1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
|
// Copyright 2019 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.vespa.athenz.identityprovider.client;
import com.google.common.cache.CacheBuilder;
import com.google.common.cache.CacheLoader;
import com.google.common.cache.LoadingCache;
import com.google.inject.Inject;
import com.yahoo.component.AbstractComponent;
import com.yahoo.container.core.identity.IdentityConfig;
import com.yahoo.container.jdisc.athenz.AthenzIdentityProvider;
import com.yahoo.container.jdisc.athenz.AthenzIdentityProviderException;
import com.yahoo.jdisc.Metric;
import com.yahoo.log.LogLevel;
import com.yahoo.vespa.athenz.api.AthenzDomain;
import com.yahoo.vespa.athenz.api.AthenzRole;
import com.yahoo.vespa.athenz.api.AthenzService;
import com.yahoo.vespa.athenz.identity.ServiceIdentityProvider;
import com.yahoo.vespa.athenz.identity.ServiceIdentityProviderListenerHelper;
import com.yahoo.vespa.athenz.tls.KeyStoreType;
import com.yahoo.vespa.athenz.tls.SslContextBuilder;
import com.yahoo.vespa.defaults.Defaults;
import javax.net.ssl.SSLContext;
import java.io.File;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import java.time.Clock;
import java.time.Duration;
import java.time.Instant;
import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.ScheduledThreadPoolExecutor;
import java.util.concurrent.TimeUnit;
import java.util.logging.Logger;
/**
* @author mortent
* @author bjorncs
*/
public final class AthenzIdentityProviderImpl extends AbstractComponent implements AthenzIdentityProvider, ServiceIdentityProvider {
private static final Logger log = Logger.getLogger(AthenzIdentityProviderImpl.class.getName());
// TODO Make some of these values configurable through config. Match requested expiration of register/update requests.
// TODO These should match the requested expiration
static final Duration UPDATE_PERIOD = Duration.ofDays(1);
static final Duration AWAIT_TERMINTATION_TIMEOUT = Duration.ofSeconds(90);
public static final String CERTIFICATE_EXPIRY_METRIC_NAME = "athenz-tenant-cert.expiry.seconds";
private volatile AthenzCredentials credentials;
private final ZtsClient ztsClient = new ZtsClient();
private final Metric metric;
private final AthenzCredentialsService athenzCredentialsService;
private final ScheduledExecutorService scheduler;
private final Clock clock;
private final AthenzService identity;
private final ServiceIdentityProviderListenerHelper listenerHelper;
private final LoadingCache<AthenzRole, SSLContext> roleSslContextCache;
private final static Duration roleSslContextExpiry = Duration.ofHours(24);
// TODO IdentityConfig should contain ZTS uri and dns suffix
@Inject
public AthenzIdentityProviderImpl(IdentityConfig config, Metric metric) {
this(config,
metric,
new AthenzCredentialsService(config,
new IdentityDocumentClient(config.loadBalancerAddress()),
new ZtsClient(),
getDefaultTrustStoreLocation()),
new ScheduledThreadPoolExecutor(1),
Clock.systemUTC());
}
// Test only
AthenzIdentityProviderImpl(IdentityConfig config,
Metric metric,
AthenzCredentialsService athenzCredentialsService,
ScheduledExecutorService scheduler,
Clock clock) {
this.metric = metric;
this.athenzCredentialsService = athenzCredentialsService;
this.scheduler = scheduler;
this.clock = clock;
this.identity = new AthenzService(config.domain(), config.service());
this.listenerHelper = new ServiceIdentityProviderListenerHelper(this.identity);
registerInstance();
roleSslContextCache = CacheBuilder.newBuilder()
.refreshAfterWrite(roleSslContextExpiry.dividedBy(2).toMinutes(), TimeUnit.MINUTES)
.expireAfterWrite(roleSslContextExpiry.toMinutes(), TimeUnit.MINUTES)
.build(new CacheLoader<AthenzRole, SSLContext>() {
@Override
public SSLContext load(AthenzRole key) throws Exception {
return createRoleSslContext(key);
}
});
}
private void registerInstance() {
try {
credentials = athenzCredentialsService.registerInstance();
scheduler.scheduleAtFixedRate(this::refreshCertificate, UPDATE_PERIOD.toMinutes(), UPDATE_PERIOD.toMinutes(), TimeUnit.MINUTES);
scheduler.scheduleAtFixedRate(this::reportMetrics, 0, 5, TimeUnit.MINUTES);
} catch (Throwable t) {
throw new AthenzIdentityProviderException("Could not retrieve Athenz credentials", t);
}
}
@Override
public AthenzService identity() {
return identity;
}
@Override
public String domain() {
return identity.getDomain().getName();
}
@Override
public String service() {
return identity.getName();
}
@Override
public SSLContext getIdentitySslContext() {
return credentials.getIdentitySslContext();
}
@Override
public void addIdentityListener(Listener listener) {
listenerHelper.addIdentityListener(listener);
}
@Override
public void removeIdentityListener(Listener listener) {
listenerHelper.removeIdentityListener(listener);
}
@Override
public SSLContext getRoleSslContext(String domain, String role) {
// This ssl context should ideally be cached as it is quite expensive to create.
