Skip to content

Commit bdf5642

Browse files
ibuildthecloudibuildthecloud
authored
Merge pull request #13 from ibuildthecloud/master
Add TPM support
2 parents 14a6796 + 357fd68 commit bdf5642

File tree

15 files changed

+900
-112
lines changed

15 files changed

+900
-112
lines changed

‎.drone.yml

-43
Original file line numberDiff line numberDiff line change
@@ -83,46 +83,3 @@ volumes:
8383
- name: docker
8484
host:
8585
path: /var/run/docker.sock
86-
87-
---
88-
kind: pipeline
89-
name: arm
90-
91-
platform:
92-
os: linux
93-
arch: arm
94-
95-
steps:
96-
- name: build
97-
image: rancher/dapper:v0.4.1
98-
commands:
99-
- dapper ci
100-
volumes:
101-
- name: docker
102-
path: /var/run/docker.sock
103-
104-
- name: github_binary_release
105-
image: plugins/github-release
106-
settings:
107-
api_key:
108-
from_secret: github_token
109-
prerelease: true
110-
checksum:
111-
- sha256
112-
checksum_file: CHECKSUMsum-arm.txt
113-
checksum_flatten: true
114-
files:
115-
- "dist/artifacts/*"
116-
when:
117-
instance:
118-
- drone-publish.rancher.io
119-
ref:
120-
- refs/head/master
121-
- refs/tags/*
122-
event:
123-
- tag
124-
125-
volumes:
126-
- name: docker
127-
host:
128-
path: /var/run/docker.sock

‎Dockerfile.dapper

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
FROM golang:1.16.2-alpine3.12
1+
FROM registry.suse.com/bci/golang:1.16
22

33
ARG DAPPER_HOST_ARCH
44
ENV ARCH $DAPPER_HOST_ARCH
55

6-
RUN apk -U add bash git gcc musl-dev docker vim less file curl wget ca-certificates
6+
RUN zypper in -y bash git gcc docker vim less file curl wget ca-certificates trousers-devel
77
RUN go get golang.org/x/tools/cmd/goimports
88
RUN if [ "${ARCH}" == "amd64" ]; then \
99
curl -sL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s v1.40.1; \
@@ -13,8 +13,7 @@ ENV DAPPER_ENV REPO TAG DRONE_TAG CROSS
1313
ENV DAPPER_SOURCE /go/src/github.com/rancher/rancherd/
1414
ENV DAPPER_OUTPUT ./bin ./dist
1515
ENV DAPPER_DOCKER_SOCKET true
16-
ENV DAPPER_RUN_ARGS "-v rancherd:/go/pkg -v rancherd:/root/.cache/go-build"
17-
ENV HOME ${DAPPER_SOURCE}
16+
ENV DAPPER_RUN_ARGS "-v rancherd-go:/root/go -v rancherd-cache:/root/.cache"
1817
WORKDIR ${DAPPER_SOURCE}
1918

2019
ENTRYPOINT ["./scripts/entry"]

‎cmd/rancherd/gettpmhash/gettpmhash.go

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
package gettpmhash
2+
3+
import (
4+
"fmt"
5+
6+
"github.com/rancher/rancherd/pkg/tpm"
7+
cli "github.com/rancher/wrangler-cli"
8+
"github.com/spf13/cobra"
9+
)
10+
11+
func NewGetTPMHash() *cobra.Command {
12+
return cli.Command(&GetTPMHash{}, cobra.Command{
13+
Use: "get-tpm-hash",
14+
Short: "Print TPM hash to identify this machine",
15+
})
16+
}
17+
18+
type GetTPMHash struct {
19+
}
20+
21+
func (p *GetTPMHash) Run(cmd *cobra.Command, args []string) error {
22+
str, err := tpm.GetPubHash()
23+
if err != nil {
24+
return err
25+
}
26+
fmt.Println(str)
27+
return nil
28+
}

