Agent Auto Configuration: Client First Time Auto Configuration #8086

mkeeler · 2020-06-11T13:48:55Z

This PR is a rather large change to how we go about starting up an agent. Previously a lot of the logic was built into the CLI command but most of that was moved into the Agent itself.

Most of the necessary changes in this PR are fallout from test expectations about how we can force new configuration into the Agent. Functionally all the real code changes are in agent/agent.go command/agent/agent.go and agent/auto-config/auto_config.go

TODOS:

testing
figure out how to set verify_incoming (Will be in a future PR)

Right now if you try to set verify incoming prior to having certs it doesn't work even though eventually the agent will get certs and serve out HTTPs

agent/agent.go

agent/consul/options.go

agent/auto_config.go

agent/agent.go

mkeeler · 2020-06-16T13:47:49Z

agent/acl.go

@@ -187,23 +187,23 @@ func (a *Agent) vetCheckRegisterWithAuthorizer(authz acl.Authorizer, check *stru
 	// Vet the check itself.
 	if len(check.ServiceName) > 0 {
 		if authz.ServiceWrite(check.ServiceName, &authzContext) != acl.Allow {
-			return acl.ErrPermissionDenied
+			return acl.PermissionDenied("Missing service:write on %s", check.CompoundServiceID())


I added these in while debugging some issues but figured I would leave them as we want permission denied errors like this anyways.

mkeeler · 2020-06-16T14:27:32Z

agent/acl_test.go

@@ -258,7 +265,7 @@ var (
 		nodeRWSecret: {
 			token: structs.ACLToken{
 				AccessorID: "efb6b7d5-d343-47c1-b4cb-aa6b94d2f490",
-				SecretID:   nodeROSecret,
+				SecretID:   nodeRWSecret,


Fixed a previous typo although it doesn't matter in the tests as the secret was already used to lookup the token.

mkeeler · 2020-06-16T14:37:34Z

agent/agent.go

@@ -247,8 +253,6 @@ type Agent struct {
 	eventLock   sync.RWMutex
 	eventNotify NotifyGroup

-	reloadCh chan chan error


The reloadCh was previously used for the odd interaction between the cli command and the Agent itself. To do an API triggered reload before required the agent endpoint code pushing a chan into this chan and then waiting to hear back that the reload was completed. The cli command was responsible for processing that chan.

Now reloads happen a little differently since the Agent itself is responsible for parsing configuration (or rather the autoconf package). Now the cli command will process a SIGHUP and just call ReloadConfig on the Agent. The HTTP endpoint will do similarly and there is no need for the channel.

mkeeler · 2020-06-16T14:38:12Z

agent/agent.go

@@ -313,22 +317,103 @@ type Agent struct {
 	// IP.
 	httpConnLimiter connlimit.Limiter

+	// Connection Pool
+	connPool *pool.ConnPool


The Agent code now needs to make insecure RPCs to servers for autoconfig so the shared connection pool has been moved up a level into the Agent and we pass it down into the Server/Client

mkeeler · 2020-06-16T14:43:05Z

agent/agent.go

 	if err := a.CheckSecurity(newCfg); err != nil {
 		a.logger.Error("Security error while reloading configuration: %#v", err)
 		return err
 	}
+
+	// Change the log level and update it
+	if logging.ValidateLogLevel(newCfg.LogLevel) {


Moved from the cli commands processing of the configuration to update the loggers level.

mkeeler · 2020-06-16T15:01:17Z

agent/config/builder.go

@@ -916,6 +916,7 @@ func (b *Builder) Build() (rt RuntimeConfig, err error) {
 		ConnectMeshGatewayWANFederationEnabled: connectMeshGatewayWANFederationEnabled,
 		ConnectSidecarMinPort:                  sidecarMinPort,
 		ConnectSidecarMaxPort:                  sidecarMaxPort,
+		ConnectTestCALeafRootChangeSpread:      b.durationVal("connect.test_ca_leaf_root_change_spread", c.Connect.TestCALeafRootChangeSpread),


Put into the Config and map into the RuntimeConfig to simplify how test overrides are done. We now just inject a source after the tail that can include this value along with other things such as the check_reap_interval

mkeeler · 2020-06-16T15:02:29Z

agent/pool/pool.go

@@ -466,7 +466,11 @@ func (p *ConnPool) getNewConn(dc string, nodeName string, addr net.Addr) (*Conn,
 	conf.LogOutput = p.LogOutput

 	// Create a multiplexed session
-	session, _ := yamux.Client(conn, conf)
+	session, err := yamux.Client(conn, conf)
+	if err != nil {


At one point I experienced a segfault here. I fixed why it could occur but thought it best to leave the error checking in.

lib/decode/decode.go

This is needed so that we can make an AutoConfig RPC at the Agent level prior to creating the Client/Server.

There are a couple of things in here. First, just like auto encrypt, any Cluster.AutoConfig RPC will implicitly use the less secure RPC mechanism. This drastically modifies how the Consul Agent starts up and moves most of the responsibilities (other than signal handling) from the cli command and into the Agent.

hanshasselberg

LGTM

hanshasselberg · 2020-06-18T12:21:18Z

command/agent/agent.go

-		logGate.Flush()
-		return 1
-	}
-
 	// Create the agent
 	cli.output("Starting Consul agent...")


This log output should go above agent.New

It cannot go there any longer.

Before the cli code here parsed the config so it already knew prior to creating the agent whether it was doing JSON logging or not. Now it doesn't know that until after agent.New and we still want to prevent unstructured logs from being emitted when configured to do JSON logging.

However the output was misleading before. It had nothing to do with starting the agent but rather building an object and it would call agent.Start() later on.

agent/auto-config/auto_config.go

hashicorp-ci · 2020-06-18T14:45:56Z

🍒✅ Cherry pick of commit abce1f0 onto release/1.8.x succeeded!

