diff options
author | Bjørn Christian Seime <bjorncs@oath.com> | 2018-08-15 14:57:28 +0200 |
---|---|---|
committer | Bjørn Christian Seime <bjorncs@oath.com> | 2018-08-15 14:57:28 +0200 |
commit | d9eb236e0ede31ae7935076d274ce0db2d331560 (patch) | |
tree | d55f5634387fa4ca05ba6cc318e2cd91814e64a8 /vespa-athenz | |
parent | 506ea9c1367748ddd4ff20203fc13211d635f5a6 (diff) |
Revert "Remove listener interface from ServiceIdentityProvider"
This reverts commit 90cdc3376e9a899674264d9ffa2edf3286b248a7.
Diffstat (limited to 'vespa-athenz')
4 files changed, 76 insertions, 0 deletions
diff --git a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identity/ServiceIdentityProvider.java b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identity/ServiceIdentityProvider.java index 6b318fb16be..f945783cf8a 100644 --- a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identity/ServiceIdentityProvider.java +++ b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identity/ServiceIdentityProvider.java @@ -15,4 +15,10 @@ import javax.net.ssl.SSLContext; public interface ServiceIdentityProvider { AthenzService identity(); SSLContext getIdentitySslContext(); + void addIdentityListener(Listener listener); + void removeIdentityListener(Listener listener); + + interface Listener { + void onCredentialsUpdate(SSLContext sslContext, AthenzService identity); + } } diff --git a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identity/ServiceIdentityProviderListenerHelper.java b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identity/ServiceIdentityProviderListenerHelper.java new file mode 100644 index 00000000000..bf50673fab8 --- /dev/null +++ b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identity/ServiceIdentityProviderListenerHelper.java @@ -0,0 +1,40 @@ +// Copyright 2018 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. +package com.yahoo.vespa.athenz.identity; + +import com.yahoo.vespa.athenz.api.AthenzService; + +import javax.net.ssl.SSLContext; +import java.util.Set; +import java.util.concurrent.CopyOnWriteArraySet; + +/** + * A helper class managing {@link ServiceIdentityProvider.Listener} instances for implementations of {@link ServiceIdentityProvider}. + * + * @author bjorncs + */ +public class ServiceIdentityProviderListenerHelper { + + private final Set<ServiceIdentityProvider.Listener> listeners = new CopyOnWriteArraySet<>(); + private final AthenzService identity; + + public ServiceIdentityProviderListenerHelper(AthenzService identity) { + this.identity = identity; + } + + public void addIdentityListener(ServiceIdentityProvider.Listener listener) { + listeners.add(listener); + } + + public void removeIdentityListener(ServiceIdentityProvider.Listener listener) { + listeners.remove(listener); + } + + public void onCredentialsUpdate(SSLContext sslContext) { + listeners.forEach(l -> l.onCredentialsUpdate(sslContext, identity)); + } + + public void clearListeners() { + listeners.clear(); + } + +} diff --git a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identity/SiaIdentityProvider.java b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identity/SiaIdentityProvider.java index b06ae089b2a..ebff56a6f48 100644 --- a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identity/SiaIdentityProvider.java +++ b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identity/SiaIdentityProvider.java @@ -7,6 +7,7 @@ import com.yahoo.log.LogLevel; import com.yahoo.vespa.athenz.api.AthenzService; import com.yahoo.vespa.athenz.tls.KeyStoreType; import com.yahoo.vespa.athenz.tls.SslContextBuilder; +import com.yahoo.vespa.athenz.utils.AthenzIdentities; import com.yahoo.vespa.athenz.utils.SiaUtils; import javax.net.ssl.SSLContext; @@ -38,6 +39,7 @@ public class SiaIdentityProvider extends AbstractComponent implements ServiceIde private final File certificateFile; private final File trustStoreFile; private final ScheduledExecutorService scheduler; + private final ServiceIdentityProviderListenerHelper listenerHelper; @Inject public SiaIdentityProvider(SiaProviderConfig config) { @@ -69,6 +71,7 @@ public class SiaIdentityProvider extends AbstractComponent implements ServiceIde this.trustStoreFile = trustStoreFile; this.scheduler = scheduler; this.sslContext.set(createIdentitySslContext()); + this.listenerHelper = new ServiceIdentityProviderListenerHelper(service); scheduler.scheduleAtFixedRate(this::reloadSslContext, REFRESH_INTERVAL.toMinutes(), REFRESH_INTERVAL.toMinutes(), TimeUnit.MINUTES); } @@ -90,6 +93,16 @@ public class SiaIdentityProvider extends AbstractComponent implements ServiceIde return sslContext.get(); } + @Override + public void addIdentityListener(Listener listener) { + listenerHelper.addIdentityListener(listener); + } + + @Override + public void removeIdentityListener(Listener listener) { + listenerHelper.removeIdentityListener(listener); + } + private SSLContext createIdentitySslContext() { return new SslContextBuilder() .withTrustStore(trustStoreFile, KeyStoreType.JKS) @@ -102,6 +115,7 @@ public class SiaIdentityProvider extends AbstractComponent implements ServiceIde try { SSLContext sslContext = createIdentitySslContext(); this.sslContext.set(sslContext); + listenerHelper.onCredentialsUpdate(sslContext); } catch (Exception e) { log.log(LogLevel.SEVERE, "Failed to update SSLContext: " + e.getMessage(), e); } @@ -113,6 +127,7 @@ public class SiaIdentityProvider extends AbstractComponent implements ServiceIde try { scheduler.shutdownNow(); scheduler.awaitTermination(90, TimeUnit.SECONDS); + listenerHelper.clearListeners(); } catch (InterruptedException e) { throw new RuntimeException(e); } diff --git a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/client/AthenzIdentityProviderImpl.java b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/client/AthenzIdentityProviderImpl.java index 266e2ebcefd..e40a0933002 100644 --- a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/client/AthenzIdentityProviderImpl.java +++ b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/client/AthenzIdentityProviderImpl.java @@ -18,6 +18,7 @@ import com.yahoo.vespa.athenz.api.ZToken; import com.yahoo.vespa.athenz.client.zts.DefaultZtsClient; import com.yahoo.vespa.athenz.client.zts.ZtsClient; import com.yahoo.vespa.athenz.identity.ServiceIdentityProvider; +import com.yahoo.vespa.athenz.identity.ServiceIdentityProviderListenerHelper; import com.yahoo.vespa.athenz.identity.SiaIdentityProvider; import com.yahoo.vespa.athenz.tls.KeyStoreType; import com.yahoo.vespa.athenz.tls.SslContextBuilder; @@ -62,6 +63,7 @@ public final class AthenzIdentityProviderImpl extends AbstractComponent implemen private final ScheduledExecutorService scheduler; private final Clock clock; private final AthenzService identity; + private final ServiceIdentityProviderListenerHelper listenerHelper; private final String dnsSuffix; private final URI ztsEndpoint; @@ -94,6 +96,7 @@ public final class AthenzIdentityProviderImpl extends AbstractComponent implemen this.scheduler = scheduler; this.clock = clock; this.identity = new AthenzService(config.domain(), config.service()); + this.listenerHelper = new ServiceIdentityProviderListenerHelper(this.identity); this.dnsSuffix = config.athenzDnsSuffix(); this.ztsEndpoint = URI.create(config.ztsUrl()); roleSslContextCache = createCache(ROLE_SSL_CONTEXT_EXPIRY, this::createRoleSslContext); @@ -145,6 +148,16 @@ public final class AthenzIdentityProviderImpl extends AbstractComponent implemen } @Override + public void addIdentityListener(Listener listener) { + listenerHelper.addIdentityListener(listener); + } + + @Override + public void removeIdentityListener(Listener listener) { + listenerHelper.removeIdentityListener(listener); + } + + @Override public SSLContext getRoleSslContext(String domain, String role) { // This ssl context should ideally be cached as it is quite expensive to create. try { @@ -203,6 +216,7 @@ public final class AthenzIdentityProviderImpl extends AbstractComponent implemen try { scheduler.shutdownNow(); scheduler.awaitTermination(AWAIT_TERMINTATION_TIMEOUT.getSeconds(), TimeUnit.SECONDS); + listenerHelper.clearListeners(); } catch (InterruptedException e) { throw new RuntimeException(e); } @@ -230,6 +244,7 @@ public final class AthenzIdentityProviderImpl extends AbstractComponent implemen credentials = isExpired(credentials) ? athenzCredentialsService.registerInstance() : athenzCredentialsService.updateCredentials(credentials.getIdentityDocument(), credentials.getIdentitySslContext()); + listenerHelper.onCredentialsUpdate(credentials.getIdentitySslContext()); } catch (Throwable t) { log.log(LogLevel.WARNING, "Failed to update credentials: " + t.getMessage(), t); } |