// Start starts the cluster.
func (l *LocalCluster) Start(ctx context.Context) {
defer l.stopOnPanic(ctx)
l.mu.Lock()
defer l.mu.Unlock()
l.createNetwork(ctx)
l.initCluster(ctx)
log.Infof(ctx, "creating certs (%dbit) in: %s", keyLen, l.CertsDir)
l.createCACert()
l.createNodeCerts()
maybePanic(security.RunCreateClientCert(
filepath.Join(l.CertsDir, security.EmbeddedCACert),
filepath.Join(l.CertsDir, security.EmbeddedCAKey),
filepath.Join(l.CertsDir, security.EmbeddedRootCert),
filepath.Join(l.CertsDir, security.EmbeddedRootKey),
512, security.RootUser))
l.monitorCtx, l.monitorCtxCancelFunc = context.WithCancel(context.Background())
go l.monitor(ctx)
var wg sync.WaitGroup
wg.Add(len(l.Nodes))
for _, node := range l.Nodes {
go func(node *testNode) {
l.startNode(ctx, node)
wg.Done()
}(node)
}
wg.Wait()
}
// runCreateClientCert generates key pair and CA certificate and writes them
// to their corresponding files.
func runCreateClientCert(cmd *cobra.Command, args []string) error {
if len(args) != 1 {
return usageAndError(cmd)
}
if len(baseCfg.SSLCA) == 0 || len(baseCfg.SSLCAKey) == 0 ||
len(baseCfg.SSLCert) == 0 || len(baseCfg.SSLCertKey) == 0 {
return errMissingParams
}
return errors.Wrap(security.RunCreateClientCert(baseCfg.SSLCA, baseCfg.SSLCAKey,
baseCfg.SSLCert, baseCfg.SSLCertKey, keySize, args[0]),
"failed to generate clent certificate",
)
}
// Start starts the cluster.
func (l *LocalCluster) Start() {
defer l.stopOnPanic()
l.mu.Lock()
defer l.mu.Unlock()
l.createNetwork()
l.initCluster()
log.Infof(context.Background(), "creating certs (%dbit) in: %s", keyLen, l.CertsDir)
l.createCACert()
l.createNodeCerts()
maybePanic(security.RunCreateClientCert(
filepath.Join(l.CertsDir, security.EmbeddedCACert),
filepath.Join(l.CertsDir, security.EmbeddedCAKey),
filepath.Join(l.CertsDir, security.EmbeddedRootCert),
filepath.Join(l.CertsDir, security.EmbeddedRootKey),
512, security.RootUser))
l.monitorCtx, l.monitorCtxCancelFunc = context.WithCancel(context.Background())
go l.monitor()
for _, node := range l.Nodes {
l.startNode(node)
}
}
// This is a fairly high-level test of CA and node certificates.
// We construct SSL server and clients and use the generated certs.
func TestUseCerts(t *testing.T) {
defer leaktest.AfterTest(t)()
// Do not mock cert access for this test.
security.ResetReadFileFn()
defer ResetTest()
certsDir := util.CreateTempDir(t, "certs_test")
defer util.CleanupDir(certsDir)
err := security.RunCreateCACert(
filepath.Join(certsDir, security.EmbeddedCACert),
filepath.Join(certsDir, security.EmbeddedCAKey),
512)
if err != nil {
t.Fatalf("Expected success, got %v", err)
}
err = security.RunCreateNodeCert(
filepath.Join(certsDir, security.EmbeddedCACert),
filepath.Join(certsDir, security.EmbeddedCAKey),
filepath.Join(certsDir, security.EmbeddedNodeCert),
filepath.Join(certsDir, security.EmbeddedNodeKey),
512, []string{"127.0.0.1"})
if err != nil {
t.Fatalf("Expected success, got %v", err)
}
err = security.RunCreateClientCert(
filepath.Join(certsDir, security.EmbeddedCACert),
filepath.Join(certsDir, security.EmbeddedCAKey),
filepath.Join(certsDir, security.EmbeddedRootCert),
filepath.Join(certsDir, security.EmbeddedRootKey),
512, security.RootUser)
if err != nil {
t.Fatalf("Expected success, got %v", err)
}
// Load TLS Configs. This is what TestServer and HTTPClient do internally.
_, err = security.LoadServerTLSConfig(
filepath.Join(certsDir, security.EmbeddedCACert),
filepath.Join(certsDir, security.EmbeddedNodeCert),
filepath.Join(certsDir, security.EmbeddedNodeKey))
if err != nil {
t.Fatalf("Expected success, got %v", err)
}
_, err = security.LoadClientTLSConfig(
filepath.Join(certsDir, security.EmbeddedCACert),
filepath.Join(certsDir, security.EmbeddedNodeCert),
filepath.Join(certsDir, security.EmbeddedNodeKey))
if err != nil {
t.Fatalf("Expected success, got %v", err)
}
// Start a test server and override certs.
// We use a real context since we want generated certs.
params := base.TestServerArgs{
SSLCA: filepath.Join(certsDir, security.EmbeddedCACert),
SSLCert: filepath.Join(certsDir, security.EmbeddedNodeCert),
SSLCertKey: filepath.Join(certsDir, security.EmbeddedNodeKey),
}
s, _, _ := serverutils.StartServer(t, params)
defer s.Stopper().Stop()
// Insecure mode.
clientContext := testutils.NewNodeTestBaseContext()
clientContext.Insecure = true
httpClient, err := clientContext.GetHTTPClient()
if err != nil {
t.Fatal(err)
}
req, err := http.NewRequest("GET", s.AdminURL()+"/_admin/v1/health", nil)
if err != nil {
t.Fatalf("could not create request: %v", err)
}
resp, err := httpClient.Do(req)
if err == nil {
resp.Body.Close()
t.Fatalf("Expected SSL error, got success")
}
// New client. With certs this time.
clientContext = testutils.NewNodeTestBaseContext()
clientContext.SSLCA = filepath.Join(certsDir, security.EmbeddedCACert)
clientContext.SSLCert = filepath.Join(certsDir, security.EmbeddedNodeCert)
clientContext.SSLCertKey = filepath.Join(certsDir, security.EmbeddedNodeKey)
httpClient, err = clientContext.GetHTTPClient()
if err != nil {
t.Fatalf("Expected success, got %v", err)
}
req, err = http.NewRequest("GET", s.AdminURL()+"/_admin/v1/health", nil)
if err != nil {
t.Fatalf("could not create request: %v", err)
}
resp, err = httpClient.Do(req)
if err != nil {
t.Fatalf("Expected success, got %v", err)
}
resp.Body.Close()
if resp.StatusCode != http.StatusOK {
t.Fatalf("Expected OK, got: %d", resp.StatusCode)
}
}