Add a config endpoint on a new api server

cmd/agent/api/listener.go

@@ -22,10 +22,6 @@ func getIPCAddressPort() (string, error) {
 }
 
 // getListener returns a listening connection
-func getListener() (net.Listener, error) {
-	address, err := getIPCAddressPort()
-	if err != nil {
-		return nil, err
-	}
+func getListener(address string) (net.Listener, error) {
 	return net.Listen("tcp", address)
 }

cmd/agent/api/security.go

@@ -17,12 +17,6 @@ import (
 	"github.com/DataDog/datadog-agent/pkg/api/util"
 )
 
-var (
-	tlsKeyPair  *tls.Certificate
-	tlsCertPool *x509.CertPool
-	tlsAddr     string
-)
-
 // validateToken - validates token for legacy API
 func validateToken(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -47,13 +41,9 @@ func parseToken(token string) (interface{}, error) {
 	return struct{}{}, nil
 }
 
-func buildSelfSignedKeyPair() ([]byte, []byte) {
-
+func buildSelfSignedKeyPair(extraHosts ...string) ([]byte, []byte) {
 	hosts := []string{"127.0.0.1", "localhost", "::1"}
-	ipcAddr, err := getIPCAddressPort()
-	if err == nil {
-		hosts = append(hosts, ipcAddr)
-	}
+	hosts = append(hosts, extraHosts...)
 	_, rootCertPEM, rootKey, err := security.GenerateRootCert(hosts, 2048)
 	if err != nil {
 		return nil, nil
@@ -68,26 +58,21 @@ func buildSelfSignedKeyPair() ([]byte, []byte) {
 	return rootCertPEM, rootKeyPEM
 }
 
-func initializeTLS() error {
-	cert, key := buildSelfSignedKeyPair()
+func initializeTLS(extraHosts ...string) (*tls.Certificate, *x509.CertPool, error) {
+	cert, key := buildSelfSignedKeyPair(extraHosts...)
 	if cert == nil {
-		return errors.New("unable to generate certificate")
+		return nil, nil, errors.New("unable to generate certificate")
 	}
 	pair, err := tls.X509KeyPair(cert, key)
 	if err != nil {
-		return fmt.Errorf("unable to generate TLS key pair: %v", err)
+		return nil, nil, fmt.Errorf("unable to generate TLS key pair: %v", err)
 	}
-	tlsKeyPair = &pair
-	tlsCertPool = x509.NewCertPool()
+
+	tlsCertPool := x509.NewCertPool()
 	ok := tlsCertPool.AppendCertsFromPEM(cert)
 	if !ok {
-		return fmt.Errorf("unable to add new certificate to pool")
-	}
-
-	tlsAddr, err = getIPCAddressPort()
-	if err != nil {
-		return fmt.Errorf("unable to get IPC address and port: %v", err)
+		return nil, nil, fmt.Errorf("unable to add new certificate to pool")
 	}
 
-	return nil
+	return &pair, tlsCertPool, nil
 }

cmd/agent/api/server.go

@@ -11,28 +11,19 @@ sending commands and receiving infos.
 package api
 
 import (
-	"context"
 	"crypto/tls"
 	"fmt"
 	stdLog "log"
 	"net"
 	"net/http"
-	"time"
+	"strconv"
 
