Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Secure Consul Ph. 1] Integrate ready-to-run signal with Consul bootstrapping done #3160

Closed
jim-wang-intel opened this issue Feb 9, 2021 · 0 comments · Fixed by #3273
Closed

[Secure Consul Ph. 1] Integrate ready-to-run signal with Consul bootstrapping done #3160

jim-wang-intel opened this issue Feb 9, 2021 · 0 comments · Fixed by #3273
Labels
enhancement New feature or request ireland security-services
Milestone
Ireland

Comments

@jim-wang-intel
Copy link
Contributor

jim-wang-intel commented Feb 9, 2021 •
edited
Loading

🚀 Feature Request

Relevant Package

This feature request is for security-bootstrapper

Description

Once consul bootstrapper is done with installation of agent-token, we need a way to signal it is complete and ready to accept the connection for other services.

Describe the solution you'd like

In security-bootstrapper, before raising the ready-to-run port/semaphore, we need to wait for consul agent token ready signal or port.
The consul bootstrapper also should implement a way to short-circuit the whole ACL and agent token bootstrapping to signal agent token ready if it has already done this successfully before (like 2nd time or later).

Describe alternatives you've considered

Have you considered any alternative solutions or workarounds?
@jim-wang-intel jim-wang-intel added the enhancement New feature or request label Feb 9, 2021
@jim-wang-intel jim-wang-intel changed the title [Secure Consul] Integrate ready-to-run signal with Consul [Secure Consul] Integrate ready-to-run signal with Consul bootstrapping done Feb 9, 2021
@jim-wang-intel jim-wang-intel added this to the Ireland milestone Feb 9, 2021
@jim-wang-intel jim-wang-intel changed the title [Secure Consul] Integrate ready-to-run signal with Consul bootstrapping done [Secure Consul Ph. 1] Integrate ready-to-run signal with Consul bootstrapping done Feb 10, 2021
jim-wang-intel added a commit to jim-wang-intel/edgex-go that referenced this issue Mar 18, 2021
@jim-wang-intel
feat(security): Implementation for adding ACL policies and roles
81908f6 
New addition for implementing for Consul's ACL policies creation and roles for Consul tokens generated later on
 - Add logic to check whehter the ACL policy is already pre-existing before creation of new policy
 - Add implementation to create a new ACL policy
 - Add implementation to create a role for EdgeX's services via Vault's /consul/roles/* APIs: this sets the stage for creating role-based Consul tokens used by EdgeX services
 - Add logic for creating token roles based on EdgeX service keys from configuration file
 - Add implementation to create registry management token and store it into a file
 - Update token-file-provider on edgex's default policy to add the permission for calling /consul/creds/"service-key" endpoint

Closes: edgexfoundry#3158, edgexfoundry#3254, edgexfoundry#3160

Signed-off-by: Jim Wang <[email protected]>
jim-wang-intel added a commit to jim-wang-intel/edgex-go that referenced this issue Mar 18, 2021
@jim-wang-intel
feat(security): Implementation for adding ACL policies and roles
1563183 
New addition for implementing for Consul's ACL policies creation and roles for Consul tokens generated later on via `go-mod-secret`
 - Add logic to check whether the ACL policy is already per-existing before creation of new policy
 - Add implementation to create a new ACL policy
 - Add implementation to create a role for EdgeX's services via Vault's /consul/roles/* APIs: this sets the stage for creating role-based Consul tokens used by EdgeX services
 - Add logic for creating token roles based on EdgeX service keys from configuration file
 - Add implementation to create registry management token and store it into a file
 - Update token-file-provider on edgex's default policy to add the permission for calling /consul/creds/"service-key" endpoint

Closes: edgexfoundry#3158, edgexfoundry#3254, edgexfoundry#3160

Signed-off-by: Jim Wang <[email protected]>
@jim-wang-intel jim-wang-intel mentioned this issue Mar 18, 2021
Merged
3 tasks
@jim-wang-intel jim-wang-intel linked a pull request Mar 18, 2021 that will close this issue
feat(security): Implementation for adding Consul ACL policies, roles #3273
Merged
3 tasks
jim-wang-intel added a commit to jim-wang-intel/edgex-go that referenced this issue Mar 19, 2021
@jim-wang-intel
feat(security): Implementation for adding ACL policies and roles
8d101f2 
New addition for implementing for Consul's ACL policies creation and roles for Consul tokens generated later on via `go-mod-secret`
 - Add logic to check whether the ACL policy is already per-existing before creation of new policy
 - Add implementation to create a new ACL policy
 - Add implementation to create a role for EdgeX's services via Vault's /consul/roles/* APIs: this sets the stage for creating role-based Consul tokens used by EdgeX services
 - Add logic for creating token roles based on EdgeX service keys from configuration file
 - Add implementation to create registry management token and store it into a file
 - Update token-file-provider on edgex's default policy to add the permission for calling /consul/creds/"service-key" endpoint

Closes: edgexfoundry#3158, edgexfoundry#3254, edgexfoundry#3160

Signed-off-by: Jim Wang <[email protected]>
jim-wang-intel added a commit to jim-wang-intel/edgex-go that referenced this issue Mar 19, 2021
@jim-wang-intel
feat(security): Implementation for adding ACL policies and roles
c258ad2 
New addition for implementing for Consul's ACL policies creation and roles for Consul tokens generated later on via `go-mod-secret`
 - Add logic to check whether the ACL policy is already per-existing before creation of new policy
 - Add implementation to create a new ACL policy
 - Add implementation to create a role for EdgeX's services via Vault's /consul/roles/* APIs: this sets the stage for creating role-based Consul tokens used by EdgeX services
 - Add logic for creating token roles based on EdgeX service keys from configuration file
 - Add implementation to create registry management token and store it into a file
 - Update token-file-provider on edgex's default policy to add the permission for calling /consul/creds/"service-key" endpoint

Closes: edgexfoundry#3158, edgexfoundry#3254, edgexfoundry#3160

Signed-off-by: Jim Wang <[email protected]>
jim-wang-intel added a commit to jim-wang-intel/edgex-go that referenced this issue Mar 22, 2021
@jim-wang-intel
feat(security): Implementation for adding ACL policies and roles
ade5e89 
New addition for implementing for Consul's ACL policies creation and roles for Consul tokens generated later on via go-mod-secret
 - Add logic to check whether the ACL policy is already per-existing before creation of new policy
 - Add implementation to create a new ACL policy
 - Add implementation to create a role for EdgeX's services via Vault's /consul/roles/* APIs: this sets the stage for creating role-based Consul tokens used by EdgeX services
 - Add logic for creating token roles based on EdgeX service keys from configuration file
 - Update token-file-provider on edgex's default policy to add the permission for calling /consul/creds/"service-key" endpoint

Closes: edgexfoundry#3254, edgexfoundry#3160

Signed-off-by: Jim Wang <[email protected]>
jim-wang-intel added a commit that referenced this issue Mar 22, 2021
@jim-wang-intel
feat(security): Implementation for adding ACL policies and roles (#3273)
8b8c045 
New addition for implementing for Consul's ACL policies creation and roles for Consul tokens generated later on via go-mod-secret
 - Add logic to check whether the ACL policy is already per-existing before creation of new policy
 - Add implementation to create a new ACL policy
 - Add implementation to create a role for EdgeX's services via Vault's /consul/roles/* APIs: this sets the stage for creating role-based Consul tokens used by EdgeX services
 - Add logic for creating token roles based on EdgeX service keys from configuration file
 - Update token-file-provider on edgex's default policy to add the permission for calling /consul/creds/"service-key" endpoint

Closes: #3254, #3160

Signed-off-by: Jim Wang <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request ireland security-services
Projects
None yet
Milestone
Ireland
Development

Successfully merging a pull request may close this issue.

feat(security): Implementation for adding Consul ACL policies, roles jim-wang-intel/edgex-go
1 participant
@jim-wang-intel