try {
return roleSslContextCache.get(new AthenzRole(new AthenzDomain(domain), role));
} catch (Exception e) {
throw new AthenzIdentityProviderException("Could not retrieve role certificate.", e);
}
}
private SSLContext createRoleSslContext(AthenzRole role) {
PrivateKey privateKey = credentials.getKeyPair().getPrivate();
X509Certificate roleCertificate = ztsClient.getRoleCertificate(
role,
credentials.getIdentityDocument().dnsSuffix(),
credentials.getIdentityDocument().ztsEndpoint(),
identity,
privateKey,
credentials.getIdentitySslContext());
return new SslContextBuilder()
.withKeyStore(privateKey, roleCertificate)
.withTrustStore(getDefaultTrustStoreLocation(), KeyStoreType.JKS)
.build();
}
@Override
public String getRoleToken(String domain) {
return ztsClient
.getRoleToken(
new AthenzDomain(domain),
credentials.getIdentityDocument().ztsEndpoint(),
credentials.getIdentitySslContext())
.getRawToken();
}
@Override
public String getRoleToken(String domain, String role) {
return ztsClient
.getRoleToken(
new AthenzDomain(domain),
role,
credentials.getIdentityDocument().ztsEndpoint(),
credentials.getIdentitySslContext())
.getRawToken();
}
@Override
public void deconstruct() {
try {
scheduler.shutdownNow();
scheduler.awaitTermination(AWAIT_TERMINTATION_TIMEOUT.getSeconds(), TimeUnit.SECONDS);
listenerHelper.clearListeners();
} catch (InterruptedException e) {
throw new RuntimeException(e);
}
}
private static File getDefaultTrustStoreLocation() {
return new File(Defaults.getDefaults().underVespaHome("share/ssl/certs/yahoo_certificate_bundle.jks"));
}
private boolean isExpired(AthenzCredentials credentials) {
return clock.instant().isAfter(getExpirationTime(credentials));
}
private static Instant getExpirationTime(AthenzCredentials credentials) {
return credentials.getCertificate().getNotAfter().toInstant();
}
void refreshCertificate() {
try {
credentials = isExpired(credentials)
? athenzCredentialsService.registerInstance()
: athenzCredentialsService.updateCredentials(credentials.getIdentityDocument(), credentials.getIdentitySslContext());
listenerHelper.onCredentialsUpdate(credentials.getIdentitySslContext());
} catch (Throwable t) {
log.log(LogLevel.WARNING, "Failed to update credentials: " + t.getMessage(), t);
}
}
void reportMetrics() {
try {
Instant expirationTime = getExpirationTime(credentials);
Duration remainingLifetime = Duration.between(clock.instant(), expirationTime);
metric.set(CERTIFICATE_EXPIRY_METRIC_NAME, remainingLifetime.getSeconds(), null);
} catch (Throwable t) {
log.log(LogLevel.WARNING, "Failed to update metrics: " + t.getMessage(), t);
}
}
}
|
