kuma

1
package api_server
2

3
import (
4
	"net/url"
5

6
	"github.com/pkg/errors"
7
	"go.uber.org/multierr"
8

9
	"github.com/kumahq/kuma/pkg/config"
10
	config_types "github.com/kumahq/kuma/pkg/config/types"
11
)
12

13
var _ config.Config = &ApiServerConfig{}
14

15
// ApiServerConfig defines API Server configuration
16
type ApiServerConfig struct {
17
	config.BaseConfig
18

19
	// If true, then API Server will operate in read only mode (serving GET requests)
20
	ReadOnly bool `json:"readOnly" envconfig:"kuma_api_server_read_only"`
21
	// Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
22
	CorsAllowedDomains []string `json:"corsAllowedDomains" envconfig:"kuma_api_server_cors_allowed_domains"`
23
	// HTTP configuration of the API Server
24
	HTTP ApiServerHTTPConfig `json:"http"`
25
	// HTTPS configuration of the API Server
26
	HTTPS ApiServerHTTPSConfig `json:"https"`
27
	// Authentication configuration for administrative endpoints like Dataplane Token or managing Secrets
28
	Auth ApiServerAuth `json:"auth"`
29
	// Authentication configuration for API Server
30
	Authn ApiServerAuthn `json:"authn"`
31
	// BasePath the path to serve the API from
32
	BasePath string `json:"basePath" envconfig:"kuma_api_server_base_path"`
33
	// RootUrl can be used if you use a reverse proxy
34
	RootUrl string `json:"rootUrl" envconfig:"kuma_api_server_root_url"`
35
	// GUI configuration specific to the GUI
36
	GUI ApiServerGUI `json:"gui,omitempty"`
37
}
38

39
type ApiServerGUI struct {
40
	// Enabled whether to serve to gui (if mode=zone this has no effect)
41
	Enabled bool `json:"enabled" envconfig:"kuma_api_server_gui_enabled"`
42
	// RootUrl can be used if you set a reverse proxy or want to serve the gui from a different path
43
	RootUrl string `json:"rootUrl" envconfig:"kuma_api_server_gui_root_url"`
44
	// BasePath the path to serve the GUI from
45
	BasePath string `json:"basePath" envconfig:"kuma_api_server_gui_base_path"`
46
}
47

48
func (a *ApiServerGUI) Validate() error {
49
	var errs error
50
	if a.RootUrl != "" {
51
		_, err := url.Parse(a.RootUrl)
52
		if err != nil {
53
			errs = multierr.Append(errs, errors.New("RootUrl is not a valid url"))
54
		}
55
	}
56
	if a.BasePath != "" {
57
		_, err := url.Parse(a.BasePath)
58
		if err != nil {
59
			errs = multierr.Append(errs, errors.New("BaseGuiPath is not a valid url"))
60
		}
61
	}
62
	return errs
63
}
64

65
// ApiServerHTTPConfig defines API Server HTTP configuration
66
type ApiServerHTTPConfig struct {
67
	// If true then API Server will be served on HTTP
68
	Enabled bool `json:"enabled" envconfig:"kuma_api_server_http_enabled"`
69
	// Network interface on which HTTP API Server will be exposed
70
	Interface string `json:"interface" envconfig:"kuma_api_server_http_interface"`
71
	// Port of the HTTP API Server
72
	Port uint32 `json:"port" envconfig:"kuma_api_server_http_port"`
73
}
74

75
func (a *ApiServerHTTPConfig) Validate() error {
76
	var errs error
77
	if a.Interface == "" {
78
		errs = multierr.Append(errs, errors.New("Interface cannot be empty"))
79
	}
80
	if a.Port > 65535 {
81
		errs = multierr.Append(errs, errors.New("Port must be in range [0, 65535]"))
82
	}
83
	return errs
84
}
85

86
// ApiServerHTTPSConfig defines API Server HTTPS configuration
87
type ApiServerHTTPSConfig struct {
88
	// If true then API Server will be served on HTTPS
89
	Enabled bool `json:"enabled" envconfig:"kuma_api_server_https_enabled"`
90
	// Network interface on which HTTPS API Server will be exposed
91
	Interface string `json:"interface" envconfig:"kuma_api_server_https_interface"`
92
	// Port of the HTTPS API Server
93
	Port uint32 `json:"port" envconfig:"kuma_api_server_https_port"`
94
	// Path to TLS certificate file. Autoconfigured from KUMA_GENERAL_TLS_CERT_FILE if empty
95
	TlsCertFile string `json:"tlsCertFile" envconfig:"kuma_api_server_https_tls_cert_file"`
96
	// Path to TLS key file. Autoconfigured from KUMA_GENERAL_TLS_KEY_FILE if empty
97
	TlsKeyFile string `json:"tlsKeyFile" envconfig:"kuma_api_server_https_tls_key_file"`
98
	// TlsMinVersion defines the minimum TLS version to be used
99
	TlsMinVersion string `json:"tlsMinVersion" envconfig:"kuma_api_server_https_tls_min_version"`
100
	// TlsMaxVersion defines the maximum TLS version to be used
101
	TlsMaxVersion string `json:"tlsMaxVersion" envconfig:"kuma_api_server_https_tls_max_version"`
102
	// TlsCipherSuites defines the list of ciphers to use
103
	TlsCipherSuites []string `json:"tlsCipherSuites" envconfig:"kuma_api_server_https_tls_cipher_suites"`
104
	// If true, then HTTPS connection will require client cert.
105
	RequireClientCert bool `json:"requireClientCert" envconfig:"kuma_api_server_https_require_client_cert"`
106
	// Path to the CA certificate which is used to sign client certificates. It is used only for verifying client certificates.
107
	TlsCaFile string `json:"tlsCaFile" envconfig:"kuma_api_server_https_tls_ca_file"`
108
}
109

110
func (a *ApiServerHTTPSConfig) Validate() error {
111
	var errs error
112
	if a.Interface == "" {
113
		errs = multierr.Append(errs, errors.New(".Interface cannot be empty"))
114
	}
115
	if a.Port > 65535 {
116
		return errors.New("Port must be in range [0, 65535]")
117
	}
118
	if (a.TlsKeyFile == "" && a.TlsCertFile != "") || (a.TlsKeyFile != "" && a.TlsCertFile == "") {
119
		errs = multierr.Append(errs, errors.New("Both TlsCertFile and TlsKeyFile has to be specified"))
120
	}
121
	if _, err := config_types.TLSVersion(a.TlsMinVersion); err != nil {
122
		errs = multierr.Append(errs, errors.New(".TlsMinVersion"+err.Error()))
123
	}
124
	if _, err := config_types.TLSVersion(a.TlsMaxVersion); err != nil {
125
		errs = multierr.Append(errs, errors.New(".TlsMaxVersion"+err.Error()))
126
	}
127
	if _, err := config_types.TLSCiphers(a.TlsCipherSuites); err != nil {
128
		errs = multierr.Append(errs, errors.New(".TlsCipherSuites"+err.Error()))
129
	}
130
	return errs
131
}
132

133
// ApiServerAuth defines API Server authentication configuration
134
type ApiServerAuth struct {
135
	// Directory of authorized client certificates (only valid in HTTPS)
136
	ClientCertsDir string `json:"clientCertsDir" envconfig:"kuma_api_server_auth_client_certs_dir"`
137
}
138

139
// ApiServerAuthn defines Api Server Authentication configuration
140
type ApiServerAuthn struct {
141
	// Type of authentication mechanism (available values: "clientCerts", "tokens")
142
	Type string `json:"type" envconfig:"kuma_api_server_authn_type"`
143
	// Localhost is authenticated as a user admin of group admin
144
	LocalhostIsAdmin bool `json:"localhostIsAdmin" envconfig:"kuma_api_server_authn_localhost_is_admin"`
145
	// Configuration for tokens authentication
146
	Tokens ApiServerAuthnTokens `json:"tokens"`
147
}
148

149
func (a ApiServerAuthn) Validate() error {
150
	if a.Type == "tokens" {
151
		if err := a.Tokens.Validate(); err != nil {
152
			return errors.Wrap(err, ".Tokens is not valid")
153
		}
154
	}
155
	return nil
156
}
157

