Add a config endpoint on a new api server

cmd/agent/api/internal/config/endpoint.go

@@ -0,0 +1,73 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+// Package config defines the config endpoint of the IPC API Server.
+package config
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	gorilla "github.com/gorilla/mux"
+
+	"github.com/DataDog/datadog-agent/pkg/config"
+	"github.com/DataDog/datadog-agent/pkg/util/log"
+)
+
+type authorizedSet map[string]struct{}
+
+var authorizedConfigPaths = authorizedSet{
+	"api_key": {},
+}
+
+// GetConfigEndpointMux builds and returns the mux for the config endpoint
+func GetConfigEndpointMux(cfg config.Reader) *gorilla.Router {
+	return getConfigEndpointMux(cfg, authorizedConfigPaths)
+}
+
+func getConfigEndpointMux(cfg config.Reader, allowedConfigPaths map[string]struct{}) *gorilla.Router {
+	configEndpointHandler := func(w http.ResponseWriter, r *http.Request) {
+		body, statusCode, err := getConfigValueAsJSON(cfg, r, allowedConfigPaths)
+		if err != nil {
+			http.Error(w, err.Error(), statusCode)
+			return
+		}
+
+		w.WriteHeader(statusCode)
+		_, _ = w.Write(body)
+	}
+
+	configEndpointMux := gorilla.NewRouter()
+	configEndpointMux.HandleFunc("/", configEndpointHandler).Methods("GET")
+	configEndpointMux.HandleFunc("/{path}", configEndpointHandler).Methods("GET")
+
+	return configEndpointMux
+}
+
+// returns the marshalled JSON value of the config path requested
+// or an error and http status code in case of failure
+func getConfigValueAsJSON(cfg config.Reader, r *http.Request, allowedConfigPaths map[string]struct{}) ([]byte, int, error) {
+	vars := gorilla.Vars(r)
+	path := vars["path"]
+
+	if _, ok := allowedConfigPaths[path]; !ok {
+		log.Warnf("config endpoint received a request from '%s' for config '%s' which is not allowed", r.RemoteAddr, path)
+		return nil, http.StatusForbidden, fmt.Errorf("querying config value '%s' is not allowed", path)
+	}
+
+	log.Debug("config endpoint received a request from '%s' for config '%s'", r.RemoteAddr, path)
+	value := cfg.Get(path)
+	if value == nil {
+		return nil, http.StatusNotFound, fmt.Errorf("no runtime setting found for %s", path)
+	}
+
+	body, err := json.Marshal(value)
+	if err != nil {
+		return nil, http.StatusInternalServerError, fmt.Errorf("could not marshal config value of '%s': %v", path, err)
+	}
+
+	return body, http.StatusOK, nil
+}

cmd/agent/api/internal/config/endpoint_test.go

@@ -0,0 +1,99 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+package config
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/DataDog/datadog-agent/pkg/config"
+)
+
+func testConfigValue(t *testing.T, server *httptest.Server, configName string, expectedStatus int) {
+	t.Helper()
+
+	resp, err := server.Client().Get(server.URL + "/" + configName)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+
+	require.Equal(t, expectedStatus, resp.StatusCode, string(body))
+
+	if resp.StatusCode != http.StatusOK {
+		return
+	}
+
+	var configValue interface{}
+	err = json.Unmarshal(body, &configValue)
+	require.NoError(t, err)
+
+	require.EqualValues(t, config.Datadog.Get(configName), configValue)
+}
+
+func TestConfigEndpoint(t *testing.T) {
+	t.Run("real allowed default", func(t *testing.T) {
+		cfg, server := getConfigServer(t, authorizedConfigPaths)
+		for configName := range authorizedConfigPaths {
+			var expectedStatus int
+			if cfg.IsSet(configName) {
+				expectedStatus = http.StatusOK
+			} else {
+				expectedStatus = http.StatusNotFound
+			}
+			testConfigValue(t, server, configName, expectedStatus)
+		}
+	})
+
+	t.Run("authorized existing", func(t *testing.T) {
+		configName := "my.config.value"
+		cfg, server := getConfigServer(t, authorizedSet{configName: {}})
+		cfg.SetWithoutSource(configName, "some_value")
+		testConfigValue(t, server, configName, http.StatusOK)
+	})
+
+	t.Run("authorized missing", func(t *testing.T) {
+		configName := "my.config.value"
+		_, server := getConfigServer(t, authorizedSet{configName: {}})
+		testConfigValue(t, server, configName, http.StatusNotFound)
+	})
+
+	t.Run("authorized not marshallable", func(t *testing.T) {
+		configName := "my.config.value"
+		cfg, server := getConfigServer(t, authorizedSet{configName: {}})
+		cfg.SetWithoutSource(configName, make(chan int))
+		testConfigValue(t, server, "my.config.value", http.StatusInternalServerError)
+	})
+
+	t.Run("unauthorized existing", func(t *testing.T) {
+		cfg, server := getConfigServer(t, authorizedSet{})
+		configName := "my.config.value"
+		cfg.SetWithoutSource(configName, "some_value")
+		testConfigValue(t, server, configName, http.StatusForbidden)
+	})
+
+	t.Run("unauthorized missing", func(t *testing.T) {
+		_, server := getConfigServer(t, authorizedSet{})
+		testConfigValue(t, server, "my.config.value", http.StatusForbidden)
+	})
+}
+
+func getConfigServer(t *testing.T, authorizedConfigPaths map[string]struct{}) (*config.MockConfig, *httptest.Server) {
+	t.Helper()
+
+	cfg := config.Mock(t)
+	configEndpointMux := getConfigEndpointMux(cfg, authorizedConfigPaths)
+	server := httptest.NewServer(configEndpointMux)
+	t.Cleanup(server.Close)
+
+	return cfg, server
+}

