Skip to content

Commit

Permalink
Add template for ssl config reference settings (#20357) (#20678)
Browse files Browse the repository at this point in the history 
* Add template for ssl config reference settings

Use a shared template for the ssl options in reference configs. The reduces
duplication of the SSL settings in config templates and ensures that the
reference configs are consistent across outputs and monitoring.

I provided an `indent` function in case this config template needed to be reused
at various indentation levels, but it turns out that all of the uses so far required
an indentation of 2 (so I could have just indented ssl.reference.yml.tmpl manually).

* Indent any non-whitespace containing lines

(cherry picked from commit 9e4d4f2)
  • Loading branch information
@andrewkroh
andrewkroh authored Aug 24, 2020
1 parent 16e2d64 commit 96b5843
Show file tree
Hide file tree
Showing 21 changed files with 668 additions and 563 deletions.
75 changes: 48 additions & 27 deletions auditbeat/auditbeat.reference.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -605,11 +605,11 @@ output.elasticsearch:
# Resolve names locally when using a proxy server. Defaults to false.
#proxy_use_local_resolver: false

# Enable SSL support. SSL is automatically enabled if any SSL setting is set.
# Use SSL settings for HTTPS.
#ssl.enabled: true

# Configure SSL verification mode. If `none` is configured, all server hosts
# and certificates will be accepted. In this mode, SSL based connections are
# and certificates will be accepted. In this mode, SSL-based connections are
# susceptible to man-in-the-middle attacks. Use only for testing. Default is
# `full`.
#ssl.verification_mode: full
Expand All @@ -618,7 +618,6 @@ output.elasticsearch:
# up to 1.3 are enabled.
#ssl.supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]

# Optional SSL configuration options. SSL is off by default.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

Expand All @@ -628,7 +627,7 @@ output.elasticsearch:
# Client certificate key
#ssl.key: "/etc/pki/client/cert.key"

# Optional passphrase for decrypting the Certificate Key.
# Optional passphrase for decrypting the certificate key.
#ssl.key_passphrase: ''

# Configure cipher suites to be used for SSL connections
Expand Down Expand Up @@ -791,15 +790,11 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enable SSL support. SSL is automatically enabled if any SSL setting is set.
# Use SSL settings for HTTPS.
#ssl.enabled: true

# Optional SSL configuration options. SSL is off by default.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

# Configure SSL verification mode. If `none` is configured, all server hosts
# and certificates will be accepted. In this mode, SSL based connections are
# and certificates will be accepted. In this mode, SSL-based connections are
# susceptible to man-in-the-middle attacks. Use only for testing. Default is
# `full`.
#ssl.verification_mode: full
Expand All @@ -808,13 +803,16 @@ output.elasticsearch:
# up to 1.3 are enabled.
#ssl.supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]

# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key
# Client certificate key
#ssl.key: "/etc/pki/client/cert.key"

# Optional passphrase for decrypting the Certificate Key.
# Optional passphrase for decrypting the certificate key.
#ssl.key_passphrase: ''

# Configure cipher suites to be used for SSL connections
Expand All @@ -827,6 +825,12 @@ output.elasticsearch:
# never, once, and freely. Default is never.
#ssl.renegotiation: never

# Configure a pin that can be used to do extra validation of the verified certificate chain,
# this allow you to ensure that a specific certificate is used to validate the chain of trust.
#
# The pin is a base64 encoded string of the SHA-256 fingerprint.
#ssl.ca_sha256: ""

# Enable Kerberos support. Kerberos is automatically enabled if any Kerberos setting is set.
#kerberos.enabled: true

Expand Down Expand Up @@ -934,11 +938,11 @@ output.elasticsearch:
# occurs on the proxy server.
#proxy_use_local_resolver: false

# Enable SSL support. SSL is automatically enabled, if any SSL setting is set.
# Use SSL settings for HTTPS.
#ssl.enabled: true

# Configure SSL verification mode. If `none` is configured, all server hosts
# and certificates will be accepted. In this mode, SSL based connections are
# and certificates will be accepted. In this mode, SSL-based connections are
# susceptible to man-in-the-middle attacks. Use only for testing. Default is
# `full`.
#ssl.verification_mode: full
Expand All @@ -947,29 +951,35 @@ output.elasticsearch:
# up to 1.3 are enabled.
#ssl.supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]

# Optional SSL configuration options. SSL is off by default.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key
# Client certificate key
#ssl.key: "/etc/pki/client/cert.key"

# Optional passphrase for decrypting the Certificate Key.
# Optional passphrase for decrypting the certificate key.
#ssl.key_passphrase: ''

# Configure cipher suites to be used for SSL connections
#ssl.cipher_suites: []

# Configure curve types for ECDHE based cipher suites
# Configure curve types for ECDHE-based cipher suites
#ssl.curve_types: []

# Configure what types of renegotiation are supported. Valid options are
# never, once, and freely. Default is never.
#ssl.renegotiation: never