 	"github.com/cihub/seelog"
-	gorilla "github.com/gorilla/mux"
-	grpc_auth "github.com/grpc-ecosystem/go-grpc-middleware/auth"
-	"github.com/grpc-ecosystem/grpc-gateway/runtime"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials"
-
-	"github.com/DataDog/datadog-agent/cmd/agent/api/internal/agent"
-	"github.com/DataDog/datadog-agent/cmd/agent/api/internal/check"
+
 	"github.com/DataDog/datadog-agent/comp/aggregator/demultiplexer"
 	"github.com/DataDog/datadog-agent/comp/core/flare"
 	"github.com/DataDog/datadog-agent/comp/core/secrets"
 	"github.com/DataDog/datadog-agent/comp/core/workloadmeta"
-	workloadmetaServer "github.com/DataDog/datadog-agent/comp/core/workloadmeta/server"
 	"github.com/DataDog/datadog-agent/comp/dogstatsd/replay"
 	dogstatsdServer "github.com/DataDog/datadog-agent/comp/dogstatsd/server"
 	dogstatsddebug "github.com/DataDog/datadog-agent/comp/dogstatsd/serverDebug"
@@ -44,14 +35,22 @@ import (
 	"github.com/DataDog/datadog-agent/pkg/api/util"
 	"github.com/DataDog/datadog-agent/pkg/config"
 	remoteconfig "github.com/DataDog/datadog-agent/pkg/config/remote/service"
-	pb "github.com/DataDog/datadog-agent/pkg/proto/pbgo/core"
-	"github.com/DataDog/datadog-agent/pkg/tagger"
-	taggerserver "github.com/DataDog/datadog-agent/pkg/tagger/server"
-	grpcutil "github.com/DataDog/datadog-agent/pkg/util/grpc"
+	"github.com/DataDog/datadog-agent/pkg/util/log"
 	"github.com/DataDog/datadog-agent/pkg/util/optional"
 )
 
-var listener net.Listener
+func startServer(listener net.Listener, srv *http.Server, name string) {
+	// Use a stack depth of 4 on top of the default one to get a relevant filename in the stdlib
+	logWriter, _ := config.NewLogWriter(5, seelog.ErrorLvl)
+
+	srv.ErrorLog = stdLog.New(logWriter, fmt.Sprintf("Error from the agent http %s: ", name), 0) // log errors to seelog
+
+	tlsListener := tls.NewListener(listener, srv.TLSConfig)
+
+	go srv.Serve(tlsListener) //nolint:errcheck
+
+	log.Infof("%s started on %s", name, listener.Addr().String())
+}
 
 // StartServer creates the router and starts the HTTP server
 func StartServer(
@@ -69,124 +68,64 @@ func StartServer(
 	invHost inventoryhost.Component,
 	secretResolver secrets.Component,
 ) error {
-	err := initializeTLS()
+	apiAddr, err := getIPCAddressPort()
 	if err != nil {
-		return fmt.Errorf("unable to initialize TLS: %v", err)
+		return fmt.Errorf("unable to get IPC address and port: %v", err)
 	}
 
-	// get the transport we're going to use under HTTP
-	listener, err = getListener()
-	if err != nil {
-		// we use the listener to handle commands for the Agent, there's
-		// no way we can recover from this error
-		return fmt.Errorf("Unable to create the api server: %v", err)
-	}
+	extraHosts := []string{apiAddr}
 
-	err = util.CreateAndSetAuthToken()
-	if err != nil {
-		return err
-	}
+	ipcHost := config.Datadog.GetString("agent_ipc_host")
+	apiConfigPort := config.Datadog.GetInt("agent_ipc_port")
+	apiConfigEnabled := apiConfigPort > 0
+	apiConfigHostPort := net.JoinHostPort(ipcHost, strconv.Itoa(apiConfigPort))
 
-	// gRPC server
-	authInterceptor := grpcutil.AuthInterceptor(parseToken)
-	opts := []grpc.ServerOption{
-		grpc.Creds(credentials.NewClientTLSFromCert(tlsCertPool, tlsAddr)),
-		grpc.StreamInterceptor(grpc_auth.StreamServerInterceptor(authInterceptor)),
-		grpc.UnaryInterceptor(grpc_auth.UnaryServerInterceptor(authInterceptor)),
+	if apiConfigEnabled {
+		extraHosts = append(extraHosts, apiConfigHostPort)
 	}
 
