Fabio can connect to Consul using TLS for secure communication. #391

jrasell · 2017-11-20T12:57:54Z

This change updates Fabio's configuration parameters to allow use and specification of TLS certificates for HTTPS. In Consul setups where full TLS is configured using CA private this allows Fabio to work in a secure manner.

I have tested this change locally with a Consul TLS setup; log fragments are shown below to provide further detail:

./fabio -registry.consul.caFile=/Users/rasellj/opt/hashicorp/ca/rasellj-ca.pem -registry.consul.enableSSL -registry.consul.keyFile=/Users/rasellj/opt/hashicorp/consul/consul-server-key.pem -registry.consul.certFile=/Users/rasellj/opt/hashicorp/consul/consul-server.pem -registry.consul.verifySSL

"EnableSSL": true,
"VerifySSL": true,
"CAFile": "/Users/rasellj/opt/hashicorp/ca/rasellj-ca.pem",
"CertFile": "/Users/rasellj/opt/hashicorp/consul/consul-server.pem",
"KeyFile": "/Users/rasellj/opt/hashicorp/consul/consul-server-key.pem"

2017/11/20 09:44:50 [INFO] Version v1.5.3-10-g5b2fe34 starting
2017/11/20 09:44:50 [INFO] Go runtime is go1.9
2017/11/20 09:44:50 [INFO] Metrics disabled
2017/11/20 09:44:50 [INFO] Setting GOGC=800
2017/11/20 09:44:50 [INFO] Setting GOMAXPROCS=8
2017/11/20 09:44:50 [INFO] consul: Connecting to "localhost:8500" in datacenter "dc1"
2017/11/20 09:44:50 [INFO] Admin server access mode "rw"
2017/11/20 09:44:50 [INFO] Admin server listening on ":9998"
2017/11/20 09:44:50 [INFO] Waiting for first routing table
2017/11/20 09:44:50 [INFO] consul: Using dynamic routes
2017/11/20 09:44:50 [INFO] consul: Using tag prefix "urlprefix-"
2017/11/20 09:44:50 [INFO] consul: Watching KV path "/fabio/config"
2017/11/20 09:44:53 [INFO] consul: Registered fabio with id "REDACTED-9998"
2017/11/20 09:44:53 [INFO] consul: Registered fabio with address "10.210.90.45"
2017/11/20 09:44:53 [INFO] consul: Registered fabio with tags ""
2017/11/20 09:44:53 [INFO] consul: Registered fabio with health check to "http://[10.210.90.45]:9998/health"
2017/11/20 09:44:54 [INFO] consul: Manual config changed to #1
2017/11/20 09:44:54 [INFO] HTTP proxy listening on :9999
2017/11/20 09:44:54 [INFO] Access logging disabled
2017/11/20 09:44:54 [INFO] Using routing strategy "rnd"
2017/11/20 09:44:54 [INFO] Using route matching "prefix"
2017/11/20 09:44:54 [INFO] consul: Health changed to #6

Feedback would be appreciated, and any changes requested will be acted upon promptly.

Closes #276

This change updates Fabio's configuration parameters to allow use and specification of TLS certificates for HTTPS. In Consul setups where full TLS is configured using CA private this allows Fabio to work in a secure manner. Closes fabiolb#276

CLAassistant · 2017-11-20T12:58:00Z

All committers have signed the CLA.

jrasell · 2017-11-20T13:07:33Z

The test failures seem to be sporadic and I do not believe they are related to my changes.

jrasell · 2017-12-04T08:29:48Z

@magiconair would it be possible to get some feedback on this PR?

magiconair · 2017-12-04T09:07:06Z

Yes. I’ll have a look later today. Sorry for the delay

magiconair · 2017-12-04T09:10:49Z

Why do you need a key? This is for making TLS connections to consul, correct? Can’t you just add the ca file to the trusted root CAs in /etc/ssl?

magiconair · 2017-12-04T09:11:38Z

And use an https URL for consul obviously

jrasell · 2017-12-05T14:26:36Z

@magiconair yes that is an option and is what I currently do in my setups. I was merely adding this feature as detailed in the ticket #276

magiconair · 2017-12-05T14:48:21Z

Ah, the cert and key are used for client cert authentication. The example uses the Consul server cert and that doesn't seem correct.

I can see several use cases:

Use HTTPS:
add registry.consul.scheme=https option
Use custom CA:
add registry.consul.tls.ca_path=/path/to/certs
disable cert validation
add registry.consul.tls.skip_verify = {true,false} to be (somewhat) consistent with the other options
enable client cert authentication
add registry.consul.tls.client_cert=/path/to/cert.pem and registry.consul.tls.client_key=/path/to/key.pem The key should be optional if both cert and key are in the same file. In this case both should point to the same file.