# Configure a pin that can be used to do extra validation of the verified certificate chain,
# this allow you to ensure that a specific certificate is used to validate the chain of trust.
#
# The pin is a base64 encoded string of the SHA-256 fingerprint.
#ssl.ca_sha256: ""


# -------------------------------- File Output ---------------------------------
#output.file:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -1205,15 +1215,11 @@ setup.kibana:
# Optional Kibana space ID.
#space.id: ""

# Custom HTTP headers to add to each request
#headers:
# X-My-Header: Contents of the header

# Use SSL settings for HTTPS. Default is true.
# Use SSL settings for HTTPS.
#ssl.enabled: true

# Configure SSL verification mode. If `none` is configured, all server hosts
# and certificates will be accepted. In this mode, SSL based connections are
# and certificates will be accepted. In this mode, SSL-based connections are
# susceptible to man-in-the-middle attacks. Use only for testing. Default is
# `full`.
#ssl.verification_mode: full
Expand All @@ -1222,7 +1228,6 @@ setup.kibana:
# up to 1.3 are enabled.
#ssl.supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]

# SSL configuration. The default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

Expand All @@ -1241,6 +1246,17 @@ setup.kibana:
# Configure curve types for ECDHE-based cipher suites
#ssl.curve_types: []

# Configure what types of renegotiation are supported. Valid options are
# never, once, and freely. Default is never.
#ssl.renegotiation: never

# Configure a pin that can be used to do extra validation of the verified certificate chain,
# this allow you to ensure that a specific certificate is used to validate the chain of trust.
#
# The pin is a base64 encoded string of the SHA-256 fingerprint.
#ssl.ca_sha256: ""


# ================================== Logging ===================================

# There are four options for the log output: file, stderr, syslog, eventlog
Expand Down Expand Up @@ -1392,7 +1408,7 @@ logging.files:
#ssl.enabled: true

# Configure SSL verification mode. If `none` is configured, all server hosts
# and certificates will be accepted. In this mode, SSL based connections are
# and certificates will be accepted. In this mode, SSL-based connections are
# susceptible to man-in-the-middle attacks. Use only for testing. Default is
# `full`.
#ssl.verification_mode: full
Expand All @@ -1401,7 +1417,6 @@ logging.files:
# up to 1.3 are enabled.
#ssl.supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]

# SSL configuration. The default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

Expand All @@ -1424,6 +1439,12 @@ logging.files:
# never, once, and freely. Default is never.
#ssl.renegotiation: never

# Configure a pin that can be used to do extra validation of the verified certificate chain,
# this allow you to ensure that a specific certificate is used to validate the chain of trust.
#
# The pin is a base64 encoded string of the SHA-256 fingerprint.
#ssl.ca_sha256: ""

# Enable Kerberos support. Kerberos is automatically enabled if any Kerberos setting is set.
#kerberos.enabled: true

Expand Down
24 changes: 23 additions & 1 deletion dev-tools/mage/config.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,12 @@
package mage

import (
"bytes"
"fmt"
"io/ioutil"
"os"
"path/filepath"
"regexp"
"sort"
"strings"
"text/template"
Expand Down Expand Up @@ -160,14 +162,26 @@ func makeConfigTemplate(destination string, mode os.FileMode, confParams ConfigF
"ExcludeDashboards": false,
}
params = joinMaps(params, confParams.ExtraVars, tmplParams)
tmpl := template.New("config").Option("missingkey=error")
funcs := joinMaps(FuncMap, template.FuncMap{
"header": header,
"subheader": subheader,
"indent": indent,
// include is necessary because you cannot pipe 'template' to a function
// since 'template' is an action. This allows you to include a
// template and indent it (e.g. {{ include "x.tmpl" . | indent 4 }}).
"include": func(name string, data interface{}) (string, error) {
buf := bytes.NewBuffer(nil)
if err := tmpl.ExecuteTemplate(buf, name, data); err != nil {
return "", err
}
return buf.String(), nil
},
})
tmpl = tmpl.Funcs(funcs)

fmt.Printf(">> Building %v for %v/%v\n", destination, params["GOOS"], params["GOARCH"])
var err error
tmpl := template.New("config").Option("missingkey=error").Funcs(funcs)
for _, templateGlob := range confParams.Templates {
if tmpl, err = tmpl.ParseGlob(templateGlob); err != nil {
return errors.Wrapf(err, "failed to parse config templates in %q", templateGlob)
Expand Down Expand Up @@ -205,6 +219,14 @@ func subheader(title string) string {
return makeHeading(title, "-")
}

var nonWhitespaceRegex = regexp.MustCompile(`(?m)(^.*\S.*$)`)

// indent pads all non-whitespace lines with the number of spaces specified.
func indent(spaces int, content string) string {
pad := strings.Repeat(" ", spaces)
return nonWhitespaceRegex.ReplaceAllString(content, pad+"$1")
}

func makeHeading(title, separator string) string {
const line = 80
leftEquals := (line - len("# ") - len(title) - 2*len(" ")) / 2
Expand Down
Loading

0 comments on commit 96b5843

Please sign in to comment.