github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

grpc config add options tcp_tls_ca

Browse Source 
Signed-off-by: zwtop <wang.zhan@smartx.com>
This commit is contained in:
zwtop 2021-06-15 18:31:22 +08:00
parent 0a3a77bc44
commit 63fe34add6
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
services/server/config/config.go
View File

@ -122,6 +122,7 @@ func (c *Config) ValidateV2() error {
type GRPCConfig struct { type GRPCConfig struct {
Address string `toml:"address"` Address string `toml:"address"`
TCPAddress string `toml:"tcp_address"` TCPAddress string `toml:"tcp_address"`
TCPTLSCA string `toml:"tcp_tls_ca"`
TCPTLSCert string `toml:"tcp_tls_cert"` TCPTLSCert string `toml:"tcp_tls_cert"`
TCPTLSKey string `toml:"tcp_tls_key"` TCPTLSKey string `toml:"tcp_tls_key"`
UID int `toml:"uid"` UID int `toml:"uid"`

21
services/server/server.go
View File

@ -18,8 +18,11 @@ package server
import ( import (
"context" "context"
"crypto/tls"
"crypto/x509"
"expvar" "expvar"
"io" "io"
"io/ioutil"
"net" "net"
"net/http" "net/http"
"net/http/pprof" "net/http/pprof"
@ -111,11 +114,25 @@ func New(ctx context.Context, config *srvconfig.Config) (*Server, error) {
tcpServerOpts := serverOpts tcpServerOpts := serverOpts
if config.GRPC.TCPTLSCert != "" { if config.GRPC.TCPTLSCert != "" {
log.G(ctx).Info("setting up tls on tcp GRPC services...") log.G(ctx).Info("setting up tls on tcp GRPC services...")
creds, err := credentials.NewServerTLSFromFile(config.GRPC.TCPTLSCert, config.GRPC.TCPTLSKey)
tlsCert, err := tls.LoadX509KeyPair(config.GRPC.TCPTLSCert, config.GRPC.TCPTLSKey)
if err != nil { if err != nil {
return nil, err return nil, err
} }
tcpServerOpts = append(tcpServerOpts, grpc.Creds(creds)) tlsConfig := &tls.Config{Certificates: []tls.Certificate{tlsCert}}
if config.GRPC.TCPTLSCA != "" {
caCertPool := x509.NewCertPool()
caCert, err := ioutil.ReadFile(config.GRPC.TCPTLSCA)
if err != nil {
return nil, errors.Wrap(err, "failed to load CA file")
}
caCertPool.AppendCertsFromPEM(caCert)
tlsConfig.ClientCAs = caCertPool
tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
}
tcpServerOpts = append(tcpServerOpts, grpc.Creds(credentials.NewTLS(tlsConfig)))
} }
var ( var (
grpcServer = grpc.NewServer(serverOpts...) grpcServer = grpc.NewServer(serverOpts...)