‎cmd/rancherd/main.go

+2
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package main
33
import (
44
"github.com/rancher/rancherd/cmd/rancherd/bootstrap"
55
"github.com/rancher/rancherd/cmd/rancherd/gettoken"
6+
"github.com/rancher/rancherd/cmd/rancherd/gettpmhash"
67
"github.com/rancher/rancherd/cmd/rancherd/info"
78
"github.com/rancher/rancherd/cmd/rancherd/probe"
89
"github.com/rancher/rancherd/cmd/rancherd/resetadmin"
@@ -31,6 +32,7 @@ func main() {
3132
retry.NewRetry(),
3233
upgrade.NewUpgrade(),
3334
info.NewInfo(),
35+
gettpmhash.NewGetTPMHash(),
3436
)
3537
cli.Main(root)
3638
}

‎go.mod

+4-1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,9 @@ replace (
3131
)
3232

3333
require (
34+
github.com/google/certificate-transparency-go v1.1.2
35+
github.com/google/go-attestation v0.3.2
36+
github.com/gorilla/websocket v1.4.2
3437
github.com/hashicorp/go-discover v0.0.0-20201029210230-738cb3105cd0
3538
github.com/pkg/errors v0.9.1
3639
github.com/rancher/rancher/pkg/apis v0.0.0-20210920193801-79027c456224
@@ -42,7 +45,7 @@ require (
4245
github.com/spf13/cobra v1.1.3
4346
golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97
4447
gopkg.in/yaml.v2 v2.4.0
45-
gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776
48+
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
4649
k8s.io/api v0.21.3
4750
k8s.io/apimachinery v0.21.3
4851
k8s.io/client-go v12.0.0+incompatible

‎go.sum

+498-26
Large diffs are not rendered by default.

‎pkg/cacerts/cacerts.go

+31-4
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
url2 "net/url"
1515
"time"
1616

17+
"github.com/rancher/rancherd/pkg/tpm"
1718
"github.com/rancher/wrangler/pkg/randomtoken"
1819
)
1920

@@ -42,18 +43,33 @@ func get(server, token, path string, clusterToken bool) ([]byte, string, error)
4243
}
4344
u.Path = path
4445

45-
req, err := http.NewRequest(http.MethodGet, u.String(), nil)
46+
var (
47+
isTPM bool
48+
)
49+
if !clusterToken {
50+
isTPM, token, err = tpm.ResolveToken(token)
51+
if err != nil {
52+
return nil, "", err
53+
}
54+
}
55+
56+
cacert, caChecksum, err := CACerts(server, token, clusterToken)
4657
if err != nil {
4758
return nil, "", err
4859
}
49-
if !clusterToken {
50-
req.Header.Set("Authorization", "Bearer "+base64.StdEncoding.EncodeToString([]byte(token)))
60+
61+
if isTPM {
62+
data, err := tpm.Get(cacert, u.String(), nil)
63+
return data, caChecksum, err
5164
}
5265

53-
cacert, caChecksum, err := CACerts(server, token, clusterToken)
66+
req, err := http.NewRequest(http.MethodGet, u.String(), nil)
5467
if err != nil {
5568
return nil, "", err
5669
}
70+
if !clusterToken {
71+
req.Header.Set("Authorization", "Bearer "+base64.StdEncoding.EncodeToString([]byte(token)))
72+
}
5773

5874
var resp *http.Response
5975
if len(cacert) == 0 {
@@ -103,6 +119,13 @@ func CACerts(server, token string, clusterToken bool) ([]byte, string, error) {
103119
if !clusterToken {
104120
requestURL = fmt.Sprintf("https://%s/v1-rancheros/cacerts", url.Host)
105121
}
122+
123+
if resp, err := http.Get(requestURL); err == nil {
124+
_, _ = ioutil.ReadAll(resp.Body)
125+
resp.Body.Close()
126+
return nil, "", nil
127+
}
128+
106129
req, err := http.NewRequest(http.MethodGet, requestURL, nil)
107130
if err != nil {
108131
return nil, "", err
@@ -121,6 +144,10 @@ func CACerts(server, token string, clusterToken bool) ([]byte, string, error) {
121144
return nil, "", err
122145
}
123146

147+
if resp.StatusCode != http.StatusOK {
148+
return nil, "", fmt.Errorf("response %d: %s getting cacerts: %s", resp.StatusCode, resp.Status, data)
149+
}
150+
124151
if resp.Header.Get("X-Cattle-Hash") != hash(token, nonce, data) {
125152
return nil, "", fmt.Errorf("response hash (%s) does not match (%s)",
126153
resp.Header.Get("X-Cattle-Hash"),