158
type ApiServerAuthnTokens struct {
159
	// If true then User Token with name admin and group admin will be created and placed as admin-user-token Kuma Global Secret
160
	BootstrapAdminToken bool `json:"bootstrapAdminToken" envconfig:"kuma_api_server_authn_tokens_bootstrap_admin_token"`
161
	// If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
162
	EnableIssuer bool `json:"enableIssuer" envconfig:"kuma_api_server_authn_tokens_enable_issuer"`
163
	// Token validator configuration
164
	Validator TokensValidator `json:"validator"`
165
}
166

167
func (a ApiServerAuthnTokens) Validate() error {
168
	if err := a.Validator.Validate(); err != nil {
169
		return errors.Wrap(err, ".Validator is not valid")
170
	}
171
	return nil
172
}
173

174
var _ config.Config = TokensValidator{}
175

176
type TokensValidator struct {
177
	config.BaseConfig
178

179
	// If true then Kuma secrets with prefix "user-token-signing-key" are considered as signing keys.
180
	UseSecrets bool `json:"useSecrets" envconfig:"kuma_api_server_authn_tokens_validator_use_secrets"`
181
	// List of public keys used to validate the token.
182
	PublicKeys []config_types.PublicKey `json:"publicKeys"`
183
}
184

185
func (t TokensValidator) Validate() error {
186
	for i, key := range t.PublicKeys {
187
		if err := key.Validate(); err != nil {
188
			return errors.Wrapf(err, ".PublicKeys[%d] is not valid", i)
189
		}
190
	}
191
	return nil
192
}
193

194
func (a *ApiServerConfig) Validate() error {
195
	var errs error
196
	if err := a.HTTP.Validate(); err != nil {
197
		errs = multierr.Append(err, errors.Wrap(err, ".HTTP not valid"))
198
	}
199
	if err := a.HTTPS.Validate(); err != nil {
200
		errs = multierr.Append(err, errors.Wrap(err, ".HTTPS not valid"))
201
	}
202
	if err := a.GUI.Validate(); err != nil {
203
		errs = multierr.Append(err, errors.Wrap(err, ".GUI not valid"))
204
	}
205
	if a.RootUrl != "" {
206
		if _, err := url.Parse(a.RootUrl); err != nil {
207
			errs = multierr.Append(err, errors.New("RootUrl is not a valid URL"))
208
		}
209
	}
210
	if a.BasePath != "" {
211
		_, err := url.Parse(a.BasePath)
212
		if err != nil {
213
			errs = multierr.Append(errs, errors.New("BaseGuiPath is not a valid url"))
214
		}
215
	}
216
	if err := a.Authn.Validate(); err != nil {
217
		errs = multierr.Append(err, errors.Wrap(err, ".Authn is not valid"))
218
	}
219
	return errs
220
}
221

222
func DefaultApiServerConfig() *ApiServerConfig {
223
	return &ApiServerConfig{
224
		ReadOnly:           false,
225
		CorsAllowedDomains: []string{".*"},
226
		BasePath:           "/",
227
		HTTP: ApiServerHTTPConfig{
228
			Enabled:   true,
229
			Interface: "0.0.0.0",
230
			Port:      5681,
231
		},
232
		HTTPS: ApiServerHTTPSConfig{
233
			Enabled:         true,
234
			Interface:       "0.0.0.0",
235
			Port:            5682,
236
			TlsCertFile:     "", // autoconfigured
237
			TlsKeyFile:      "", // autoconfigured
238
			TlsMinVersion:   "TLSv1_2",
239
			TlsCipherSuites: []string{},
240
		},
241
		Auth: ApiServerAuth{
242
			ClientCertsDir: "",
243
		},
244
		Authn: ApiServerAuthn{
245
			Type:             "tokens",
246
			LocalhostIsAdmin: true,
247
			Tokens: ApiServerAuthnTokens{
248
				BootstrapAdminToken: true,
249
				EnableIssuer:        true,
250
				Validator: TokensValidator{
251
					UseSecrets: true,
252
					PublicKeys: []config_types.PublicKey{},
253
				},
254
			},
255
		},
256
		GUI: ApiServerGUI{
257
			Enabled:  true,
258
			BasePath: "/gui",
259
		},
260
	}
261
}
262