-	s := grpc.NewServer(opts...)
-	pb.RegisterAgentServer(s, &server{})
-	pb.RegisterAgentSecureServer(s, &serverSecure{
-		configService: configService,
-		taggerServer:  taggerserver.NewServer(tagger.GetDefaultTagger()),
-		// TODO(components): decide if workloadmetaServer should be componentized itself
-		workloadmetaServer: workloadmetaServer.NewServer(wmeta),
-		dogstatsdServer:    dogstatsdServer,
-		capture:            capture,
-	})
-
-	dcreds := credentials.NewTLS(&tls.Config{
-		ServerName: tlsAddr,
-		RootCAs:    tlsCertPool,
-	})
-	dopts := []grpc.DialOption{grpc.WithTransportCredentials(dcreds)}
-
-	// starting grpc gateway
-	ctx := context.Background()
-	gwmux := runtime.NewServeMux()
-	err = pb.RegisterAgentHandlerFromEndpoint(
-		ctx, gwmux, tlsAddr, dopts)
+	tlsKeyPair, tlsCertPool, err := initializeTLS(extraHosts...)
 	if err != nil {
-		return fmt.Errorf("error registering agent handler from endpoint %s: %v", tlsAddr, err)
+		return fmt.Errorf("unable to initialize TLS: %v", err)
 	}
 
-	err = pb.RegisterAgentSecureHandlerFromEndpoint(
-		ctx, gwmux, tlsAddr, dopts)
-	if err != nil {
-		return fmt.Errorf("error registering agent secure handler from endpoint %s: %v", tlsAddr, err)
+	tlsConfig := &tls.Config{
+		Certificates: []tls.Certificate{*tlsKeyPair},
+		NextProtos:   []string{"h2"},
+		MinVersion:   tls.VersionTLS12,
 	}
 
-	// Setup multiplexer
-	// create the REST HTTP router
-	agentMux := gorilla.NewRouter()
-	checkMux := gorilla.NewRouter()
-	// Validate token for every request
-	agentMux.Use(validateToken)
-	checkMux.Use(validateToken)
-
-	mux := http.NewServeMux()
-	mux.Handle(
-		"/agent/",
-		http.StripPrefix("/agent",
-			agent.SetupHandlers(
-				agentMux,
-				flare,
-				dogstatsdServer,
-				serverDebug,
-				wmeta,
-				logsAgent,
-				senderManager,
-				hostMetadata,
-				invAgent,
-				demux,
-				invHost,
-				secretResolver,
-			)))
-	mux.Handle("/check/", http.StripPrefix("/check", check.SetupHandlers(checkMux)))
-	mux.Handle("/", gwmux)
-
-	// Use a stack depth of 4 on top of the default one to get a relevant filename in the stdlib
-	logWriter, _ := config.NewLogWriter(5, seelog.ErrorLvl)
-
-	srv := grpcutil.NewMuxedGRPCServer(
-		tlsAddr,
-		&tls.Config{
-			Certificates: []tls.Certificate{*tlsKeyPair},
-			NextProtos:   []string{"h2"},
-			MinVersion:   tls.VersionTLS12,
-		},
-		s,
-		grpcutil.TimeoutHandlerFunc(mux, time.Duration(config.Datadog.GetInt64("server_timeout"))*time.Second),
-	)
+	if err := util.CreateAndSetAuthToken(); err != nil {
+		return err
+	}
 
-	srv.ErrorLog = stdLog.New(logWriter, "Error from the agent http API server: ", 0) // log errors to seelog
+	if err := startCMDServer(
+		apiAddr, tlsConfig, tlsCertPool,
+		configService, flare, dogstatsdServer,
+		capture, serverDebug, wmeta, logsAgent,
+		senderManager, hostMetadata, invAgent,
+		demux, invHost, secretResolver,
+	); err != nil {
+		return err
+	}
 
-	tlsListener := tls.NewListener(listener, srv.TLSConfig)
+	if apiConfigEnabled {
+		if err := startIPCServer(apiConfigHostPort, tlsConfig); err != nil {
+			StopServer()
+			return err
+		}
+	}
 
-	go srv.Serve(tlsListener) //nolint:errcheck
 	return nil
 }
 
 // StopServer closes the connection and the server
 // stops listening to new commands.
 func StopServer() {
-	if listener != nil {
-		listener.Close()
+	if cmdListener != nil {
+		cmdListener.Close()
+	}
+	if ipcConfigListener != nil {
+		ipcConfigListener.Close()
 	}
-}
-
-// ServerAddress retruns the server address.
-func ServerAddress() *net.TCPAddr {
-	return listener.Addr().(*net.TCPAddr)
 }