Skip to content

Commit 4534944

Browse files
ehazlettehazlett
committed
use tls for auth
Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
1 parent 6ea17ee commit 4534944

File tree

10 files changed

+361
-259
lines changed

10 files changed

+361
-259
lines changed

‎commands.go‎

Lines changed: 16 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"fmt"
66
"os"
77
"os/exec"
8+
"path/filepath"
89
"sort"
910
"strings"
1011
"text/tabwriter"
@@ -149,7 +150,7 @@ var Commands = []cli.Command{
149150

150151
func cmdActive(c *cli.Context) {
151152
name := c.Args().First()
152-
store := NewStore(c.GlobalString("storage-path"))
153+
store := NewStore(c.GlobalString("storage-path"), c.GlobalString("auth-ca"), c.GlobalString("auth-key"))
153154

154155
if name == "" {
155156
host, err := store.GetActive()
@@ -182,25 +183,7 @@ func cmdCreate(c *cli.Context) {
182183
log.Fatal("You must specify a machine name")
183184
}
184185

185-
store := NewStore(c.GlobalString("storage-path"))
186-
187-
exists, err := store.Exists(name)
188-
if err != nil {
189-
log.Fatal(err)
190-
}
191-
192-
if exists {
193-
log.Fatal("There's already a machine with the same name")
194-
}
195-
196-
keyExists, err := drivers.PublicKeyExists()
197-
if err != nil {
198-
log.Fatal(err)
199-
}
200-
201-
if !keyExists {
202-
log.Fatalf("Identity authentication public key doesn't exist at %q. Create your public key by running the \"docker\" command.", drivers.PublicKeyPath())
203-
}
186+
store := NewStore(c.GlobalString("storage-path"), c.GlobalString("auth-ca"), c.GlobalString("auth-key"))
204187

205188
host, err := store.Create(name, driver, c)
206189
if err != nil {
@@ -220,7 +203,15 @@ func cmdCreate(c *cli.Context) {
220203
log.Fatalf("error setting active host: %v", err)
221204
}
222205

223-
log.Infof("%q has been created and is now the active machine. To point Docker at this machine, run: export DOCKER_HOST=$(machine url) DOCKER_AUTH=identity", name)
206+
log.Infof("%q has been created and is now the active machine", name)
207+
// TODO @ehazlett - this will change but at least show how to connect for now
208+
log.Info("To connect, pass these args to Docker: ")
209+
storeDir := c.GlobalString("storage-path")
210+
caCert := filepath.Join(storeDir, name, "ca.pem")
211+
clientCert := filepath.Join(storeDir, name, "client.pem")
212+
clientKey := filepath.Join(storeDir, name, "client-key.pem")
213+
log.Infof("--auth=cert --auth-ca=%s --auth-cert=%s --auth-key=%s -H $(machine url)",
214+
caCert, clientCert, clientKey)
224215
}
225216

226217
func cmdInspect(c *cli.Context) {
@@ -249,7 +240,7 @@ func cmdKill(c *cli.Context) {
249240

250241
func cmdLs(c *cli.Context) {
251242
quiet := c.Bool("quiet")
252-
store := NewStore(c.GlobalString("storage-path"))
243+
store := NewStore(c.GlobalString("storage-path"), c.GlobalString("auth-ca"), c.GlobalString("auth-key"))
253244

254245
hostList, err := store.List()
255246
if err != nil {
@@ -320,7 +311,7 @@ func cmdRm(c *cli.Context) {
320311

321312
isError := false
322313

323-
store := NewStore(c.GlobalString("storage-path"))
314+
store := NewStore(c.GlobalString("storage-path"), c.GlobalString("auth-ca"), c.GlobalString("auth-key"))
324315
for _, host := range c.Args() {
325316
if err := store.Remove(host, force); err != nil {
326317
log.Errorf("Error removing machine %s: %s", host, err)
@@ -334,7 +325,7 @@ func cmdRm(c *cli.Context) {
334325

335326
func cmdSsh(c *cli.Context) {
336327
name := c.Args().First()
337-
store := NewStore(c.GlobalString("storage-path"))
328+
store := NewStore(c.GlobalString("storage-path"), c.GlobalString("auth-ca"), c.GlobalString("auth-key"))
338329

339330
if name == "" {
340331
host, err := store.GetActive()
@@ -412,7 +403,7 @@ func cmdNotFound(c *cli.Context, command string) {
412403

413404
func getHost(c *cli.Context) *Host {
414405
name := c.Args().First()
415-
store := NewStore(c.GlobalString("storage-path"))
406+
store := NewStore(c.GlobalString("storage-path"), c.GlobalString("auth-ca"), c.GlobalString("auth-key"))
416407

417408
if name == "" {
418409
host, err := store.GetActive()

‎drivers/amazonec2/amazonec2.go‎

Lines changed: 6 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ import (
99
"os"
1010
"os/exec"
1111
"path"
12-
"path/filepath"
1312
"time"
1413

1514
log "github.com/Sirupsen/logrus"
@@ -23,14 +22,15 @@ import (
2322
const (
2423
driverName = "amazonec2"
2524
defaultRegion = "us-east-1"
26-
defaultAMI = "ami-a00461c8"
25+
defaultAMI = "ami-4ae27e22"
2726
defaultInstanceType = "t2.micro"
2827
defaultRootSize = 16
2928
ipRange = "0.0.0.0/0"
3029
)
3130

3231
type Driver struct {
3332
Id string
33+
MachineName string
3434
AccessKey string
3535
SecretKey string
3636
SessionToken string
@@ -48,6 +48,8 @@ type Driver struct {
4848
VpcId string
4949
SubnetId string
5050
Zone string
51+
CaCertPath string
52+
PrivateKeyPath string
5153
storePath string
5254
keyPath string
5355
}
@@ -134,9 +136,9 @@ func GetCreateFlags() []cli.Flag {
134136
}
135137
}
136138

137-
func NewDriver(machineName string, storePath string) (drivers.Driver, error) {
139+
func NewDriver(machineName string, storePath string, caCert string, privateKey string) (drivers.Driver, error) {
138140
id := generateId()
139-
return &Driver{Id: id, MachineName: machineName, storePath: storePath}, nil
141+
return &Driver{Id: id, MachineName: machineName, storePath: storePath, CaCertPath: caCert, PrivateKeyPath: privateKey}, nil
140142
}
141143

142144
func (d *Driver) SetConfigFromFlags(flags drivers.DriverOptions) error {
@@ -263,72 +265,11 @@ func (d *Driver) Create() error {
263265
cmd, err = d.GetSSHCommand("if [ ! -e /usr/bin/docker ]; then curl get.docker.io | sudo sh -; fi")
264266
if err != nil {
265267
return err
266-
}
267-
if err := cmd.Run(); err != nil {
268-
return err
269-
}
270-
271-
cmd, err = d.GetSSHCommand("sudo stop docker")
272-
if err != nil {
273-
return err
274-
}
275-
if err := cmd.Run(); err != nil {
276-
return err
277-
}
278-
279-
log.Debugf("HACK: Downloading version of Docker with identity auth...")
280-
281-
cmd, err = d.GetSSHCommand("sudo curl -sS -o /usr/bin/docker https://ehazlett.s3.amazonaws.com/public/docker/linux/docker-1.4.1-136b351e-identity")
282-
if err != nil {
283-
return err
284-
}
285-
if err := cmd.Run(); err != nil {
286-
return err
287-
}
288-
289-
log.Debugf("Updating /etc/default/docker to use identity auth...")
290-
291-
cmd, err = d.GetSSHCommand("echo 'export DOCKER_OPTS=\"--auth=identity --host=tcp://0.0.0.0:2376 --host=unix:///var/run/docker.sock --auth-authorized-dir=/root/.docker/authorized-keys.d\"' | sudo tee -a /etc/default/docker")
292-
if err != nil {
293-
return err
294-
}
295-
if err := cmd.Run(); err != nil {
296-
return err
297-
}
298-
299-
// HACK: create dir for ubuntu user to access
300-
log.Debugf("Adding key to authorized-keys.d...")
301-
302-
cmd, err = d.GetSSHCommand("sudo mkdir -p /root/.docker && sudo chown -R ubuntu /root/.docker")
303-
if err != nil {
304-
return err
305-
}
306-
if err := cmd.Run(); err != nil {
307-
return err
308-
}
309268

310-
f, err := os.Open(filepath.Join(os.Getenv("HOME"), ".docker/public-key.json"))
311-
if err != nil {
312-
return err
313-
}
314-
defer f.Close()
315-
316-
cmdString := fmt.Sprintf("sudo mkdir -p %q && sudo tee -a %q", "/root/.docker/authorized-keys.d", "/root/.docker/authorized-keys.d/docker-host.json")
317-
cmd, err = d.GetSSHCommand(cmdString)
318-
if err != nil {
319-
return err
320269
}
321-
cmd.Stdin = f
322270
if err := cmd.Run(); err != nil {
323271
return err
324-
}
325272

326-
cmd, err = d.GetSSHCommand("sudo start docker")
327-
if err != nil {
328-
return err
329-
}
330-
if err := cmd.Run(); err != nil {
331-
return err
332273
}
333274

334275
return nil

‎drivers/digitalocean/digitalocean.go‎

Lines changed: 15 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,19 @@ import (
1919
)
2020

2121
type Driver struct {
22-
AccessToken string
23-
DropletID int
24-
Image string
25-
IPAddress string
26-
MachineName string
27-
Region string
28-
SSHKeyID int
29-
Size string
30-
storePath string
22+
AccessToken string
23+
DropletID int
24+
DropletName string
25+
Image string
26+
MachineName string
27+
IPAddress string
28+
Region string
29+
SSHKeyID int
30+
Size string
31+
CaCertPath string
32+
PrivateKeyPath string
33+
DriverKeyPath string
34+
storePath string
3135
}
3236

3337
func init() {
@@ -67,8 +71,8 @@ func GetCreateFlags() []cli.Flag {
6771
}
6872
}
6973

70-
func NewDriver(machineName string, storePath string) (drivers.Driver, error) {
71-
return &Driver{MachineName: machineName, storePath: storePath}, nil
74+
func NewDriver(machineName string, storePath string, caCert string, privateKey string) (drivers.Driver, error) {
75+
return &Driver{MachineName: machineName, storePath: storePath, CaCertPath: caCert, PrivateKeyPath: privateKey}, nil
7276
}
7377

7478
func (d *Driver) DriverName() string {
@@ -160,48 +164,6 @@ func (d *Driver) Create() error {
160164
return err
161165
}
162166

163-
log.Debugf("HACK: Downloading version of Docker with identity auth...")
164-
165-
cmd, err = d.GetSSHCommand("stop docker")
166-
if err != nil {
167-
return err
168-
}
169-
if err := cmd.Run(); err != nil {
170-
return err
171-
}
172-
173-
cmd, err = d.GetSSHCommand("curl -sS https://ehazlett.s3.amazonaws.com/public/docker/linux/docker-1.4.1-136b351e-identity > /usr/bin/docker")
174-
if err != nil {
175-
return err
176-
}
177-
if err := cmd.Run(); err != nil {
178-
return err
179-
}
180-
181-
log.Debugf("Updating /etc/default/docker to use identity auth...")
182-
183-
cmd, err = d.GetSSHCommand("echo 'export DOCKER_OPTS=\"--auth=identity --host=tcp://0.0.0.0:2376 --host=unix:///var/run/docker.sock\"' >> /etc/default/docker")
184-
if err != nil {
185-
return err
186-
}
187-
if err := cmd.Run(); err != nil {
188-
return err
189-
}
190-
191-
log.Debugf("Adding key to authorized-keys.d...")
192-
193-
if err := drivers.AddPublicKeyToAuthorizedHosts(d, "/.docker/authorized-keys.d"); err != nil {
194-
return err
195-
}
196-
197-
cmd, err = d.GetSSHCommand("start docker")
198-
if err != nil {
199-
return err
200-
}
201-
if err := cmd.Run(); err != nil {
202-
return err
203-
}
204-
205167
return nil
206168
}
207169

‎drivers/drivers.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ type Driver interface {
6767
// - RegisterCreateFlags: a function that takes the FlagSet for
6868
// "docker hosts create" and returns an object to pass to SetConfigFromFlags
6969
type RegisteredDriver struct {
70-
New func(machineName string, storePath string) (Driver, error)
70+
New func(machineName string, storePath string, caCert string, privateKey string) (Driver, error)
7171
GetCreateFlags func() []cli.Flag
7272
}
7373

@@ -92,12 +92,12 @@ func Register(name string, registeredDriver *RegisteredDriver) error {
9292
}
9393

9494
// NewDriver creates a new driver of type "name"
95-
func NewDriver(name string, machineName string, storePath string) (Driver, error) {
95+
func NewDriver(name string, machineName string, storePath string, caCert string, privateKey string) (Driver, error) {
9696
driver, exists := drivers[name]
9797
if !exists {
9898
return nil, fmt.Errorf("hosts: Unknown driver %q", name)
9999
}
100-
return driver.New(machineName, storePath)
100+
return driver.New(machineName, storePath, caCert, privateKey)
101101
}
102102

103103
// GetCreateFlags runs GetCreateFlags for all of the drivers and

‎drivers/virtualbox/virtualbox.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ type Driver struct {
3232
Memory int
3333
DiskSize int
3434
Boot2DockerURL string
35+
CaCertPath string
36+
PrivateKeyPath string
3537
storePath string
3638
}
3739

@@ -71,8 +73,8 @@ func GetCreateFlags() []cli.Flag {
7173
}
7274
}
7375

74-
func NewDriver(machineName string, storePath string) (drivers.Driver, error) {
75-
return &Driver{MachineName: machineName, storePath: storePath}, nil
76+
func NewDriver(machineName string, storePath string, caCert string, privateKey string) (drivers.Driver, error) {
77+
return &Driver{MachineName: machineName, storePath: storePath, CaCertPath: caCert, PrivateKeyPath: privateKey}, nil
7678
}
7779

7880
func (d *Driver) DriverName() string {

0 commit comments

Comments
 (0)