mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-23 11:50:44 +00:00
Move the common logic of checking for kms-plugin's version into gRPC client interceptor.
This commit is contained in:
parent
46b33af8ef
commit
d2b4723302
@ -61,29 +61,31 @@ func NewGRPCService(endpoint string, callTimeout time.Duration) (Service, error)
|
|||||||
return nil, err
|
return nil, err
|
||||||
}
|
}
|
||||||
|
|
||||||
connection, err := grpc.Dial(addr, grpc.WithInsecure(), grpc.WithDefaultCallOptions(grpc.WaitForReady(true)), grpc.WithContextDialer(
|
s := &gRPCService{callTimeout: callTimeout}
|
||||||
func(context.Context, string) (net.Conn, error) {
|
s.connection, err = grpc.Dial(
|
||||||
// Ignoring addr and timeout arguments:
|
addr,
|
||||||
// addr - comes from the closure
|
grpc.WithInsecure(),
|
||||||
c, err := net.DialUnix(unixProtocol, nil, &net.UnixAddr{Name: addr})
|
grpc.WithUnaryInterceptor(s.interceptor),
|
||||||
if err != nil {
|
grpc.WithDefaultCallOptions(grpc.WaitForReady(true)),
|
||||||
klog.Errorf("failed to create connection to unix socket: %s, error: %v", addr, err)
|
grpc.WithContextDialer(
|
||||||
} else {
|
func(context.Context, string) (net.Conn, error) {
|
||||||
klog.V(4).Infof("Successfully dialed Unix socket %v", addr)
|
// Ignoring addr and timeout arguments:
|
||||||
}
|
// addr - comes from the closure
|
||||||
return c, err
|
c, err := net.DialUnix(unixProtocol, nil, &net.UnixAddr{Name: addr})
|
||||||
}))
|
if err != nil {
|
||||||
|
klog.Errorf("failed to create connection to unix socket: %s, error: %v", addr, err)
|
||||||
|
} else {
|
||||||
|
klog.V(4).Infof("Successfully dialed Unix socket %v", addr)
|
||||||
|
}
|
||||||
|
return c, err
|
||||||
|
}))
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("failed to create connection to %s, error: %v", endpoint, err)
|
return nil, fmt.Errorf("failed to create connection to %s, error: %v", endpoint, err)
|
||||||
}
|
}
|
||||||
|
|
||||||
kmsClient := kmsapi.NewKeyManagementServiceClient(connection)
|
s.kmsClient = kmsapi.NewKeyManagementServiceClient(s.connection)
|
||||||
return &gRPCService{
|
return s, nil
|
||||||
kmsClient: kmsClient,
|
|
||||||
connection: connection,
|
|
||||||
callTimeout: callTimeout,
|
|
||||||
}, nil
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Parse the endpoint to extract schema, host or path.
|
// Parse the endpoint to extract schema, host or path.
|
||||||
@ -139,10 +141,6 @@ func (g *gRPCService) Decrypt(cipher []byte) ([]byte, error) {
|
|||||||
ctx, cancel := context.WithTimeout(context.Background(), g.callTimeout)
|
ctx, cancel := context.WithTimeout(context.Background(), g.callTimeout)
|
||||||
defer cancel()
|
defer cancel()
|
||||||
|
|
||||||
if err := g.checkAPIVersion(ctx); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
|
|
||||||
request := &kmsapi.DecryptRequest{Cipher: cipher, Version: kmsapiVersion}
|
request := &kmsapi.DecryptRequest{Cipher: cipher, Version: kmsapiVersion}
|
||||||
response, err := g.kmsClient.Decrypt(ctx, request)
|
response, err := g.kmsClient.Decrypt(ctx, request)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
@ -155,9 +153,6 @@ func (g *gRPCService) Decrypt(cipher []byte) ([]byte, error) {
|
|||||||
func (g *gRPCService) Encrypt(plain []byte) ([]byte, error) {
|
func (g *gRPCService) Encrypt(plain []byte) ([]byte, error) {
|
||||||
ctx, cancel := context.WithTimeout(context.Background(), g.callTimeout)
|
ctx, cancel := context.WithTimeout(context.Background(), g.callTimeout)
|
||||||
defer cancel()
|
defer cancel()
|
||||||
if err := g.checkAPIVersion(ctx); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
|
|
||||||
request := &kmsapi.EncryptRequest{Plain: plain, Version: kmsapiVersion}
|
request := &kmsapi.EncryptRequest{Plain: plain, Version: kmsapiVersion}
|
||||||
response, err := g.kmsClient.Encrypt(ctx, request)
|
response, err := g.kmsClient.Encrypt(ctx, request)
|
||||||
@ -166,3 +161,21 @@ func (g *gRPCService) Encrypt(plain []byte) ([]byte, error) {
|
|||||||
}
|
}
|
||||||
return response.Cipher, nil
|
return response.Cipher, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func (g *gRPCService) interceptor(
|
||||||
|
ctx context.Context,
|
||||||
|
method string,
|
||||||
|
req interface{},
|
||||||
|
reply interface{},
|
||||||
|
cc *grpc.ClientConn,
|
||||||
|
invoker grpc.UnaryInvoker,
|
||||||
|
opts ...grpc.CallOption,
|
||||||
|
) error {
|
||||||
|
if !kmsapi.IsVersionCheckMethod(method) {
|
||||||
|
if err := g.checkAPIVersion(ctx); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return invoker(ctx, method, req, reply, cc, opts...)
|
||||||
|
}
|
||||||
|
@ -2,7 +2,10 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library")
|
|||||||
|
|
||||||
go_library(
|
go_library(
|
||||||
name = "go_default_library",
|
name = "go_default_library",
|
||||||
srcs = ["service.pb.go"],
|
srcs = [
|
||||||
|
"service.pb.go",
|
||||||
|
"v1beta1.go",
|
||||||
|
],
|
||||||
importmap = "k8s.io/kubernetes/vendor/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1",
|
importmap = "k8s.io/kubernetes/vendor/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1",
|
||||||
importpath = "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1",
|
importpath = "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1",
|
||||||
visibility = ["//visibility:public"],
|
visibility = ["//visibility:public"],
|
||||||
|
@ -0,0 +1,23 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2019 The Kubernetes Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package v1beta1 contains definition of kms-plugin's gRPC service.
|
||||||
|
package v1beta1
|
||||||
|
|
||||||
|
// IsVersionCheckMethod determines whether the supplied method is a version check against kms-plugin.
|
||||||
|
func IsVersionCheckMethod(method string) bool {
|
||||||
|
return method == "/v1beta1.KeyManagementService/Version"
|
||||||
|
}
|
Loading…
Reference in New Issue
Block a user