feat(gRPC): add support mtls to secure grpc connections

relay-server/config/config.go

@@ -0,0 +1,48 @@
+package config
+
+import (
+	"flag"
+
+	"github.com/spf13/viper"
+)
+
+type RelayConfig struct {
+	GRPC            string
+	TLSEnabled      bool
+	TLSCertPath     string
+	TLSCertProvider string
+}
+
+var GlobalConfig RelayConfig
+
+const (
+	ConfigGRPC            string = "gRPCPort"
+	ConfigTLSEnabled      string = "tlsEnabled"
+	ConfigTLSCertPath     string = "tlsCertPath"
+	ConfigTLSCertProvider string = "tlsCertProvider"
+	SelfCertProvider      string = "self"
+	ExternalCertProvider  string = "external"
+)
+
+func readCmdLineParams() {
+	grpcStr := flag.String(ConfigGRPC, "32767", "gRPC port")
+	tlsEnabled := flag.Bool(ConfigTLSEnabled, false, "enble tls to connect with kubearmor ssl service")
+	tlsCertPath := flag.String(ConfigTLSCertPath, "/var/lib/kubearmor/tls", "path to tls certs files ca.crt, client.crt, client.key")
+	tlsCertProvider := flag.String(ConfigTLSCertProvider, ExternalCertProvider, "source of certificate {self|external}, self: create certificate dynamically, external: provided by some external entity")
+	flag.Parse()
+	viper.SetDefault(ConfigGRPC, grpcStr)
+	viper.SetDefault(ConfigTLSEnabled, tlsEnabled)
+	viper.SetDefault(ConfigTLSCertPath, tlsCertPath)
+	viper.SetDefault(ConfigTLSCertProvider, tlsCertProvider)
+}
+
+func LoadConfig() error {
+
+	readCmdLineParams()
+
+	GlobalConfig.GRPC = viper.GetString(ConfigGRPC)
+	GlobalConfig.TLSEnabled = viper.GetBool(ConfigTLSEnabled)
+	GlobalConfig.TLSCertPath = viper.GetString(ConfigTLSCertPath)
+	GlobalConfig.TLSCertProvider = viper.GetString(ConfigTLSCertProvider)
+	return nil
+}

relay-server/go.mod

@@ -12,44 +12,68 @@ replace (
 require (
 	github.com/cenkalti/backoff/v4 v4.2.1
 	github.com/dustin/go-humanize v1.0.1
-	github.com/elastic/go-elasticsearch/v7 v7.17.7
-	github.com/google/uuid v1.4.0
-	github.com/kubearmor/KubeArmor/protobuf v0.0.0-20240208122905-ace82ae0506c
-	go.uber.org/zap v1.19.0
-	google.golang.org/grpc v1.61.0
-	k8s.io/apimachinery v0.21.1
-	k8s.io/client-go v0.21.1
+	github.com/elastic/go-elasticsearch/v7 v7.17.10
+	github.com/google/uuid v1.6.0
+	github.com/kubearmor/KubeArmor/KubeArmor v0.0.0-20240221143208-5ce18832d33e
+	github.com/kubearmor/KubeArmor/protobuf v0.0.0-20240221143208-5ce18832d33e
+	github.com/spf13/viper v1.18.2
+	go.uber.org/zap v1.27.0
+	google.golang.org/grpc v1.62.0
+	k8s.io/apimachinery v0.29.2
+	k8s.io/client-go v0.29.2
 )
 
 require (
-	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/go-logr/logr v0.4.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.11.2 // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-openapi/jsonpointer v0.20.2 // indirect
+	github.com/go-openapi/jsonreference v0.20.4 // indirect
+	github.com/go-openapi/swag v0.22.9 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
-	github.com/google/gofuzz v1.1.0 // indirect
-	github.com/googleapis/gnostic v0.4.1 // indirect
-	github.com/imdario/mergo v0.3.5 // indirect
-	github.com/json-iterator/go v1.1.10 // indirect
+	github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/magiconair/properties v1.8.7 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.1 // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pelletier/go-toml/v2 v2.1.1 // indirect
+	github.com/sagikazarmark/locafero v0.4.0 // indirect
+	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.11.0 // indirect
+	github.com/spf13/cast v1.6.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	go.uber.org/atomic v1.7.0 // indirect
-	go.uber.org/multierr v1.6.0 // indirect
-	golang.org/x/net v0.20.0 // indirect
-	golang.org/x/oauth2 v0.14.0 // indirect
-	golang.org/x/sys v0.16.0 // indirect
-	golang.org/x/term v0.16.0 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/exp v0.0.0-20240213143201-ec583247a57a // indirect
+	golang.org/x/net v0.21.0 // indirect
+	golang.org/x/oauth2 v0.17.0 // indirect
+	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/term v0.17.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba // indirect
+	golang.org/x/time v0.5.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240221002015-b0ce06bbee7c // indirect
 	google.golang.org/protobuf v1.32.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/api v0.21.1 // indirect
-	k8s.io/klog/v2 v2.8.0 // indirect
-	k8s.io/utils v0.0.0-20201110183641-67b214c5f920 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.1.0 // indirect
-	sigs.k8s.io/yaml v1.2.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/api v0.29.2 // indirect
+	k8s.io/klog/v2 v2.120.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20240221221325-2ac9dc51f3f1 // indirect
+	k8s.io/utils v0.0.0-20240102154912-e7106e64919e // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )