Skip to content

Commit fa5362a

Browse files
v0lkanv0lkan
authored
Configurable data directory for SPIKE Nexus backing store (#232)
* Configurable data directory. This will be useful to parallelize tests too. Signed-off-by: Volkan Özçelik <[email protected]> * Configurable data directory. This will be useful to parallelize tests too. Signed-off-by: Volkan Özçelik <[email protected]> * WIP. Signed-off-by: Volkan Özçelik <[email protected]> * WIP. Signed-off-by: Volkan Özçelik <[email protected]> * WIP. Signed-off-by: Volkan Özçelik <[email protected]> * hopefully-working version. will check tomorrow. Signed-off-by: Volkan Özçelik <[email protected]> * minor changes. Signed-off-by: Volkan Özçelik <[email protected]> * wip. Signed-off-by: Volkan Özçelik <[email protected]> * wip. Signed-off-by: Volkan Özçelik <[email protected]> * add docs. Signed-off-by: Volkan Özçelik <[email protected]> * env var const Signed-off-by: Volkan Özçelik <[email protected]> * wip Signed-off-by: Volkan Özçelik <[email protected]> * docs Signed-off-by: Volkan Özçelik <[email protected]> * fix failing test. Signed-off-by: Volkan Özçelik <[email protected]> --------- Signed-off-by: Volkan Özçelik <[email protected]>
1 parent 2244b83 commit fa5362a

File tree

77 files changed

+1836
-368
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

77 files changed

+1836
-368
lines changed

‎CLAUDE.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,17 +53,21 @@ missing environment variables that are not mentioned and suggest updates here.
5353
| SPIKE Nexus | `SPIKE_NEXUS_SHAMIR_SHARES` | The total number of shares used for secret sharding, this should be equal to the number of SPIKE Keepers too. | `3` |
5454
| SPIKE Nexus | `SPIKE_NEXUS_SHAMIR_THRESHOLD` | The minimum number of shares to be able to reconstruct the root key. | `2` |
5555
| SPIKE Nexus | `SPIKE_NEXUS_KEEPER_UPDATE_INTERVAL` | The duration between SPIKE Nexus updates SPIKE Keepers with the relevant shard information. | `5m` |
56+
| SPIKE Nexus | `SPIKE_NEXUS_DATA_DIR` | Custom data directory for SPIKE Nexus database storage. If not set, falls back to `~/.spike/data`. | `""` (uses `~/.spike/data`) |
57+
| SPIKE Pilot | `SPIKE_PILOT_RECOVERY_DIR` | Custom recovery directory for SPIKE Pilot recovery shards. If not set, falls back to `~/.spike/recover`. | `""` (uses `~/.spike/recover`) |
5658
| SPIKE Pilot | `SPIKE_PILOT_SHOW_MEMORY_WARNING` | Whether to show a warning when the system cannot lock memory for security. | `false` |
5759
| All | `SPIKE_SYSTEM_LOG_LEVEL` | The log level for all SPIKE components (`"DEBUG"`, `"INFO"`, `"WARN"`, `"ERROR"`). | `"WARN"` |
5860
| All | `SPIKE_NEXUS_API_URL` | The URL where SPIKE Nexus can be reached | `"https://localhost:8553"` |
5961
| All | `SPIKE_TRUST_ROOT` | The SPIFFE trust root used within the SPIKE trust boundary. Can be a single entry, or a comma-delimited list of suitable trust roots. | `"spike.ist"` |
6062
| All | `SPIKE_TRUST_ROOT_KEEPER` | The SPIFFE trust root used for SPIKE Keeper instances. Can be a single entry, or a comma-delimited list of suitable trust roots. | `"spike.ist"` |
6163
| All | `SPIKE_TRUST_ROOT_PILOT` | The SPIFFE trust root used for SPIKE Pilot instances. Can be a single entry, or a comma-delimited list of suitable trust roots. | `"spike.ist"` |
6264
| All | `SPIKE_TRUST_ROOT_NEXUS` | The SPIFFE trust root used for SPIKE Nexus instances. Can be a single entry, or a comma-delimited list of suitable trust roots. | `"spike.ist"` |
65+
| All | `SPIKE_TRUST_ROOT_BOOTSTRAP` | The SPIFFE trust root used for SPIKE Bootstrap. Can be a single entry, or a comma-delimited list of suitable trust roots. | `"spike.ist"` |
6366
| All | `SPIKE_TRUST_ROOT_LITE_WORKLOAD` | The SPIFFE trust root used for lite workload instances. Can be a single entry, or a comma-delimited list of suitable trust roots. | `"spike.ist"` |
6467
| All | `SPIKE_BANNER_ENABLED` | Whether to display the SPIKE banner on startup. Set to `true` to enable. | `true` |
6568
| All | `SPIFFE_ENDPOINT_SOCKET` | The Unix domain socket path used for SPIFFE Workload API | `"unix:///tmp/spire-agent/public/api.sock"` |
6669