…nfig-inject

mkeeler requested a review from a team June 11, 2020 13:49

mkeeler changed the title ~~Feature/auto config/client config inject~~ Agent Auto Configuration: Client First Time Auto Configuration Jun 11, 2020

mkeeler force-pushed the feature/auto-config/client-config-inject branch 2 times, most recently from 3ad5cff to 488aee1 Compare June 11, 2020 16:24

dnephin reviewed Jun 11, 2020

View reviewed changes

agent/agent.go Outdated Show resolved Hide resolved

agent/agent.go Outdated Show resolved Hide resolved

agent/consul/options.go Outdated Show resolved Hide resolved

agent/auto_config.go Outdated Show resolved Hide resolved

agent/agent.go Outdated Show resolved Hide resolved

mkeeler force-pushed the feature/auto-config/client-config-inject branch 2 times, most recently from 00490d7 to 94d93ad Compare June 12, 2020 17:36

mkeeler removed the request for review from a team June 12, 2020 17:42

mkeeler force-pushed the feature/auto-config/client-config-inject branch 2 times, most recently from a6e21a5 to 303391e Compare June 15, 2020 21:36

mkeeler marked this pull request as ready for review June 15, 2020 21:38

mkeeler force-pushed the feature/auto-config/client-config-inject branch 7 times, most recently from edbbd45 to 378bf66 Compare June 16, 2020 13:46

mkeeler commented Jun 16, 2020

View reviewed changes

mkeeler force-pushed the feature/auto-config/client-config-inject branch 2 times, most recently from ab38fed to bdf2dbb Compare June 16, 2020 14:24

mkeeler commented Jun 16, 2020

View reviewed changes

mkeeler force-pushed the feature/auto-config/client-config-inject branch 2 times, most recently from 6253b0e to cd0b45f Compare June 16, 2020 14:34

mkeeler commented Jun 16, 2020

View reviewed changes

mkeeler force-pushed the feature/auto-config/client-config-inject branch from cd0b45f to 93c5261 Compare June 16, 2020 14:59

mkeeler commented Jun 16, 2020

View reviewed changes

mkeeler force-pushed the feature/auto-config/client-config-inject branch 2 times, most recently from ef01a47 to 2bef1b5 Compare June 16, 2020 16:23

mkeeler force-pushed the feature/auto-config/server-rpc branch 2 times, most recently from 39d5bfa to 9f4401f Compare June 17, 2020 14:04

mkeeler force-pushed the feature/auto-config/client-config-inject branch from 2bef1b5 to 81a895b Compare June 17, 2020 14:26

mkeeler force-pushed the feature/auto-config/server-rpc branch from 9f4401f to 9b01f94 Compare June 17, 2020 15:25

mkeeler force-pushed the feature/auto-config/client-config-inject branch 2 times, most recently from afb178e to e67d9fd Compare June 17, 2020 15:38

mkeeler commented Jun 17, 2020

View reviewed changes

lib/decode/decode.go Outdated Show resolved Hide resolved

mkeeler force-pushed the feature/auto-config/client-config-inject branch from e67d9fd to 5d669c0 Compare June 17, 2020 16:21

dnephin reviewed Jun 17, 2020

View reviewed changes

lib/decode/decode.go Outdated Show resolved Hide resolved

lib/decode/decode.go Outdated Show resolved Hide resolved

mkeeler force-pushed the feature/auto-config/client-config-inject branch 2 times, most recently from ee0a02c to f9356d0 Compare June 17, 2020 18:37

Base automatically changed from feature/auto-config/server-rpc to master June 17, 2020 20:07

mkeeler added the backport/1.8 label Jun 17, 2020

Allow the Agent its its child Client/Server to share a connection pool

8b7d669

This is needed so that we can make an AutoConfig RPC at the Agent level prior to creating the Client/Server.

mkeeler force-pushed the feature/auto-config/client-config-inject branch from f9356d0 to 9fe7bcb Compare June 17, 2020 20:36

mkeeler force-pushed the feature/auto-config/client-config-inject branch from 9fe7bcb to 3dbbd2d Compare June 17, 2020 20:50

hanshasselberg approved these changes Jun 18, 2020

View reviewed changes

mkeeler merged commit abce1f0 into master Jun 18, 2020

mkeeler deleted the feature/auto-config/client-config-inject branch June 18, 2020 14:44

hashicorp-ci pushed a commit that referenced this pull request Jun 18, 2020

Merge pull request #8086 from hashicorp/feature/auto-config/client-co…

6375db7

…nfig-inject

dependabot bot mentioned this pull request Mar 14, 2021

Bump github.com/hashicorp/consul/api from 1.5.0 to 1.8.1 fangyincheng/dubbo-go#17

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Agent Auto Configuration: Client First Time Auto Configuration #8086

Agent Auto Configuration: Client First Time Auto Configuration #8086

mkeeler commented Jun 11, 2020 •

edited

Loading

mkeeler Jun 16, 2020

mkeeler Jun 16, 2020

mkeeler Jun 16, 2020

mkeeler Jun 16, 2020

mkeeler Jun 16, 2020

mkeeler Jun 16, 2020

mkeeler Jun 16, 2020

hanshasselberg left a comment

hanshasselberg Jun 18, 2020

mkeeler Jun 18, 2020

mkeeler Jun 18, 2020

hashicorp-ci commented Jun 18, 2020

Agent Auto Configuration: Client First Time Auto Configuration #8086

Agent Auto Configuration: Client First Time Auto Configuration #8086

Conversation

mkeeler commented Jun 11, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hanshasselberg left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hashicorp-ci commented Jun 18, 2020

mkeeler commented Jun 11, 2020 •

edited

Loading