Dark-Alex-17/kapow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Control API uses automatic cross-pinning mTLS (Closes #119)

Browse Source 
. kapow server generates on startup a pair of certificates
that will use to secure communications to its control server.
It will communicate the server and client certificates as well
as the client private key to the init programs it launches,
via environment variables.

. kapow server now understands a new flag --control-reachable-addr
which accepts either a IP address or a DNS name, that can be used
to ensure that the generated server certificate will be appropiate
in case the control server must be accessed from something other
than localhost.

Co-authored-by: Roberto Abdelkader Martínez Pérez <robertomartinezp@gmail.com>
This commit is contained in:
pancho horrillo
2021-03-12 17:11:12 +01:00
parent ab50721f69
commit 1e63f3c104
18 changed files with 325 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/source/concepts/interfaces.rst
+9 -5
View File
@@ -16,16 +16,20 @@ By default it binds to address ``0.0.0.0`` and port ``8080``, but that can be
changed via the ``--bind`` flag.
.. _http-control-interface:
.. _https-control-interface:
HTTP Control Interface
----------------------
HTTPS Control Interface
-----------------------
The `HTTP Control Interface` is used by the command ``kapow route`` to
The `HTTPS Control Interface` is used by the command ``kapow route`` to
administer the list of system routes.
This interface uses mTLS by default (double-pinned autogenerated certs).
By default it binds to address ``127.0.0.1`` and port ``8081``, but that can be
changed via the ``--control-bind`` flag.
changed via the ``--control-bind`` flag. If this is the case, consider
also ``--control-reachable-addr`` which will configure the autogenerated
certificate to match that address.
.. _http-data-interface:
docs/source/concepts/request_life_cycle.rst
+2 -2
View File
@@ -30,8 +30,8 @@ The spawned entrypoint is run with the following variables added to its
environment:
- :envvar:`KAPOW_HANDLER_ID`: Containing the `HANDLER_ID`
- :envvar:`KAPOW_DATAAPI_URL`: With the URL of the :ref:`http-data-interface`
- :envvar:`KAPOW_CONTROLAPI_URL`: With the URL of the :ref:`http-control-interface`
- :envvar:`KAPOW_DATA_URL`: With the URL of the :ref:`http-data-interface`
- :envvar:`KAPOW_CONTROL_URL`: With the URL of the :ref:`https-control-interface`
3. ``kapow set /response/body banana``