support grpc auth.

Signed-off-by: morvencao <[email protected]>

cmd/maestro/environments/framework.go

@@ -8,10 +8,14 @@ import (
 	"github.com/getsentry/sentry-go"
 	"github.com/golang/glog"
 	"github.com/openshift-online/maestro/pkg/client/cloudevents"
+	"github.com/openshift-online/maestro/pkg/client/grpcauthorizer"
 	"github.com/openshift-online/maestro/pkg/client/ocm"
 	"github.com/openshift-online/maestro/pkg/config"
 	"github.com/openshift-online/maestro/pkg/errors"
 	"github.com/spf13/pflag"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
 
 	"open-cluster-management.io/sdk-go/pkg/cloudevents/generic"
 )
@@ -196,6 +200,31 @@ func (e *Env) LoadClients() error {
 		}
 	}
 
+	// Create GRPC authorizer based on configuration
+	if e.Config.GRPCServer.EnableGRPCServer {
+		if e.Config.GRPCServer.EnableGRPCAuthZMock {
+			glog.Infof("Using Mock GRPC Authorizer")
+			e.Clients.GRPCAuthorizer = grpcauthorizer.NewMockGRPCAuthorizer()
+		} else {
+			kubeConfig, err := clientcmd.BuildConfigFromFlags("", e.Config.GRPCServer.GRPCAuthrizerConfig)
+			if err != nil {
+				glog.Warningf("Unable to create kube client config: %s", err.Error())
+				// fallback to in-cluster config
+				kubeConfig, err = rest.InClusterConfig()
+				if err != nil {
+					glog.Errorf("Unable to create kube client config: %s", err.Error())
+					return err
+				}
+			}
+			kubeClient, err := kubernetes.NewForConfig(kubeConfig)
+			if err != nil {
+				glog.Errorf("Unable to create kube client: %s", err.Error())
+				return err
+			}
+			e.Clients.GRPCAuthorizer = grpcauthorizer.NewKubeGRPCAuthorizer(kubeClient)
+		}
+	}
+
 	return nil
 }
 

cmd/maestro/environments/types.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/openshift-online/maestro/pkg/auth"
 	"github.com/openshift-online/maestro/pkg/client/cloudevents"
+	"github.com/openshift-online/maestro/pkg/client/grpcauthorizer"
 	"github.com/openshift-online/maestro/pkg/client/ocm"
 	"github.com/openshift-online/maestro/pkg/config"
 	"github.com/openshift-online/maestro/pkg/db"
@@ -57,6 +58,7 @@ type Services struct {
 
 type Clients struct {
 	OCM               *ocm.Client
+	GRPCAuthorizer    grpcauthorizer.GRPCAuthorizer
 	CloudEventsSource cloudevents.SourceClient
 }
 

cmd/maestro/server/api_server.go

@@ -126,7 +126,7 @@ func NewAPIServer(eventBroadcaster *event.EventBroadcaster) Server {
 
 	// TODO: support authn and authz for gRPC
 	if env().Config.GRPCServer.EnableGRPCServer {
-		s.grpcServer = NewGRPCServer(env().Services.Resources(), eventBroadcaster, *env().Config.GRPCServer)
+		s.grpcServer = NewGRPCServer(env().Services.Resources(), eventBroadcaster, *env().Config.GRPCServer, env().Clients.GRPCAuthorizer)
 	}
 	return s
 }

cmd/maestro/server/grpc_broker.go

@@ -14,7 +14,6 @@ import (
 	"github.com/golang/glog"
 	"github.com/google/uuid"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/keepalive"
 	"google.golang.org/protobuf/types/known/emptypb"
 	"k8s.io/klog/v2"
@@ -74,26 +73,7 @@ func NewGRPCBroker(eventBroadcaster *event.EventBroadcaster) EventServer {
 		MaxConnectionAge: config.MaxConnectionAge,
 	}))
 
-	if config.EnableTLS {
-		// Check tls cert and key path path
-		if config.TLSCertFile == "" || config.TLSKeyFile == "" {
-			check(
-				fmt.Errorf("unspecified required --grpc-tls-cert-file, --grpc-tls-key-file"),
-				"Can't start gRPC broker",
-			)
-		}
-
-		// Serve with TLS
-		creds, err := credentials.NewServerTLSFromFile(config.TLSCertFile, config.TLSKeyFile)
-		if err != nil {
-			glog.Fatalf("Failed to generate credentials %v", err)
-		}
-		grpcServerOptions = append(grpcServerOptions, grpc.Creds(creds))
-		glog.Infof("Serving gRPC broker with TLS at %s", config.BrokerBindPort)
-	} else {
-		glog.Infof("Serving gRPC broker without TLS at %s", config.BrokerBindPort)
-	}
-
+	glog.Infof("Serving gRPC broker without TLS at %s", config.BrokerBindPort)
 	sessionFactory := env().Database.SessionFactory
 	return &GRPCBroker{
 		grpcServer:         grpc.NewServer(grpcServerOptions...),
@@ -109,14 +89,15 @@ func NewGRPCBroker(eventBroadcaster *event.EventBroadcaster) EventServer {
 
 // Start starts the gRPC broker
 func (bkr *GRPCBroker) Start(ctx context.Context) {
+	glog.Info("Starting gRPC broker")
 	lis, err := net.Listen("tcp", bkr.bindAddress)
 	if err != nil {
-		glog.Fatalf("failed to listen: %v", err)
+		check(fmt.Errorf("failed to listen: %v", err), "Can't start gRPC broker")
 	}
 	pbv1.RegisterCloudEventServiceServer(bkr.grpcServer, bkr)
 	go func() {
 		if err := bkr.grpcServer.Serve(lis); err != nil {
-			glog.Fatalf("failed to start gRPC broker: %v", err)
+			check(fmt.Errorf("failed to serve gRPC broker: %v", err), "Can't start gRPC broker")
 		}
 	}()