‎pkg/config/runtime.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,9 @@ package config
33
import "strings"
44

55
var (
6-
RuntimeRKE2 Runtime = "rke2"
7-
RuntimeK3S Runtime = "k3s"
6+
RuntimeRKE2 Runtime = "rke2"
7+
RuntimeK3S Runtime = "k3s"
8+
RuntimeUnknown Runtime = "unknown"
89
)
910

1011
type Runtime string

‎pkg/discovery/discovery.go

+11-3
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,9 @@ func discoverServerAndRole(ctx context.Context, cfg *config.Config) (string, boo
106106
}
107107

108108
func (j *joinServer) addresses(params map[string]string, discovery *discover.Discover) ([]string, error) {
109+
if params["provider"] == "mdns" {
110+
params["v6"] = "false"
111+
}
109112
addrs, err := discovery.Addrs(discover.Config(params).String(), log.Default())
110113
if err != nil {
111114
return nil, err
@@ -146,15 +149,15 @@ func (j *joinServer) loop(ctx context.Context, count int, params map[string]stri
146149
}
147150
resp, err := insecureHTTPClient.Do(req)
148151
if err != nil {
149-
logrus.Errorf("failed to connect to %s: %v", url, err)
152+
logrus.Infof("failed to connect to %s: %v", url, err)
150153
allAgree = false
151154
continue
152155
}
153156

154157
data, err := ioutil.ReadAll(resp.Body)
155158
resp.Body.Close()
156159
if err != nil || resp.StatusCode != http.StatusOK {
157-
logrus.Errorf("failed to read response from %s: code %d: %v", url, resp.StatusCode, err)
160+
logrus.Infof("failed to read response from %s: code %d: %v", url, resp.StatusCode, err)
158161
allAgree = false
159162
continue
160163
}
@@ -181,6 +184,11 @@ func (j *joinServer) loop(ctx context.Context, count int, params map[string]stri
181184
}
182185
}
183186

187+
if len(addrs) == 0 {
188+
logrus.Infof("No available peers")
189+
return "", false
190+
}
191+
184192
if firstID != j.id {
185193
logrus.Infof("Waiting for peer %s from %v to initialize", addrs[0], addrs)
186194
return "", false
@@ -219,7 +227,7 @@ func newJoinServer(ctx context.Context, cacheDuration string, port int64) (*join
219227
}
220228

221229
if cacheDuration == "" {
222-
cacheDuration = "5m"
230+
cacheDuration = "1m"
223231
}
224232

225233
duration, err := time.ParseDuration(cacheDuration)

‎pkg/plan/bootstrap.go

+5-18
Original file line numberDiff line numberDiff line change
@@ -49,28 +49,19 @@ func toJoinPlan(cfg *config.Config, dataDir string) (*applyinator.Plan, error) {
4949
}
5050

5151
plan := plan{}
52-
k8sVersion, err := versions.K8sVersion(cfg.KubernetesVersion)
53-
if err != nil {
54-
return nil, err
55-
}
56-
5752
if err := plan.addFile(join.ToScriptFile(cfg, dataDir)); err != nil {
5853
return nil, err
5954
}
60-
if err := plan.addFile(runtime.ToFile(&cfg.RuntimeConfig, config.GetRuntime(k8sVersion), false)); err != nil {
61-
return nil, err
62-
}
6355
if err := plan.addInstruction(join.ToInstruction(cfg, dataDir)); err != nil {
6456
return nil, err
6557
}
66-
if err := plan.addInstruction(probe.ToInstruction(cfg.RuntimeInstallerImage, cfg.SystemDefaultRegistry, k8sVersion)); err != nil {
58+
if err := plan.addInstruction(probe.ToInstruction()); err != nil {
6759
return nil, err
6860
}
69-
if err := plan.addProbesForRoles(cfg); err != nil {
61+
if err := plan.addProbesForJoin(cfg); err != nil {
7062
return nil, err
7163
}
7264

73-
plan.addPrePostInstructions(cfg, "")
7465
return (*applyinator.Plan)(&plan), nil
7566
}
7667

@@ -95,7 +86,7 @@ func (p *plan) addInstructions(cfg *config.Config, dataDir string) error {
9586
return err
9687
}
9788