70+
6771
### Error Handling Strategy
6872
- `panic()` for "should never happen" errors (testable)
6973
- `os.Exit(1)` should NEVER happen (panic instead; it is testable)

‎app/VERSION.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0.5.1
1+
0.6.0

‎app/bootstrap/cmd/main.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,13 @@ import (
1515
"github.com/spiffe/spike-sdk-go/retry"
1616
"github.com/spiffe/spike-sdk-go/spiffe"
1717
svid "github.com/spiffe/spike-sdk-go/spiffeid"
18-
"github.com/spiffe/spike/internal/config"
1918

2019
"github.com/spiffe/spike/app/bootstrap/internal/env"
2120
"github.com/spiffe/spike/app/bootstrap/internal/lifecycle"
2221
"github.com/spiffe/spike/app/bootstrap/internal/net"
2322
"github.com/spiffe/spike/app/bootstrap/internal/state"
2423
"github.com/spiffe/spike/app/bootstrap/internal/url"
24+
"github.com/spiffe/spike/internal/config"
2525
)
2626

2727
func main() {
@@ -62,7 +62,7 @@ func main() {
6262
return
6363
}
6464

65-
if !svid.IsBootstrap(env.TrustRoot(), sv.ID.String()) {
65+
if !svid.IsBootstrap(sv.ID.String()) {
6666
log.Log().Error(
6767
"Authenticate: You need a 'bootstrap' SPIFFE ID to use this command.",
6868
)

‎app/bootstrap/internal/env/env.go‎

Lines changed: 0 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -132,43 +132,6 @@ func Keepers() map[string]string {
132132
return peers
133133
}
134134

135-
// TrustRootForKeeper returns the trust root domain(s) specifically for
136-
// SPIKE Keeper service.
137-
//
138-
// It retrieves the trust root from the SPIKE_TRUST_ROOT_KEEPER environment
139-
// variable. If the environment variable is not set, it returns the default
140-
// value "spike.ist". The return value can be a comma-delimited string of
141-
// multiple trust root domains.
142-
//
143-
// Returns:
144-
// - A string containing one or more trust root domains for SPIKE Keeper,
145-
// comma-delimited if multiple
146-
func TrustRootForKeeper() string {
147-
tr := os.Getenv(env.TrustRootKeeper)
148-
if tr == "" {
149-
return "spike.ist"
150-
}
151-
return tr
152-
}
153-
154-
// TrustRoot returns the trust root domain(s) for the application.
155-
//
156-
// It retrieves the trust root from the SPIKE_TRUST_ROOT environment variable.
157-
// If the environment variable is not set, it returns the default value
158-
// "spike.ist". The return value can be a comma-delimited string of multiple
159-
// trust root domains.
160-
//
161-
// Returns:
162-
// - A string containing one or more trust root domains, comma-delimited if
163-
// multiple
164-
func TrustRoot() string {
165-
tr := os.Getenv(env.TrustRoot)
166-
if tr == "" {
167-
return "spike.ist"
168-
}
169-
return tr
170-
}
171-
172135
// ConfigMapName returns the name of the ConfigMap used to store SPIKE
173136
// Bootstrap state information.
174137
//

‎app/bootstrap/internal/net/net.go‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,9 @@ import (
1717
"github.com/spiffe/spike-sdk-go/crypto"
1818
"github.com/spiffe/spike-sdk-go/log"
1919
network "github.com/spiffe/spike-sdk-go/net"
20+
"github.com/spiffe/spike-sdk-go/predicate"
2021
"github.com/spiffe/spike-sdk-go/spiffe"
21-
"github.com/spiffe/spike-sdk-go/spiffeid"
2222

23-
"github.com/spiffe/spike/app/bootstrap/internal/env"
2423
"github.com/spiffe/spike/internal/net"
2524
)
2625

@@ -47,9 +46,7 @@ func Source() *workloadapi.X509Source {
4746
func MTLSClient(source *workloadapi.X509Source) *http.Client {
4847
const fName = "MTLSClient"
4948
client, err := network.CreateMTLSClientWithPredicate(
50-
source, func(peerId string) bool {
51-
return spiffeid.IsKeeper(env.TrustRootForKeeper(), peerId)
52-
},
49+
source, predicate.AllowKeeper,
5350
)
5451
if err != nil {
5552
log.FatalLn(fName,

‎app/demo/cmd/main.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,20 @@ import (
1111
)
1212

