Proxy autoconfig #1099

paulbellamy · 2015-07-07T14:26:27Z

Use the docker daemon's -H flags as the proxy's default.

No support for auto-configuring TLS. For that we would have to do the procfs and flag parsing in the weave script (so that we could mount the certs into the proxy container).

This is possibly a bit linux-specific, as the layout of procfs is not standardized.

Fixes #1055

paulbellamy · 2015-07-08T15:12:27Z

per f2f discussion w/ @rade:

let's add TLS support via a binary where the weave script can do:

if [ -x $SOME_BINARY ]; then
  PROXY_VOLUMES=$($SOME_BINARY)
fi

This way, --local will work, but not support TLS autoconfiguration.

rade · 2015-07-08T15:20:45Z

command_exists $SOME_BINARY && $($SOME_BINARY) || true

weave

+    if command_exists proxyvolumes ; then
+        PROXY_VOLUMES=${PROXY_VOLUMES:-$(proxyvolumes "$@")}
+    fi
+}


test/675_proxy_autoconfig_test.sh

+    --tlscacert $PWD/tls/ca.pem \
+    --tlscert   $PWD/tls/$HOST1.pem \
+    --tlskey    $PWD/tls/$HOST1-key.pem \
+    2>&1 >/dev/null


paulbellamy · 2015-07-14T16:33:39Z

doesn't work with systemd as docker launches with: -H fd://

paulbellamy · 2015-07-15T10:32:08Z

per f2f discussion w/ @rade:

Configuring based on the daemon is a bit of a hack, so let's configure where to listen based on the client.
The three cases are:

They connect via unix socket. We should listen on unix:///var/run/weave.sock
They connect via plain TCP. We should listen on tcp://0.0.0.0:12375
They connect via TLS. We should throw an error telling them to configure the proxy manually.

site/proxy.md


    host1$ weave launch-proxy -H tcp://127.0.0.1:9999

-Multiple -H arguments can be specified. If you are working with a remote
-docker daemon, then any firewalls inbetween need to be configured to permit
+If you are connecting via TLS, you will need to specify `-H`. Multiple


prog/weaveproxy/main.go

+	}
+
+	if clientTLSEnabled && !(c.TLSConfig.Enabled || c.TLSConfig.Verify) {
+		log.Fatalln("Cannot autoconfigure the proxy when using TLS. Please specify -H")


prog/weaveproxy/main.go

+	}
+
+	if clientTLSEnabled && !(c.TLSConfig.Enabled || c.TLSConfig.Verify) {
+		log.Fatalln("Cannot autoconfigure proxy listen address when launching via TLS")


weave

+
+    if [ -z "$PROXY_HOST" ]; then
+      if [ -n "$CLIENT_TLS_ENABLED" -a -z "$PROXY_TLS_ENABLED" ]; then
+        echo "When launching proxy via TLS, -H and/or TLS options are required." >&2


rade · 2015-07-16T11:31:13Z

rest LGTM

Proxy autoconfig

paulbellamy assigned rade Jul 7, 2015

rade removed their assignment Jul 7, 2015

rade assigned paulbellamy Jul 10, 2015

paulbellamy force-pushed the 1055-proxy-autoconfig branch 2 times, most recently from 968bc87 to d72c05c Compare July 13, 2015 13:21

rade reviewed Jul 14, 2015
View reviewed changes

weave

if command_exists proxyvolumes ; then

PROXY_VOLUMES=${PROXY_VOLUMES:-$(proxyvolumes "$@")}

fi

}

This comment was marked as abuse.

Sign in to view

This comment was marked as abuse.

Sign in to view

paulbellamy force-pushed the 1055-proxy-autoconfig branch from 77ad2a6 to 25fd8a2 Compare July 14, 2015 14:54

rade reviewed Jul 14, 2015
View reviewed changes

paulbellamy force-pushed the 1055-proxy-autoconfig branch from 25fd8a2 to e365c1d Compare July 14, 2015 16:07

paulbellamy force-pushed the 1055-proxy-autoconfig branch 2 times, most recently from 70aa01d to f9e8bef Compare July 15, 2015 15:23

paulbellamy assigned rade and unassigned paulbellamy Jul 15, 2015

rade reviewed Jul 15, 2015
View reviewed changes

paulbellamy force-pushed the 1055-proxy-autoconfig branch from f9e8bef to 826889e Compare July 15, 2015 16:31

rade assigned paulbellamy and unassigned rade Jul 15, 2015

rade reviewed Jul 15, 2015
View reviewed changes

prog/weaveproxy/main.go

}

if clientTLSEnabled && !(c.TLSConfig.Enabled || c.TLSConfig.Verify) {

log.Fatalln("Cannot autoconfigure the proxy when using TLS. Please specify -H")

This comment was marked as abuse.

Sign in to view

paulbellamy force-pushed the 1055-proxy-autoconfig branch from 826889e to 6583806 Compare July 15, 2015 16:37

rade reviewed Jul 15, 2015
View reviewed changes

prog/weaveproxy/main.go

}

if clientTLSEnabled && !(c.TLSConfig.Enabled || c.TLSConfig.Verify) {

log.Fatalln("Cannot autoconfigure proxy listen address when launching via TLS")

This comment was marked as abuse.

Sign in to view

paulbellamy force-pushed the 1055-proxy-autoconfig branch from 6583806 to f3c0b82 Compare July 16, 2015 10:29

paulbellamy assigned rade and unassigned paulbellamy Jul 16, 2015

rade reviewed Jul 16, 2015
View reviewed changes

weave

if [ -z "$PROXY_HOST" ]; then

if [ -n "$CLIENT_TLS_ENABLED" -a -z "$PROXY_TLS_ENABLED" ]; then

echo "When launching proxy via TLS, -H and/or TLS options are required." >&2

This comment was marked as abuse.

Sign in to view

This comment was marked as abuse.

Sign in to view

rade assigned paulbellamy and unassigned rade Jul 16, 2015

[proxy] Choose where to listen based on how launching client connected

a4a31e6

paulbellamy force-pushed the 1055-proxy-autoconfig branch from f3c0b82 to a4a31e6 Compare July 16, 2015 11:49

paulbellamy added a commit that referenced this pull request Jul 16, 2015

Merge pull request #1099 from weaveworks/1055-proxy-autoconfig

0865f4c

Proxy autoconfig

paulbellamy merged commit 0865f4c into master Jul 16, 2015

paulbellamy deleted the 1055-proxy-autoconfig branch July 16, 2015 12:33

rade modified the milestone: 1.1.0 Jul 21, 2015

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Proxy autoconfig #1099

Proxy autoconfig #1099

paulbellamy commented Jul 7, 2015

paulbellamy commented Jul 8, 2015

rade commented Jul 8, 2015

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

paulbellamy commented Jul 14, 2015

paulbellamy commented Jul 15, 2015

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

rade commented Jul 16, 2015

Proxy autoconfig #1099

Proxy autoconfig #1099

Conversation

paulbellamy commented Jul 7, 2015

paulbellamy commented Jul 8, 2015

rade commented Jul 8, 2015

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

paulbellamy commented Jul 14, 2015

paulbellamy commented Jul 15, 2015

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

This comment was marked as abuse.

rade commented Jul 16, 2015