cmd/agent/api/server_ipc.go

@@ -7,35 +7,30 @@ package api
 
 import (
 	"crypto/tls"
-	"encoding/json"
-	"fmt"
 	"net"
 	"net/http"
 	"time"
 
-	gorilla "github.com/gorilla/mux"
-
+	configendpoint "github.com/DataDog/datadog-agent/cmd/agent/api/internal/config"
 	"github.com/DataDog/datadog-agent/pkg/config"
-	"github.com/DataDog/datadog-agent/pkg/util/log"
 )
 
 const ipc_server_name string = "IPC API Server"
 
 var ipcListener net.Listener
-var allowedConfigPaths = map[string]struct{}{
-	"api_key": {},
-}
 
 func startIPCServer(ipcServerAddr string, tlsConfig *tls.Config) (err error) {
 	ipcListener, err = getListener(ipcServerAddr)
 	if err != nil {
 		return err
 	}
 
+	configEndpointMux := configendpoint.GetConfigEndpointMux(config.Datadog)
+	configEndpointMux.Use(validateToken)
 	ipcMux := http.NewServeMux()
 	ipcMux.Handle(
 		"/config/",
-		http.StripPrefix("/config", getConfigEndpointMux()))
+		http.StripPrefix("/config", configEndpointMux))
 
 	ipcServer := &http.Server{
 		Addr:      ipcServerAddr,
@@ -48,42 +43,6 @@ func startIPCServer(ipcServerAddr string, tlsConfig *tls.Config) (err error) {
 	return nil
 }
 
-func getConfigEndpointMux() *gorilla.Router {
-	configEndpointHandler := func(w http.ResponseWriter, r *http.Request) {
-		body, err := getConfigValueAsJSON(r)
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusBadRequest)
-			return
-		}
-		_, _ = w.Write(body)
-	}
-
-	configEndpointMux := gorilla.NewRouter()
-	configEndpointMux.HandleFunc("/", configEndpointHandler).Methods("GET")
-	configEndpointMux.HandleFunc("/{path}", configEndpointHandler).Methods("GET")
-	configEndpointMux.Use(validateToken)
-
-	return configEndpointMux
-}
-
-func getConfigValueAsJSON(r *http.Request) ([]byte, error) {
-	vars := gorilla.Vars(r)
-	path := vars["path"]
-
-	if _, ok := allowedConfigPaths[path]; !ok {
-		log.Warn("config endpoint received a request from '%s' for config '%s' which is not allowed", r.RemoteAddr, path)
-		return nil, fmt.Errorf("querying config value '%s' is not allowed", path)
-	}
-
-	log.Debug("config endpoint received a request from '%s' for config '%s'", r.RemoteAddr, path)
-	value := config.Datadog.Get(path)
-	if value == nil {
-		return nil, fmt.Errorf("no runtime setting found for %s", path)
-	}
-
-	return json.Marshal(value)
-}
-
 func stopIPCServer() {
 	stopServer(ipcListener, ipc_server_name)
 }