1313
func main() {
14+
fmt.Println("SPIKE Demo")
15+
16+
// Make sure you register the demo app SPIRE Server registration entry first:
17+
// ./examples/consume-secrets/demo-register-entry.sh
18+
1419
// https://pkg.go.dev/github.com/spiffe/spike-sdk-go/api#New
1520
api := spike.New() // Use the default Workload API Socket
1621

22+
fmt.Println("Connected to SPIKE Nexus.")
23+
1724
// https://pkg.go.dev/github.com/spiffe/spike-sdk-go/api#Close
1825
defer api.Close() // Close the connection when done
1926

20-
path := "^tenants/demo/db/creds"
27+
path := "tenants/demo/db/creds"
2128

2229
// Create a Secret
2330
// https://pkg.go.dev/github.com/spiffe/spike-sdk-go/api#PutSecret

‎app/keeper/cmd/main.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,10 @@ func main() {
4949
defer spiffe.CloseSource(source)
5050

5151
// I should be a SPIKE Keeper.
52-
if !spiffeid.IsKeeper(env.TrustRoot(), selfSPIFFEID) {
52+
if !spiffeid.IsKeeper(selfSPIFFEID) {
5353
log.FatalLn(appName, "message",
54-
"Authenticate: SPIFFE ID %s is not valid.\n", selfSPIFFEID)
54+
"Authenticate: SPIFFE ID is not valid",
55+
"spiffeid", selfSPIFFEID)
5556
}
5657

5758
log.Log().Info(

‎app/keeper/internal/env/spiffe.go‎

Lines changed: 0 additions & 48 deletions
This file was deleted.

‎app/keeper/internal/net/serve.go‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import (
88
"github.com/spiffe/go-spiffe/v2/workloadapi"
99
"github.com/spiffe/spike-sdk-go/log"
1010
"github.com/spiffe/spike-sdk-go/net"
11-
"github.com/spiffe/spike-sdk-go/spiffeid"
11+
"github.com/spiffe/spike-sdk-go/predicate"
1212

1313
"github.com/spiffe/spike/app/keeper/internal/env"
1414
http "github.com/spiffe/spike/app/keeper/internal/route/base"
@@ -33,10 +33,9 @@ func Serve(appName string, source *workloadapi.X509Source) {
3333
if err := net.ServeWithPredicate(
3434
source,
3535
func() { routing.HandleRoute(http.Route) },
36-
func(peerSpiffeId string) bool {
37-
// Only SPIKE Nexus can talk to SPIKE Keeper:
38-
return spiffeid.PeerCanTalkToKeeper(env.TrustRootForNexus(), peerSpiffeId)
39-
},
36+
// Security: Only SPIKE Nexus and SPIKE Bootstrap
37+
// can talk to SPIKE Keepers.
38+
predicate.AllowKeeperPeer,
4039
env.TLSPort(),
4140
); err != nil {
4241
log.FatalF("%s: Failed to serve: %s\n", appName, err.Error())

‎app/nexus/cmd/main.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"crypto/fips140"
1010
"fmt"
1111

12+
cfg "github.com/spiffe/spike-sdk-go/config/env"
1213
"github.com/spiffe/spike-sdk-go/log"
1314
"github.com/spiffe/spike-sdk-go/security/mem"
1415
"github.com/spiffe/spike-sdk-go/spiffe"
@@ -43,9 +44,10 @@ func main() {
4344
ctx, cancel := context.WithCancel(context.Background())
4445
defer cancel()
4546

46-
log.Log().Info(appName, "message", "SPIFFE Trust Domain: "+env.TrustRoot())
47+
log.Log().Info(appName,
48+
"message", "SPIFFE Trust Domain: "+cfg.TrustRootVal(),
49+
)
4750

48-
fmt.Println("before trying to get source...")
4951
source, selfSPIFFEID, err := spiffe.Source(ctx, spiffe.EndpointSocket())
5052
if err != nil {
5153
log.FatalLn(appName, "message", "failed to get source", "err", err.Error())
@@ -54,11 +56,12 @@ func main() {
5456

5557
log.Log().Info(appName, "message", "self.spiffeid: "+selfSPIFFEID)
5658

57-
// I should be Nexus.
58-
if !spiffeid.IsNexus(env.TrustRoot(), selfSPIFFEID) {
59+
// I should be SPIKE Nexus.
60+
if !spiffeid.IsNexus(selfSPIFFEID) {
5961
log.FatalLn(appName,
6062
"message",
61-
"Authenticate: SPIFFE ID %s is not valid.\n", selfSPIFFEID)
63+
"Authenticate: SPIFFE ID is not valid",
64+
"spiffeid", selfSPIFFEID)
6265
}
6366

6467
initialization.Initialize(source)

0 commit comments

Comments
 (0)