Merge pull request #58 from thedebugger/add_tls_support

Add tls support

CHANGELOG.md

@@ -1,3 +1,6 @@
+# 0.5.0
+* Add support for TLS, and gossip encryption
+
 # 0.4.4
 * Adds server list to a consul instance running as a cluster with a `bootstrap_expect` value greater than one.
 

README.md

@@ -170,7 +170,126 @@ Installs and configures [Consul][1].
  </td>
  <td><tt>{}</tt></td>
  </tr>
+ <tr>
+ <td><tt>['consul']['encrypt_enabled']</tt></td>
+ <td>Boolean</td>
+ <td>
+  To enable Consul gossip encryption
+ </td>
+ <td><tt>false</tt></td>
+ </tr>
+ <tr>
+ <td><tt>['consul']['verify_incoming']</tt></td>
+ <td>Boolean</td>
+ <td>
+  If set to True, Consul requires that all incoming connections make use of TLS.
+ </td>
+ <td><tt>false</tt></td>
+ </tr>
+ <tr>
+ <td><tt>['consul']['verify_outgoing']</tt></td>
+ <td>Boolean</td>
+ <td>
+  If set to True, Consul requires that all outgoing connections make use of TLS.
+ </td>
+ <td><tt>false</tt></td>
+ </tr>
+ <tr>
+ <td><tt>['consul']['key_file']</tt></td>
+ <td>String</td>
+ <td>
+  The content of PEM encoded private key
+ </td>
+ <td><tt>nil</tt></td>
+ </tr>
+ <tr>
+ <td><tt>['consul']['key_file_path']</tt></td>
+ <td>String</td>
+ <td>
+  Path where the private key is stored on the disk
+ </td>
+ <td><tt>/etc/consul.d/key.pem</tt></td>
+ </tr>
+ <tr>
+ <td><tt>['consul']['ca_file']</tt></td>
+ <td>String</td>
+  The content of PEM encoded ca cert
+ <td>
+ </td>
+ <td><tt>nil</tt></td>
+ </tr>
+ <tr>
+ <td><tt>['consul']['ca_file_path']</tt></td>
+ <td>String</td>
+ <td>
+  Path where ca is stored on the disk
+ </td>
+ <td><tt>/etc/consul.d/ca.pem</tt></td>
+ </tr>
+ <tr>
+ <td><tt>['consul']['cert_file']</tt></td>
+ <td>String</td>
+ <td>
+  The content of PEM encoded cert. It should only contain the public key.
+ </td>
+ <td><tt>nil</tt></td>
+ </tr>
+ <tr>
+ <td><tt>['consul']['cert_file_path']</tt></td>
+ <td>String</td>
+ <td>
+  Path where cert is stored on the disk
+ </td>
+ <td><tt>/etc/consul.d/cert.pem</tt></td>
+ </tr>
+</table>
 
+### Databag Attributes (optional)
+Following attributes, if exist in the [encrypted databag][7], override the node attributes
+
+<table>
+ <tr>
+ <th>Key</th>
+ <th>Databag item</th>
+ <th>Type</th>
+ <th>Description</th>
+ </tr>
+ <tr>
+ <td><tt>key_file</tt></td>
+ <td>['consul']['encrypt']</td>
+ <td>String</td>
+ <td>The content of PEM encoded private key</td>
+ </tr>
+ <tr>
+ <td><tt>key_file_{fqdn}</tt></td>
+ <td>['consul']['encrypt']</td>
+ <td>String</td>
+ <td>Node's(identified by fqdn) unique PEM encoded private key. If it exists, it will override the databag and node key_file attribute</td>
+ </tr>
+ <tr>
+ <td><tt>ca_file</tt></td>
+ <td>['consul']['encrypt']</td>
+ <td>String</td>
+ <td>The content of PEM encoded ca cert</td>
+ </tr>
+ <tr>
+ <td><tt>encrypt</tt></td>
+ <td>['consul']['encrypt']</td>
+ <td>String</td>
+ <td>Consul Gossip encryption key</td>
+ </tr>
+ <tr>
+ <td><tt>cert_file</tt></td>
+ <td>['consul']['encrypt']</td>
+ <td>String</td>
+ <td>The content of PEM encoded cert</td>
+ </tr>
+ <tr>
+ <td><tt>cert_file_{fqdn}</tt></td>
+ <td>['consul']['encrypt']</td>
+ <td>String</td>
+ <td>Node's(identified by fqdn) unique PEM encoded cert. If it exists, it will override the databag and node cert_file attribute</td>
+ </tr>
 </table>
 
 ### Consul UI Attributes
@@ -320,3 +439,5 @@ Created and maintained by [John Bellone][3] [@johnbellone][2] (<jbellone@bloombe
 [4]: https://github.com/johnbellone/consul-cookbook/graphs/contributors
 [5]: http://travis-ci.org/johnbellone/consul-cookbook
 [6]: https://coveralls.io/r/johnbellone/consul-cookbook
+[7]: https://docs.getchef.com/essentials_data_bags.html
+

attributes/default.rb

@@ -45,6 +45,8 @@
 
 # Service attributes
 default['consul']['service_mode'] = 'bootstrap'
+# In the cluster mode, set the default cluster size to 3
+default['consul']['bootstrap_expect'] = 3
 default['consul']['data_dir'] = '/var/lib/consul'
 default['consul']['config_dir'] = '/etc/consul.d'
 case node['platform_family']
@@ -69,6 +71,21 @@
  "server" => 8300,
 }
 
+# Gossip encryption
+default['consul']['encrypt_enabled'] = false
+default['consul']['encrypt'] = nil
+# TLS support
+default['consul']['verify_incoming'] = false
+default['consul']['verify_outgoing'] = false
+# Cert in pem format
+default['consul']['ca_cert'] = nil
+default['consul']['ca_path'] = "%{config_dir}/ca.pem"
+default['consul']['cert_file'] = nil
+default['consul']['cert_path'] = "%{config_dir}/cert.pem"
+# Cert in pem format. It can be unique for each host
+default['consul']['key_file'] = nil
+default['consul']['key_file_path'] = "%{config_dir}/key.pem"
+
 # Optionally bind to a specific interface
 default['consul']['bind_interface'] = nil
 default['consul']['advertise_interface'] = nil

libraries/encrypt.rb

@@ -0,0 +1,21 @@
+class Chef
+ class Recipe
+ # Don't throw the error if it doesn't exist
+ def consul_encrypted_dbi
+ begin
+ # loads the secret from /etc/chef/encrypted_data_bag_secret
+ Chef::EncryptedDataBagItem.load('consul', 'encrypt')
+ rescue Net::HTTPServerException => e
+ raise e unless e.response.code == '404'
+ end
+ end
+
+ def consul_dbi_key_with_node_default(dbi, key)
+ value = dbi[key]
+ Chef::Log.warn "Consul encrypt key=#{key} doesn't exist in the databag. \
+Reading it from node's attributes" if value.nil?
+ value ||= node['consul'][key]
+ value
+ end
+ end
+end

recipes/_service.rb

@@ -111,7 +111,7 @@
 end
 
 copy_params = [
- :bind_addr, :datacenter, :domain, :log_level, :node_name, :advertise_addr, :ports, :enable_syslog, :encrypt
+ :bind_addr, :datacenter, :domain, :log_level, :node_name, :advertise_addr, :ports, :enable_syslog
 ]
 copy_params.each do |key|
  if node['consul'][key]
@@ -123,6 +123,53 @@
  end
 end
 
+dbi = nil
+# Gossip encryption
+if node.consul.encrypt_enabled
+ # Fetch the databag only once, and use empty hash if it doesn't exists
+ dbi = consul_encrypted_dbi || {}
+ secret = consul_dbi_key_with_node_default(dbi, 'encrypt')
+ raise "Consul encrypt key is empty or nil" if secret.nil? or secret.empty?
+ service_config['encrypt'] = secret
+else
+ # for backward compatibilty
+ service_config['encrypt'] = node.consul.encrypt unless node.consul.encrypt.nil?
+end
+
+# TLS encryption
+if node.consul.verify_incoming || node.consul.verify_outgoing
+ dbi = consul_encrypted_dbi || {} if dbi.nil?
+ service_config['verify_outgoing'] = node.consul.verify_outgoing
+ service_config['verify_incoming'] = node.consul.verify_incoming
+
+ ca_path = node.consul.ca_path % { config_dir: node.consul.config_dir }
+ service_config['ca_file'] = ca_path
+
+ cert_path = node.consul.cert_path % { config_dir: node.consul.config_dir }
+ service_config['cert_file'] = cert_path
+
+ key_path = node.consul.key_file_path % { config_dir: node.consul.config_dir }
+ service_config['key_file'] = key_path
+
+ # Search for key_file_hostname since key and cert file can be unique/host
+ key_content = dbi['key_file_' + node.fqdn] || consul_dbi_key_with_node_default(dbi, 'key_file')
+ cert_content = dbi['cert_file_' + node.fqdn] || consul_dbi_key_with_node_default(dbi, 'cert_file')
+ ca_content = consul_dbi_key_with_node_default(dbi, 'ca_cert')
+
+ # Save the certs if exists
+ {ca_path => ca_content, key_path => key_content, cert_path => cert_content}.each do |path, content|
+ unless content.nil? or content.empty?
+ file path do
+ user consul_user
+ group consul_group
+ mode 0600
+ action :create
+ content content
+ end
+ end
+ end
+end
+
 consul_config_filename = File.join(node['consul']['config_dir'], 'default.json')
 
 file consul_config_filename do