	config       *config.C
-	buildVersion string
-	initialized  bool
-	store        *store.Store
-	ipManager    *store.IPManager
-	unixGrpc     *grpc.Server
-	agentService *grpc.Server
-	tasks        *tasks
+	l              *logrus.Logger
+	config         *config.C
+	buildVersion   string
+	initialized    bool
+	store          *store.Store
+	ipManager      *store.IPManager
+	unixGrpc       *grpc.Server
+	agentService   *grpc.Server
+	tasks          *tasks
+	tlsLock        sync.RWMutex
+	tlsCertificate *tls.Certificate
 }
 
 func Main(config *config.C, buildVersion string, logger *logrus.Logger) (*Control, error) {
@@ -34,7 +38,7 @@ func Main(config *config.C, buildVersion string, logger *logrus.Logger) (*Contro
 		FullTimestamp: true,
 	}
 
-	server := server{l, config, buildVersion, false, nil, nil, nil, nil, nil}
+	server := server{l: l, config: config, buildVersion: buildVersion}
 
 	return &Control{l, server.start, server.stop, make(chan interface{})}, nil
 }
@@ -164,17 +168,31 @@ func (s *server) startHttpsServer(dataDir string) error {
 
 		tlsConfig = manager.TLSConfig()
 	} else {
-
-		cert := s.config.GetString("pki.cert", "server.crt")
-		key := s.config.GetString("pki.key", "server.key")
-
-		keyPair, err := tls.LoadX509KeyPair(cert, key)
+		s.config.RegisterReloadCallback(func(_ *config.C) {
+			s.l.Info("Reloading tls cert")
+			keyPair, err := s.getKeyPair()
+			if err != nil {
+				return
+			}
+			s.tlsLock.Lock()
+			defer s.tlsLock.Unlock()
+			s.tlsCertificate = keyPair
+		})
+
+		keyPair, err := s.getKeyPair()
 		if err != nil {
-			s.l.WithError(err).Errorf("SERVER: unable to read server key pair: %v", err)
 			return err
 		}
+		s.tlsLock.Lock()
+		defer s.tlsLock.Unlock()
+		s.tlsCertificate = keyPair
+
 		tlsConfig = &tls.Config{
-			Certificates: []tls.Certificate{keyPair},
+			GetCertificate: func(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
+				s.tlsLock.RLock()
+				defer s.tlsLock.RUnlock()
+				return s.tlsCertificate, nil
+			},
 		}
 	}
 
@@ -198,6 +216,52 @@ func (s *server) startHttpsServer(dataDir string) error {
 	return nil
 }
 
+func (s *server) getKeyPair() (*tls.Certificate, error) {
+	cert := s.config.GetString("pki.cert", "server.crt")
+	key := s.config.GetString("pki.key", "server.key")
+
+	keyPair, err := tls.LoadX509KeyPair(cert, key)
+	if err != nil {
+		s.l.WithError(err).Errorf("SERVER: unable to read server key pair: %v", err)
+		return nil, err
+	}
+	return &keyPair, nil
+}
+
+func (s *server) startUnixSocket(store *store.Store) error {
+	s.l.Println("Starting http unix socket")
+	socketPath := s.config.GetString("command.socket", "/tmp/nebula-provisioner.socket") // TODO Change default path
+	lis, err := net.Listen("unix", socketPath)
+	if err != nil {
+		return err
+	}
+
+	var opts []grpc.ServerOption
+	s.unixGrpc = grpc.NewServer(opts...)
+
+	c := commandServer{
+		l:         s.l,
+		store:     store,
+		ipManager: s.ipManager,
+	}
+	protocol.RegisterServerCommandServer(s.unixGrpc, &c)
+	go func() {
+		err := s.unixGrpc.Serve(lis)
+		if err != nil {
+			s.l.WithError(err).Error("Failed to start http unix socket")
+		}
+	}()
+	return nil
+}
+
+func (s *server) stopUnixSocket() error {
+	s.l.Println("Stopping http unix socket")
+	if s.unixGrpc != nil {
+		s.unixGrpc.GracefulStop()
+	}
+	return nil
+}
+
 func grpcHandlerFunc(g *grpc.Server, h http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ct := r.Header.Get("Content-Type")

server/tasks.go

@@ -23,9 +23,20 @@ func NewTasks(l *logrus.Logger, config *config.C, store *store.Store) *tasks {
 func (t *tasks) Start() {
 	t.l.Infoln("Starting task scheduler")
 
-	renewCertTicker := time.NewTicker(t.config.GetDuration("tasks.certRenew.interval", 1*time.Hour))
-	renewCATicker := time.NewTicker(t.config.GetDuration("tasks.caRenew.interval", 24*time.Hour))
-	dbGCTicker := time.NewTicker(t.config.GetDuration("tasks.dbGC.interval", 5*time.Minute))
+	renewCertDuration := func() time.Duration { return t.config.GetDuration("tasks.certRenew.interval", 1*time.Hour) }
+	renewCADuration := func() time.Duration { return t.config.GetDuration("tasks.caRenew.interval", 24*time.Hour) }
+	dbGCDuration := func() time.Duration { return t.config.GetDuration("tasks.dbGC.interval", 5*time.Minute) }
+
+	renewCertTicker := time.NewTicker(renewCertDuration())
+	renewCATicker := time.NewTicker(renewCADuration())
+	dbGCTicker := time.NewTicker(dbGCDuration())
+
+	t.config.RegisterReloadCallback(func(_ *config.C) {
+		t.l.Info("Reloading task scheduler")
+		renewCertTicker.Reset(renewCertDuration())
+		renewCATicker.Reset(renewCADuration())
+		dbGCTicker.Reset(dbGCDuration())
+	})
 
 	go func() {
 		for {
@@ -39,6 +50,8 @@ func (t *tasks) Start() {
 				t.dbGC()
 			case <-t.quit:
 				renewCertTicker.Stop()
+				renewCATicker.Stop()
+				dbGCTicker.Stop()
 				return
 			}
 		}