Client Certificate Authentication for GCP Cloud SQL #9991
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
the
database-access
jimbishopp
changed the title
r0mant
reviewed
Jan 28, 2022
smallinsky
reviewed
Jan 28, 2022
jimbishopp
force-pushed
the
jim/gcp-mtls
branch
from
0d12ffc to
6dfa159
Compare
auto-merge was automatically disabled
January 28, 2022 22:08
Pull Request is not mergeable
jimbishopp
force-pushed
the
jim/gcp-mtls
branch
2 times, most recently
from
59769e2 to
3e075aa
Compare
Allow users to secure Cloud SQL instances by setting "Allow only SSL connections". Generate client certificates using the GenerateEphemeralCert function in the Google API (added to the Connect service in v0.51). Workaround issue with mysql's cloud instance not trusting the generated cert's CA by connecting to the cloud proxy port instead.
jimbishopp
force-pushed
the
jim/gcp-mtls
branch
from
e72981a to
c1b36c8
Compare
|
@r0mant @smallinsky Backwards compatibility looks like it is working and I was able to backport to v8. Users are able to login with their current IAM configs as long as SSL is disabled. When enabled, an error message is displayed letting them know they need to update their permissions. |
r0mant
approved these changes
Jan 31, 2022
|
@jimbishopp Once this gets approved/merged, let's please backport to v8 as well. Thanks! |
smallinsky
approved these changes
Jan 31, 2022
jimbishopp
added a commit
that referenced
this pull request
Jan 31, 2022
Allow users to secure GCP Cloud SQL instances by setting "Allow only SSL connections", which enforces client certificate authentication. This implementation does not require any configuration changes for Teleport users. Teleport will detect whether client certificate authentication is required and handle either case automatically. Client certificates are ephemeral. They are created for every connection by calling the GCP Cloud SQL API's GenerateEphemeralCert function. Certificates are only created when the destination Cloud SQL instance is configured to require client certificate authentication. The configuration is detected by requesting instance settings from the GCP Cloud SQL API on every connection attempt. A special case was implemented for MySQL. MySQL servers in GCP Cloud SQL do not trust the ephemeral certificate's CA but GCP Cloud Proxy does. To work around this issue, the implementation will connect to the MySQL Cloud Proxy port using a TLS dialer instead of the default MySQL port when client certificate authentication is required. The common.CloudClients interface and implementation now return an interface (GCPSQLAdminClient) from the GetGCPSQLAdminClient function instead of the GCP client's sqladmin.Service. Returning an interface simplified calling code and allowed for the client to be mocked for testing. Existing GCP Cloud SQL tests are configured to not require client certificate authentication by default. A new test named TestGCPRequireSSL was created to simulate client certificate authentication for both Postgres and MySQL. This required some minor changes to the test server code. A new ConnectWithDialer function was added to the github.com/gravitational/go-mysql fork. This function is available upstream in v1.4.0 but other changes upstream resulted in a number of errors and a panic processing network packets. So instead of upgrading, the dialer function was copied to the Teleport fork and a custom version was created instead: v1.1.1-teleport.1.
This was referenced Jan 31, 2022
|
Added issue to track failed upgrade of |
jimbishopp
added a commit
that referenced
this pull request
Feb 1, 2022
* Vendor go-mysql update * Client Certificate Authentication for GCP Cloud SQL (#9991) Allow users to secure GCP Cloud SQL instances by setting "Allow only SSL connections", which enforces client certificate authentication. This implementation does not require any configuration changes for Teleport users. Teleport will detect whether client certificate authentication is required and handle either case automatically. Client certificates are ephemeral. They are created for every connection by calling the GCP Cloud SQL API's GenerateEphemeralCert function. Certificates are only created when the destination Cloud SQL instance is configured to require client certificate authentication. The configuration is detected by requesting instance settings from the GCP Cloud SQL API on every connection attempt. A special case was implemented for MySQL. MySQL servers in GCP Cloud SQL do not trust the ephemeral certificate's CA but GCP Cloud Proxy does. To work around this issue, the implementation will connect to the MySQL Cloud Proxy port using a TLS dialer instead of the default MySQL port when client certificate authentication is required. The common.CloudClients interface and implementation now return an interface (GCPSQLAdminClient) from the GetGCPSQLAdminClient function instead of the GCP client's sqladmin.Service. Returning an interface simplified calling code and allowed for the client to be mocked for testing. Existing GCP Cloud SQL tests are configured to not require client certificate authentication by default. A new test named TestGCPRequireSSL was created to simulate client certificate authentication for both Postgres and MySQL. This required some minor changes to the test server code. A new ConnectWithDialer function was added to the github.com/gravitational/go-mysql fork. This function is available upstream in v1.4.0 but other changes upstream resulted in a number of errors and a panic processing network packets. So instead of upgrading, the dialer function was copied to the Teleport fork and a custom version was created instead: v1.1.1-teleport.1.
jimbishopp
added a commit
that referenced
this pull request
Feb 3, 2022
jimbishopp
added a commit
that referenced
this pull request
Feb 3, 2022
jimbishopp
added a commit
that referenced
this pull request
Feb 4, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #8217
Allow users to secure GCP Cloud SQL instances by setting "Allow only SSL connections", which enforces client certificate authentication.
This implementation does not require any configuration changes for Teleport users. Teleport will detect whether client certificate authentication is required and handle either case automatically.
Client certificates are ephemeral. They are created for every connection by calling the GCP Cloud SQL API's
GenerateEphemeralCertfunction. Certificates are only created when the destination Cloud SQL instance is configured to require client certificate authentication. The configuration is detected by requesting instance settings from the GCP Cloud SQL API on every connection attempt.A special case was implemented for MySQL. MySQL servers in GCP Cloud SQL do not trust the ephemeral certificate's CA but GCP Cloud Proxy does. To work around this issue, the implementation will connect to the MySQL Cloud Proxy port using a TLS dialer instead of the default MySQL port when client certificate authentication is required.
The
common.CloudClientsinterface and implementation now return an interface (GCPSQLAdminClient) from theGetGCPSQLAdminClientfunction instead of the GCP client'ssqladmin.Service. Returning an interface simplified calling code and allowed for the client to be mocked for testing.Existing GCP Cloud SQL tests are configured to not require client certificate authentication by default. A new test named
TestGCPRequireSSLwas created to simulate client certificate authentication for both Postgres and MySQL. This required some minor changes to the test server code.A new
ConnectWithDialerfunction was added to thegithub.com/gravitational/go-mysqlfork. This function is available upstream inv1.4.0but other changes upstream resulted in a number of errors and a panic processing network packets. So instead of upgrading, the dialer function was copied to the Teleport fork and a custom version was created instead:v1.1.1-teleport.1. The errors found will be documented in another issue.Teleport documentation will be updated in another PR.