Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add Access Token callback Vault token reload #285

Merged
merged 8 commits into from
Oct 13, 2021

Conversation

lenny-goodell
Copy link
Member

@lenny-goodell lenny-goodell commented Oct 12, 2021

If your build fails due to your commit message not passing the build checks, please review the guidelines here: https://github.com/edgexfoundry/go-mod-bootstrap/blob/main/.github/Contributing.md

PR Checklist

Please check if your PR fulfills the following requirements:

  • I am not introducing a breaking change (if you are, flag in conventional commit message with BREAKING CHANGE: describing the break)
  • I am not introducing a new dependency (add notes below if you are)
  • I have added/updated unit tests for the new feature or bug fix (if not, why?)
  • I have fully tested (add details below) this the new feature or bug fix (if not, why?)
  • I have opened a PR for the related docs change (if not, why?) internal, not applicable

Testing Instructions

  1. Start edgex using compose builder using make run
  2. This will create the SecretStore for app-rules-engine
  3. Stop the App Rules Engine container
  4. Clone branch for this PR
  5. Add the following to app-functions-sdk-go go.mod
replace (
	github.com/edgexfoundry/go-mod-bootstrap/v2 => ../go-mod-bootstrap
)
  1. Add the following to app-service-configurable go.mod
replace github.com/edgexfoundry/app-functions-sdk-go/v2 => ../app-functions-sdk-go

replace github.com/edgexfoundry/go-mod-bootstrap/v2 => ../MODS/go-mod-bootstrap
  1. Build app service configurable. make build
  2. Run app service configurable with following command
 sudo EDGEX_SECURITY_SECRET_STORE=true ./app-service-configurable  -cp -r -p=rules-engine -o
  1. Restart Security Store Setup container
  2. From Consul set edgex/appservices/2.0/app-rules-engine/Writable/LogLevel to DEBUG
  3. Verify logs show following
level=INFO ts=2021-10-12T21:17:17.1307442Z app=app-rules-engine source=secrets.go:284 msg="context cancelled, dismiss the token renewal process"
level=INFO ts=2021-10-12T21:17:17.1337049Z app=app-rules-engine source=secrets.go:276 msg="kick off token renewal with interval: 30m0s"
level=INFO ts=2021-10-12T21:17:17.1567656Z app=app-rules-engine source=secrets.go:148 msg="successfully generated Consul token for service app-rules-engine"
level=INFO ts=2021-10-12T21:17:17.1568642Z app=app-rules-engine source=config.go:159 msg="Using Configuration Provider access token of length 36"
level=INFO ts=2021-10-12T21:17:17.1602663Z app=app-rules-engine source=config.go:479 msg="Writeable configuration has been updated from the Configuration Provider"
level=INFO ts=2021-10-12T21:17:17.1603564Z app=app-rules-engine source=config.go:485 msg="Logging level changed to DEBUG"
  1. Restart Security Store Setup container
  2. Send the following JSON to http://localhost:59701/api/v2/secret
{
  "apiVersion": "v2",
  "path" : "mqtt2",
  "secretData" : [
    {
      "key" : "username",
      "value" : "app-user"
    },
    {
      "key" : "password",
      "value" : "SuperDuperSecretPassword"
    }
  ]
}
  1. Verify 201 status returned and logs show following
level=DEBUG ts=2021-10-12T21:56:03.8954831Z app=app-rules-engine source=secrets.go:420 msg="Using Secrets URL of `http://localhost:8200/v1/secret/edgex/app-rules-engine/mqtt2`"
level=INFO ts=2021-10-12T21:56:03.8988297Z app=app-rules-engine source=secrets.go:284 msg="context cancelled, dismiss the token renewal process"
level=DEBUG ts=2021-10-12T21:56:03.9061821Z app=app-rules-engine source=secrets.go:420 msg="Using Secrets URL of `http://localhost:8200/v1/secret/edgex/app-rules-engine/mqtt2`"
level=INFO ts=2021-10-12T21:56:03.9062945Z app=app-rules-engine source=secrets.go:276 msg="kick off token renewal with interval: 30m0s"
  1. Restart Security Store Setup container
  2. Press CRTL C to stop app service
  3. Verify logs show following
^Clevel=INFO ts=2021-10-12T21:59:14.6273139Z app=app-rules-engine source=secrets.go:284 msg="context cancelled, dismiss the token renewal process"
level=INFO ts=2021-10-12T21:59:14.6273829Z app=app-rules-engine source=telemetry.go:83 msg="Exiting CPU Usage Average loop"
level=INFO ts=2021-10-12T21:59:14.6273512Z app=app-rules-engine source=messaging.go:123 msg="Exiting waiting for MessageBus 'edgex/events/#' topic messages"
level=INFO ts=2021-10-12T21:59:14.6272992Z app=app-rules-engine source=service.go:200 msg="Terminating signal received: interrupt"
level=INFO ts=2021-10-12T21:59:14.6274061Z app=app-rules-engine source=configupdates.go:62 msg="Exiting waiting for App Service configuration updates"
level=INFO ts=2021-10-12T21:59:14.6273722Z app=app-rules-engine source=messaging.go:139 msg="Exiting waiting for MessageBus errors and background publishing"
level=INFO ts=2021-10-12T21:59:14.627462Z app=app-rules-engine source=config.go:449 msg="Watching for '/Writable' configuration changes has stopped"
level=INFO ts=2021-10-12T21:59:14.6276276Z app=app-rules-engine source=bootstrap.go:135 msg="Un-Registering service from the Registry"
level=INFO ts=2021-10-12T21:59:14.6360734Z app=app-rules-engine source=secrets.go:276 msg="kick off token renewal with interval: 30m0s"
level=INFO ts=2021-10-12T21:59:14.6361582Z app=app-rules-engine source=secrets.go:284 msg="context cancelled, dismiss the token renewal process"
level=INFO ts=2021-10-12T21:59:14.6500755Z app=app-rules-engine source=secrets.go:148 msg="successfully generated Consul token for service app-rules-engine"
level=INFO ts=2021-10-12T21:59:14.6501655Z app=app-rules-engine source=registry.go:62 msg="Using Registry access token of length 36"
level=INFO ts=2021-10-12T21:59:14.6521669Z app=app-rules-engine source=messaging.go:168 msg="Disconnecting from the message bus"

New Dependency Instructions (If applicable)

N/A

Leonard Goodell added 7 commits October 12, 2021 12:42
Secrets are seeded from a JSON file specifed by the SecretStore.SecretsFile setting
If SecretsFile setting is blank, seeding is skipped.

closes #273

Signed-off-by: Leonard Goodell <[email protected]>
Signed-off-by: Leonard Goodell <[email protected]>
Copy link
Contributor

@jim-wang-intel jim-wang-intel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM except very tiny issue about extra comment

bootstrap/secret/secure.go Outdated Show resolved Hide resolved
Signed-off-by: Leonard Goodell <[email protected]>
@lenny-goodell
Copy link
Member Author

recheck

@lenny-goodell lenny-goodell merged commit 64217dd into edgexfoundry:main Oct 13, 2021
@lenny-goodell lenny-goodell deleted the RenewTokens branch October 13, 2021 15:32
judehung pushed a commit to IOTechSystems/go-mod-bootstrap that referenced this pull request Nov 15, 2021
* feat: Add Access Token callback and Vault token reload on Auth error

closes edgexfoundry#274

Signed-off-by: Leonard Goodell <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants