ostree: configurable MTLS config for ostree resolve #975

lzap · 2024-10-10T16:04:14Z

To complete edge service Pulp migration, we need to be able to resolve and download ostree commits from Pulp running behind console.redhat.com proxy which only supports MTLS for authentication. I have found that some MTLS support is already present but it does not make much sense why RHSM is used. I cannot figure out a workflow why ostree repo would be published via RHSM cert. I am not aware of any RH ostree content hosted via RH CDN.

This this patch is a proposal to completely remove the RHSM from ostree pipeline and replace it with simple ENV variables for CA cert, client cert and key. We only need support for accessing Insights. This feature can be possibly used by anyone wanting MTLS for ostree from which ability to set a CA cert is I think pretty helpful feature for anyone.

Now, this will likely break things, when I search for org.osbuild.rhsm.consumer I see couple of places so please search with me and help me to find what else needs to be refactored. Thanks.

Reuses variables from osbuild/osbuild-composer#4412

cmd/ostree-resolve/main.go

lzap · 2024-10-10T16:14:29Z

For the record, we want to use the same cert which is used to access RPM content, maybe there already is an ENV variable for that? @croissanne

croissanne

The mtls secrets need to be passed in the same way as https://github.com/osbuild/osbuild-composer/blob/main/cmd/osbuild-worker/jobimpl-depsolve.go.

So they're set in the worker config, and then just pass them along to the ostree resolve job.

croissanne · 2024-10-15T08:25:58Z

pkg/ostree/ostree.go

+		tlsConf := &tls.Config{}
+
+		// If CA is set, load the CA certificate and add it to the TLS configuration. Otherwise, use the system CA.
+		if caFilename := os.Getenv("OSBUILD_SOURCES_OSTREE_SSL_CA_CERT"); caFilename != "" {


Instead of using env variables here, I think you should be able to just pass a struct or something containing the mtls secrets. https://github.com/osbuild/osbuild-composer/blob/main/cmd/osbuild-worker/jobimpl-ostree-resolve.go is the entrypoint here

lzap · 2024-10-15T09:51:31Z

Good point, amending a change. I am trying hard not to break the API by introducing an option struct, but since the ResolveRef does not seem to be used in composer, I am taking the liberty on changing it. If you feel this is not okay and other components might be using that, I will introduce a complatibility function and leave the original untouched.

Edit: Fixed tests.

lzap · 2024-10-15T10:02:16Z

cmd/ostree-resolve/main.go

+		ostree.WithResolveCA(os.Getenv("OSBUILD_SOURCES_OSTREE_SSL_CA_CERT")),
+		ostree.WithResolveMTLSClient(os.Getenv("OSBUILD_SOURCES_OSTREE_SSL_CLIENT_CERT"), os.Getenv("OSBUILD_SOURCES_OSTREE_SSL_CLIENT_KEY")),
+		ostree.WithResolveProxy(proxy),
+	)


The Resolve function is kept compatible with the old codebase in composer, the options are completely optional therefore passing just spec will work and in fact not use any MTLS configuration.

lzap · 2024-10-15T10:03:04Z

pkg/ostree/ostree.go

@@ -141,56 +134,46 @@ func verifyChecksum(commit string) bool {
 // ResolveRef resolves the URL path specified by the location and ref
 // (location+"refs/heads/"+ref) and returns the commit ID for the named ref. If
 // there is an error, it will be of type ResolveRefError.
-func ResolveRef(location, ref string, consumerCerts bool, subs *rhsm.Subscriptions, ca *string) (string, error) {
+func ResolveRef(location, ref, caCert, cert, key string, proxy *url.URL) (string, error) {


Possible API break but composer does not appear to use this directly.

It's fine to break the API, will just require a tweak in composer when updating images.

pkg/ostree/ostree.go

lzap · 2024-10-15T14:03:24Z

So I changed the code so the API contract is not broken. Tests are passing now, except I think unrelevant ones.

lzap · 2024-10-16T07:23:51Z

CentOS Stream 10 - BaseOS                       647  B/s | 3.9 kB     00:06    
Errors during downloading metadata for repository 'baseos':
  - Downloading successful, but checksum doesn't match. Calculated: 09f9f3040a68ccceb349f04463cad23b3af1dc36ccf61c1fada52b9955a441742d8434dcb66f265924aed2d2b9dee3edaf16e0534fe475c6a5faf45db021d9a1(sha512)  Expected: f3765f12125ff6f09532cd5e74a0ab0bf0b275aa28794c1171b11ed247ed46fe60a7869d2ddc4658e31ac155632b4def908fd473050e6f68c32322212b921f62(sha512) 
Error: Failed to download metadata for repo 'baseos': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried

achilleas-k · 2024-10-17T12:54:05Z

pkg/ostree/ostree.go

+// ResolveRef is deprecated, use ResolveRefMTLS.
+func ResolveRef(location, ref string, consumerCerts bool, subs *rhsm.Subscriptions, ca *string) (string, error) {


Just break the API. The mess of keeping deprecated functions around isn't worth the effort.

How about I do a followup PR once this is integrated into composer? Because if I remove this function tests immediately breaks, I feel like I would make my life harder by straight-up breaking it.

Which tests break? The integration ones with composer? Those are non-required for a reason. They're meant as a warning to the PR creator that they will have to change osbuild-composer when updating.

How about I do a followup PR once this is integrated into composer?

I'd rather have one clean PR than two messy ones. The way it is now it's hard to review (though not too hard). I suspect that a single PR that makes the appropriate change would be easier for me to wrap my head around, rather than try to imagine what it will look like eventually.

achilleas-k · 2024-10-17T12:54:57Z

pkg/ostree/ostree.go

+	URL string
+	Ref string
+	// RHSM is deprecated, use Resolve function with MTLS configuration


Could the mTLS configuration be added to the SourceSpec? I imagine that would make things simpler, but I haven't written it out to be sure.

Yeah well I thought that SourceSpec is a type I should not touch. Now that I think about it, I can add fields directly in there that is more simple. Let me try.

achilleas-k · 2024-10-17T12:55:45Z

pkg/ostree/ostree.go

+func Resolve(source SourceSpec, opt ...ResolveOptionFn) (CommitSpec, error) {
+	options := ResolveOptions{}
+	for _, o := range opt {
+		o(&options)
+	}


This is a very odd pattern for something that could just be an extension of the SourceSpec struct.

Yeah well I thought that SourceSpec is a type I should not touch. Now that I think about it, I can add fields directly in there that is more simple.

lzap · 2024-10-17T16:21:57Z

Oh when working on the changes you proposed, I realized I completely missed this input type which maps to the SourceSpec:

// Input represents the user-provided inputs that will be used to resolve an
// ostree commit ID.
type Input struct {
	// URL of the repo where the commit can be fetched.
	URL string `json:"url"`

	// Ref to resolve.
	Ref string `json:"ref"`

	// Whether to use RHSM secrets when resolving and fetching the commit.
	RHSM bool `json:"rhsm,omitempty"`
}

So it was not complete at all, I fixed it. How about this?

The solution now properly reads these ENV variables, I hope they are available.

lzap commented Oct 10, 2024

View reviewed changes

cmd/ostree-resolve/main.go Outdated Show resolved Hide resolved

lzap requested a review from achilleas-k October 10, 2024 16:19

lzap force-pushed the mtls-ostree branch 2 times, most recently from d75dffc to 9505bf9 Compare October 15, 2024 07:05

lzap marked this pull request as ready for review October 15, 2024 07:05

croissanne requested changes Oct 15, 2024

View reviewed changes

lzap force-pushed the mtls-ostree branch 2 times, most recently from 652d38b to 56a8132 Compare October 15, 2024 10:00

lzap commented Oct 15, 2024

View reviewed changes

pkg/ostree/ostree.go Outdated Show resolved Hide resolved

lzap force-pushed the mtls-ostree branch 2 times, most recently from 46d5ed0 to 3b8187d Compare October 15, 2024 10:06

lzap changed the title ~~ostree: drop RHSM for MTLS over ENV~~ ostree: configurable MTLS config for ostree resolve Oct 15, 2024

lzap force-pushed the mtls-ostree branch from 3b8187d to 814531b Compare October 15, 2024 10:56

lzap mentioned this pull request Oct 15, 2024

osbuild-worker: set ostree input MTLS vars osbuild/osbuild-composer#4412

Open

lzap force-pushed the mtls-ostree branch 2 times, most recently from 379ffe3 to 4ec713c Compare October 16, 2024 07:27

achilleas-k requested changes Oct 17, 2024

View reviewed changes

lzap force-pushed the mtls-ostree branch from 4ec713c to 8e5b68c Compare October 17, 2024 16:21

ostree: configurable MTLS config for ostree resolve

56e72d4

lzap force-pushed the mtls-ostree branch from 8e5b68c to 56e72d4 Compare October 17, 2024 16:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ostree: configurable MTLS config for ostree resolve #975

ostree: configurable MTLS config for ostree resolve #975

lzap commented Oct 10, 2024 •

edited

Loading

lzap commented Oct 10, 2024

croissanne left a comment •

edited

Loading

croissanne Oct 15, 2024

lzap commented Oct 15, 2024 •

edited

Loading

lzap Oct 15, 2024

lzap Oct 15, 2024

croissanne Oct 15, 2024

lzap commented Oct 15, 2024

lzap commented Oct 16, 2024

achilleas-k Oct 17, 2024

lzap Oct 17, 2024

achilleas-k Oct 17, 2024

achilleas-k Oct 17, 2024

lzap Oct 17, 2024

achilleas-k Oct 17, 2024

lzap Oct 17, 2024

lzap commented Oct 17, 2024

		// ResolveRef is deprecated, use ResolveRefMTLS.
		func ResolveRef(location, ref string, consumerCerts bool, subs rhsm.Subscriptions, ca string) (string, error) {

ostree: configurable MTLS config for ostree resolve #975

Are you sure you want to change the base?

ostree: configurable MTLS config for ostree resolve #975

Conversation

lzap commented Oct 10, 2024 • edited Loading

lzap commented Oct 10, 2024

croissanne left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lzap commented Oct 15, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lzap commented Oct 15, 2024

lzap commented Oct 16, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lzap commented Oct 17, 2024

lzap commented Oct 10, 2024 •

edited

Loading

croissanne left a comment •

edited

Loading

lzap commented Oct 15, 2024 •

edited

Loading