Add Plugins #81

JU4N98 · 2023-07-04T19:06:33Z

Changes proposal:

Adds support for plugins according with issue #65, on each X.509 SVID, JWT SVID or JWT Bundle update, the helper will notify this change to all the loaded plugins. The block plugins is added to the config file where the configuration of every plugin is specified. For example:

agentAddress = "/var/run/api.sock"
cmd = "/run/client/assert.sh"
cmdArgs = ""
certDir = "/run/client/certs/"
renewSignal = "SIGUSR1"
svidFileName = "svid.crt"
svidKeyFileName = "svid.key"
svidBundleFileName = "root.crt"
jwt_audience = "example.org"
jwt_svid_file_name = "jwt.json"
jwt_bundle_file_name = "jwk.json"

plugins {
    "simple-plugin" {
        path="/opt/helper/simple-example"
        checksum="7ae182614c5b2f96b0c6655a6bf3e1e64fb0dbb9142fa50c8cf0002c5c5bb9c5"
        from="Bob"
        to="Alice"
        message="hi alice!"
    }
}

In this example a plugin called simple-plugin is going to be loaded into the spiffe-helper, there are two mandatory fields:

path: the path of the plugin binary.
checksum: the sha256 hash of the binary, needed to validate it.

But it is also possible to specify other string configurations for each plugin, in this case the simple-plugin has three: from, to and message. All the configurations will be shared on the plugin load.

MarcosDY · 2023-07-06T15:10:00Z

proto/plugin/plugin.proto

+syntax = "proto3";
+
+package helperPlugin;
+option go_package = "../../pkg/helperPlugin";


this package must be in the same folder we are

MarcosDY · 2023-07-06T15:13:57Z

proto/plugin/plugin.proto

+}
+
+service SpiffeHelper {
+    rpc PostConfigs(ConfigsRequest) returns (Empty) {};


what are those configs? only paths?
I feels like this plugin ends is to notify "something" about there are updated on bundles,
so we must know what is updated, and what to do based on each plugin config,
So the Service may be something like Notifier, and your PostConfig, may be Notify
what do you think?

Yes, most of the configs are paths to certs. The current approach is to execute the plugins on each cert update (and let them do what they want with those certs), but yes, it is possible to keep them running and send a notification on updates.

MarcosDY · 2023-07-06T15:15:33Z

proto/plugin/plugin.proto

+message Empty {}
+
+message ConfigsRequest {
+    map<string,string> configs = 1;


what this configs are?
What data is the Plugin getting in order to understand where to find certs, or what kind of cert was received?
and how is each plugin configured? is it possible to provide data to this plugin?

The configs contains most of the spiffe-helper .conf fields and the plugin specific configurations

JU4N98 · 2023-07-10T12:41:48Z

Hi @faisal-memon, it would be great if you can take a look to this proof of concept. It is related to 65.

MarcosDY · 2023-07-21T14:11:45Z

pkg/notifier/notifier.proto

+}
+
+service Notifier {
+    rpc LoadConfigs(ConfigsRequest) returns (Empty) {};


mmm generally we create messages for request or response, no matter if they are empty,
but when we want to add fields in a future, it keep working without back compatibility issues.
So I suggest to add messages for both requests and response

MarcosDY · 2023-07-21T14:15:08Z

pkg/notifier/shared.go

+	grpc "google.golang.org/grpc"
+)
+
+type Notifier interface {


why are not you using notifier.NotifierServer? (the one autogenerated from proto)

kfox1111 · 2023-12-18T17:05:12Z

Whats the status of this? I think it is useful to the helm-charts-hardened project.

JU4N98 · 2023-12-20T18:57:00Z

Whats the status of this? I think it is useful to the helm-charts-hardened project.

Hi @kfox1111 I'm going to keep working on this

Signed-off-by: JU4N98 <[email protected]>

kfox1111 · 2023-12-28T14:22:49Z

A thought....

This plugin support requires spire-helper to execute the plugin. In a traditional environment, that works very well.

In a containerized environment such as Kubernetes though, that would require spire-helper along with the plugins to be in the same container, which is more difficult as generally those come from different sources. In that environment, its much easier for them to be different containers, have Kubernetes exec the containers, and share between them with unix sockets.

Could this pr be updated to support that mode of operation too?

JU4N98 · 2023-12-28T17:54:31Z

A thought....

This plugin support requires spire-helper to execute the plugin. In a traditional environment, that works very well.

In a containerized environment such as Kubernetes though, that would require spire-helper along with the plugins to be in the same container, which is more difficult as generally those come from different sources. In that environment, its much easier for them to be different containers, have Kubernetes exec the containers, and share between them with unix sockets.

Could this pr be updated to support that mode of operation too?

I think something like that is out of scope for this PR, the main idea was to add support for plugins that runs alongside the helper in the same container. But is the initial approach, maybe that could be added in other PR as other kind of plugins.

Signed-off-by: JU4N98 <[email protected]>

kfox1111 · 2023-12-28T21:46:42Z

Probably ok to do in a followon, but maybe make sure the api leaves room so that it can be done via socket instead of exec without having to move around config items?

kfox1111 · 2023-12-28T21:48:41Z

Looks like that could be done by adding a 'type' field or something to the plugin to specify that path is an executable (default) vs named socket, so, I think we're good already?

JU4N98 · 2023-12-29T14:38:54Z

Looks like that could be done by adding a 'type' field or something to the plugin to specify that path is an executable (default) vs named socket, so, I think we're good already?

Yes, a field like type should be enough to treat the differently. I think isn't necessary to add anything since I'm parsing each plugin into a map of string.

Signed-off-by: JU4N98 <[email protected]>

MarcosDY reviewed Jul 6, 2023

View reviewed changes

JU4N98 force-pushed the poc-add-plugins branch from a970048 to c54b46e Compare July 10, 2023 12:35

MarcosDY reviewed Jul 21, 2023

View reviewed changes

faisal-memon added this to the 0.9.0 milestone Dec 2, 2023

JU4N98 added 10 commits December 27, 2023 09:07

Adds plugin support and a simple plugin as example.

b76b9c1

Signed-off-by: JU4N98 <[email protected]>

Minor changes.

1f13db7

Signed-off-by: JU4N98 <[email protected]>

Adds previous comment.

739f980

Signed-off-by: JU4N98 <[email protected]>

Improves usage of external plugins.

2f30c59

Signed-off-by: JU4N98 <[email protected]>

Improves simple-example.

25a5475

Signed-off-by: JU4N98 <[email protected]>

Fixes lint errors.

b2771fa

Signed-off-by: JU4N98 <[email protected]>

Renames rpc methods, adds UpdateX509SVID rpc, plugins don't stop.

c87fed3

Signed-off-by: JU4N98 <[email protected]>

Adds checksum validation.

c30c437

Signed-off-by: JU4N98 <[email protected]>

Removes interface, adds messages.

1db30a3

Signed-off-by: JU4N98 <[email protected]>

Adds support for plugins that use JWTs.

fb121c7

Signed-off-by: JU4N98 <[email protected]>

JU4N98 force-pushed the poc-add-plugins branch from 0cbf201 to fb121c7 Compare December 27, 2023 19:01

JU4N98 marked this pull request as ready for review December 27, 2023 19:02

JU4N98 requested a review from faisal-memon as a code owner December 27, 2023 19:02

JU4N98 changed the title ~~PoC: Add Plugins~~ Add Plugins Dec 27, 2023

Fixes lint errors.

65835b2

Signed-off-by: JU4N98 <[email protected]>

JU4N98 requested a review from MarcosDY December 27, 2023 19:14

Updates README.

7c29265

Signed-off-by: JU4N98 <[email protected]>

Adds it for plugins.

d537634

Signed-off-by: JU4N98 <[email protected]>

faisal-memon modified the milestones: 0.9.0, 0.10.0 Oct 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Plugins #81

Add Plugins #81

JU4N98 commented Jul 4, 2023 •

edited

Loading

MarcosDY Jul 6, 2023

MarcosDY Jul 6, 2023

JU4N98 Jul 6, 2023

MarcosDY Jul 6, 2023

JU4N98 Jul 6, 2023

JU4N98 commented Jul 10, 2023

MarcosDY Jul 21, 2023

MarcosDY Jul 21, 2023

kfox1111 commented Dec 18, 2023

JU4N98 commented Dec 20, 2023

kfox1111 commented Dec 28, 2023

JU4N98 commented Dec 28, 2023 •

edited

Loading

kfox1111 commented Dec 28, 2023

kfox1111 commented Dec 28, 2023

JU4N98 commented Dec 29, 2023 •

edited

Loading

Add Plugins #81

Are you sure you want to change the base?

Add Plugins #81

Conversation

JU4N98 commented Jul 4, 2023 • edited Loading

Changes proposal:

MarcosDY Jul 6, 2023

Choose a reason for hiding this comment

MarcosDY Jul 6, 2023

Choose a reason for hiding this comment

JU4N98 Jul 6, 2023

Choose a reason for hiding this comment

MarcosDY Jul 6, 2023

Choose a reason for hiding this comment

JU4N98 Jul 6, 2023

Choose a reason for hiding this comment

JU4N98 commented Jul 10, 2023

MarcosDY Jul 21, 2023

Choose a reason for hiding this comment

MarcosDY Jul 21, 2023

Choose a reason for hiding this comment

kfox1111 commented Dec 18, 2023

JU4N98 commented Dec 20, 2023

kfox1111 commented Dec 28, 2023

JU4N98 commented Dec 28, 2023 • edited Loading

kfox1111 commented Dec 28, 2023

kfox1111 commented Dec 28, 2023

JU4N98 commented Dec 29, 2023 • edited Loading

JU4N98 commented Jul 4, 2023 •

edited

Loading

JU4N98 commented Dec 28, 2023 •

edited

Loading

JU4N98 commented Dec 29, 2023 •

edited

Loading