This change updates Fabio's configuration parameters to allow use and specification of TLS certificates for HTTPS. In Consul setups where full TLS is configured using CA private this allows Fabio to work in a secure manner. Closes fabiolb#276

Rebase consul tls

Fixes fabiolb#276, fabiolb#501 (fixes fabiolb#391)

sev3ryn · 2018-08-02T16:49:45Z

config/load.go

@@ -168,6 +168,11 @@ func load(cmdline, environ, envprefix []string, props *properties.Properties) (c
 	f.StringVar(&cfg.Registry.Consul.KVPath, "registry.consul.kvpath", defaultConfig.Registry.Consul.KVPath, "consul KV path for manual overrides")
 	f.StringVar(&cfg.Registry.Consul.NoRouteHTMLPath, "registry.consul.noroutehtmlpath", defaultConfig.Registry.Consul.NoRouteHTMLPath, "consul KV path for HTML returned when no route is found")
 	f.StringVar(&cfg.Registry.Consul.TagPrefix, "registry.consul.tagprefix", defaultConfig.Registry.Consul.TagPrefix, "prefix for consul tags")
+	f.BoolVar(&cfg.Registry.Consul.EnableSSL, "registry.consul.enableSSL", defaultConfig.Registry.Consul.EnableSSL, "enable HTTPS communication with Consul")


uppercase words are not parsed by flag library. If you change it to lower case flag will parse it correctly. I mean - registry.consul.enableSSL change to registry.consul.enablessl
same for other added parametes

change to lowercase if property file

sev3ryn · 2018-08-02T16:50:18Z

registry/consul/backend.go

+	if cfg.EnableSSL {
+		cfg.Scheme = "https"
+
+		tls := &api.TLSConfig{


tls variable is shadowed here. Here should be
tls = api.TLSConfig{

sev3ryn · 2018-08-02T16:55:36Z

Hi, I also faced a need for this functionality today.
But code in this PR have few issues and is not fully working - @jrasell see my comments on File changes tab.

BTW. @jrasell, if you abandoned this PR - I can pick it to implement changes that @magiconair requested

vjeantet · 2018-09-15T19:58:00Z

Hello, i need this functionality too.

Currently blocked because of lack of https to search consul. :(

How can we help ?

eagle1981 · 2019-02-03T08:58:05Z

How about merge to next release? It's blocker feature for our deployment.

tecnobrat · 2019-02-08T23:15:04Z

@jrasell @sev3ryn is this abandoned? I also need this as well as its a blocker .. let me know if I can help, happy to try to refactor this PR.

pires · 2019-06-01T16:57:42Z

This can be closed since #602 was merged, right?

pschultz · 2019-06-03T07:00:38Z

Yes, thanks for the reminder.

jrasell added 2 commits November 20, 2017 12:40

Vendoring in version d968d8b648 of github.com/hashicorp/consul/api

59dc220

stack72 mentioned this pull request Jun 6, 2018

Is fabio can register itself into consul in HTTPS ? #501

Open

jrasell and others added 4 commits June 6, 2018 18:12

Vendoring in version d968d8b648 of github.com/hashicorp/consul/api

fb23d47

Merge branch 'f_gh_276' into rebase-consul-tls

b813de4

Merge pull request #2 from stack72/rebase-consul-tls

467f4bd

Rebase consul tls

jen20 added a commit to jen20/fabio that referenced this pull request Jun 6, 2018

Merge branch 'consul-tls'

b0e0f21

Fixes fabiolb#276, fabiolb#501 (fixes fabiolb#391)

sev3ryn reviewed Aug 2, 2018

View reviewed changes

sev3ryn mentioned this pull request Feb 9, 2019

added support for Consul TLS transport #602

Merged

pschultz closed this Jun 3, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fabio can connect to Consul using TLS for secure communication. #391

Fabio can connect to Consul using TLS for secure communication. #391

jrasell commented Nov 20, 2017 •

edited

Loading

CLAassistant commented Nov 20, 2017 •

edited

Loading

jrasell commented Nov 20, 2017

jrasell commented Dec 4, 2017

magiconair commented Dec 4, 2017

magiconair commented Dec 4, 2017

magiconair commented Dec 4, 2017

jrasell commented Dec 5, 2017

magiconair commented Dec 5, 2017

sev3ryn Aug 2, 2018

sev3ryn Aug 2, 2018

sev3ryn commented Aug 2, 2018 •

edited

Loading

vjeantet commented Sep 15, 2018

eagle1981 commented Feb 3, 2019

tecnobrat commented Feb 8, 2019

pires commented Jun 1, 2019

pschultz commented Jun 3, 2019

Fabio can connect to Consul using TLS for secure communication. #391

Fabio can connect to Consul using TLS for secure communication. #391

Conversation

jrasell commented Nov 20, 2017 • edited Loading

CLAassistant commented Nov 20, 2017 • edited Loading

jrasell commented Nov 20, 2017

jrasell commented Dec 4, 2017

magiconair commented Dec 4, 2017

magiconair commented Dec 4, 2017

magiconair commented Dec 4, 2017

jrasell commented Dec 5, 2017

magiconair commented Dec 5, 2017

sev3ryn Aug 2, 2018

Choose a reason for hiding this comment

sev3ryn Aug 2, 2018

Choose a reason for hiding this comment

sev3ryn commented Aug 2, 2018 • edited Loading

vjeantet commented Sep 15, 2018

eagle1981 commented Feb 3, 2019

tecnobrat commented Feb 8, 2019

pires commented Jun 1, 2019

pschultz commented Jun 3, 2019

jrasell commented Nov 20, 2017 •

edited

Loading

CLAassistant commented Nov 20, 2017 •

edited

Loading

sev3ryn commented Aug 2, 2018 •

edited

Loading