enhancement: proxy request with bearer token in header without client…

… certificate

pkg/yurthub/proxy/remote/remote.go

@@ -23,6 +23,7 @@ import (
 	"net/http"
 	"net/http/httputil"
 	"net/url"
+	"strings"
 
 	"github.com/openyurtio/openyurt/pkg/yurthub/cachemanager"
 	"github.com/openyurtio/openyurt/pkg/yurthub/filter"
@@ -37,12 +38,14 @@ import (
 
 // RemoteProxy is an reverse proxy for remote server
 type RemoteProxy struct {
-	checker      healthchecker.HealthChecker
-	reverseProxy *httputil.ReverseProxy
-	cacheMgr     cachemanager.CacheManager
-	remoteServer *url.URL
-	filterChain  filter.Interface
-	stopCh       <-chan struct{}
+	checker          healthchecker.HealthChecker
+	reverseProxy     *httputil.ReverseProxy
+	cacheMgr         cachemanager.CacheManager
+	remoteServer     *url.URL
+	filterChain      filter.Interface
+	currentTransport http.RoundTripper
+	bearerTransport  http.RoundTripper
+	stopCh           <-chan struct{}
 }
 
 // NewRemoteProxy creates an *RemoteProxy object, and will be used by LoadBalancer
@@ -56,14 +59,20 @@ func NewRemoteProxy(remoteServer *url.URL,
 	if currentTransport == nil {
 		return nil, fmt.Errorf("could not get current transport when init proxy backend(%s)", remoteServer.String())
 	}
+	bearerTransport := transportMgr.BearerTransport()
+	if bearerTransport == nil {
+		return nil, fmt.Errorf("could not get bearer transport when init proxy backend(%s)", remoteServer.String())
+	}
 
 	proxyBackend := &RemoteProxy{
-		checker:      healthChecker,
-		reverseProxy: httputil.NewSingleHostReverseProxy(remoteServer),
-		cacheMgr:     cacheMgr,
-		remoteServer: remoteServer,
-		filterChain:  filterChain,
-		stopCh:       stopCh,
+		checker:          healthChecker,
+		reverseProxy:     httputil.NewSingleHostReverseProxy(remoteServer),
+		cacheMgr:         cacheMgr,
+		remoteServer:     remoteServer,
+		filterChain:      filterChain,
+		currentTransport: currentTransport,
+		bearerTransport:  bearerTransport,
+		stopCh:           stopCh,
 	}
 
 	proxyBackend.reverseProxy.Transport = currentTransport
@@ -80,6 +89,15 @@ func (rp *RemoteProxy) Name() string {
 }
 
 func (rp *RemoteProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	rp.reverseProxy.Transport = rp.currentTransport
+	auth := strings.TrimSpace(req.Header.Get("Authorization"))
+	if auth != "" {
+		parts := strings.Split(auth, " ")
+		if len(parts) == 2 && strings.ToLower(parts[0]) == "bearer" {
+			klog.V(5).Infof("request: %s with bearer token: %s", util.ReqString(req), parts[1])
+			rp.reverseProxy.Transport = rp.bearerTransport
+		}
+	}
 	rp.reverseProxy.ServeHTTP(rw, req)
 }
 

pkg/yurthub/transport/transport.go

@@ -35,13 +35,16 @@ import (
 type Interface interface {
 	// concurrent use by multiple goroutines
 	// CurrentTransport get transport that used by load balancer
-	CurrentTransport() *http.Transport
+	CurrentTransport() http.RoundTripper
+	// BearerTransport returns transport for proxying request with bearer token in header
+	BearerTransport() http.RoundTripper
 	// close all net connections that specified by address
 	Close(address string)
 }
 
 type transportManager struct {
 	currentTransport *http.Transport
+	bearerTransport  *http.Transport
 	certManager      interfaces.YurtCertificateManager
 	closeAll         func()
 	close            func(string)
@@ -71,8 +74,23 @@ func NewTransportManager(certMgr interfaces.YurtCertificateManager, stopCh <-cha
 		DialContext:         d.DialContext,
 	})
 
+	bearerTLSCfg, err := tlsConfig(nil, caFile)
+	if err != nil {
+		klog.Errorf("could not get tls config when new bearer transport, %v", err)
+		return nil, err
+	}
+
+	bt := utilnet.SetTransportDefaults(&http.Transport{
+		Proxy:               http.ProxyFromEnvironment,
+		TLSHandshakeTimeout: 10 * time.Second,
+		TLSClientConfig:     bearerTLSCfg,
+		MaxIdleConnsPerHost: 25,
+		DialContext:         d.DialContext,
+	})
+
 	tm := &transportManager{
 		currentTransport: t,
+		bearerTransport:  bt,
 		certManager:      certMgr,
 		closeAll:         d.CloseAll,
 		close:            d.Close,
@@ -83,10 +101,14 @@ func NewTransportManager(certMgr interfaces.YurtCertificateManager, stopCh <-cha
 	return tm, nil
 }
 
-func (tm *transportManager) CurrentTransport() *http.Transport {
+func (tm *transportManager) CurrentTransport() http.RoundTripper {
 	return tm.currentTransport
 }
 
+func (tm *transportManager) BearerTransport() http.RoundTripper {
+	return tm.bearerTransport
+}
+
 func (tm *transportManager) Close(address string) {
 	tm.close(address)
 }
@@ -134,12 +156,14 @@ func tlsConfig(certMgr interfaces.YurtCertificateManager, caFile string) (*tls.C
 		RootCAs:    root,
 	}
 
-	tlsConfig.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
-		cert := certMgr.Current()
-		if cert == nil {
-			return &tls.Certificate{Certificate: nil}, nil
+	if certMgr != nil {
+		tlsConfig.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
+			cert := certMgr.Current()
+			if cert == nil {
+				return &tls.Certificate{Certificate: nil}, nil
+			}
+			return cert, nil
 		}
-		return cert, nil
 	}
 
 	return tlsConfig, nil