98-
if err := p.addInstruction(probe.ToInstruction(cfg.RuntimeInstallerImage, cfg.SystemDefaultRegistry, k8sVersion)); err != nil {
89+
if err := p.addInstruction(probe.ToInstruction()); err != nil {
9990
return err
10091
}
10192

@@ -204,12 +195,8 @@ func (p *plan) addFile(file *applyinator.File, err error) error {
204195
return nil
205196
}
206197

207-
func (p *plan) addProbesForRoles(cfg *config.Config) error {
208-
k8sVersion, err := versions.K8sVersion(cfg.KubernetesVersion)
209-
if err != nil {
210-
return err
211-
}
212-
p.Probes = probe.ProbesForRole(&cfg.RuntimeConfig, config.GetRuntime(k8sVersion))
198+
func (p *plan) addProbesForJoin(cfg *config.Config) error {
199+
p.Probes = probe.ProbesForJoin(&cfg.RuntimeConfig)
213200
return nil
214201
}
215202

‎pkg/probe/probe.go

+11-5
Original file line numberDiff line numberDiff line change
@@ -61,13 +61,13 @@ func replaceRuntime(str string, runtime config.Runtime) string {
6161
return fmt.Sprintf(str, runtime)
6262
}
6363

64-
func ProbesForRole(config *config.RuntimeConfig, runtime config.Runtime) map[string]prober.Probe {
65-
if roles.IsControlPlane(config.Role) {
66-
return AllProbes(runtime)
64+
func ProbesForJoin(cfg *config.RuntimeConfig) map[string]prober.Probe {
65+
if roles.IsControlPlane(cfg.Role) {
66+
return AllProbes(config.RuntimeUnknown)
6767
}
6868
return replaceRuntimeForProbes(map[string]prober.Probe{
6969
"kubelet": probes["kubelet"],
70-
}, runtime)
70+
}, config.RuntimeUnknown)
7171
}
7272

7373
func AllProbes(runtime config.Runtime) map[string]prober.Probe {
@@ -77,6 +77,12 @@ func AllProbes(runtime config.Runtime) map[string]prober.Probe {
7777
func replaceRuntimeForProbes(probes map[string]prober.Probe, runtime config.Runtime) map[string]prober.Probe {
7878
result := map[string]prober.Probe{}
7979
for k, v := range probes {
80+
// we don't know the runtime to find the file
81+
if runtime == config.RuntimeUnknown && (v.HTTPGetAction.CACert+
82+
v.HTTPGetAction.ClientCert+
83+
v.HTTPGetAction.ClientKey) != "" {
84+
continue
85+
}
8086
v.HTTPGetAction.CACert = replaceRuntime(v.HTTPGetAction.CACert, runtime)
8187
v.HTTPGetAction.ClientCert = replaceRuntime(v.HTTPGetAction.ClientCert, runtime)
8288
v.HTTPGetAction.ClientKey = replaceRuntime(v.HTTPGetAction.ClientKey, runtime)
@@ -85,7 +91,7 @@ func replaceRuntimeForProbes(probes map[string]prober.Probe, runtime config.Runt
8591
return result
8692
}
8793

88-
func ToInstruction(imageOverride string, systemDefaultRegistry string, k8sVersion string) (*applyinator.Instruction, error) {
94+
func ToInstruction() (*applyinator.Instruction, error) {
8995
cmd, err := self.Self()
9096
if err != nil {
9197
return nil, fmt.Errorf("resolving location of %s: %w", os.Args[0], err)

‎pkg/rancher/run.go

+5-6
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,11 @@ var defaultValues = map[string]interface{}{
1616
"ingress": map[string]interface{}{
1717
"enabled": false,
1818
},
19-
"features": "multi-cluster-management=false",
20-
"antiAffinity": "required",
21-
"replicas": -3,
22-
"tls": "external",
23-
"hostPort": 8443,
24-
"noDefaultAdmin": true,
19+
"features": "multi-cluster-management=false",
20+
"antiAffinity": "required",
21+
"replicas": -3,
22+
"tls": "external",
23+
"hostPort": 8443,
2524
}
2625

2726
func GetRancherValues(dataDir string) string {

0 commit comments

Comments
 (0)