3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-06 10:21:05 +02:00
Code Issues Projects Releases Packages Wiki Activity

xds: lazy-load root ca bundle to avoid log in version command (#778)

Browse source
This commit is contained in:
Caleb Doxsey 2020-05-26 12:00:36 -06:00 • committed by GitHub
parent 829280c73c
commit 8943c7c17d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 30 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

23
internal/controlplane/xds.go
View file

@ -11,6 +11,7 @@ import (
"os" "os"
"path/filepath" "path/filepath"
"strconv" "strconv"
"sync"
xxhash "github.com/cespare/xxhash/v2" xxhash "github.com/cespare/xxhash/v2"
envoy_config_accesslog_v3 "github.com/envoyproxy/go-control-plane/envoy/config/accesslog/v3" envoy_config_accesslog_v3 "github.com/envoyproxy/go-control-plane/envoy/config/accesslog/v3"
@ -200,9 +201,13 @@ func envoyTLSCertificateFromGoTLSCertificate(cert *tls.Certificate) *envoy_exten
return envoyCert return envoyCert
} }
var rootCABundle string var rootCABundle struct {
sync.Once
value string
}
func init() { func getRootCertificateAuthority() (string, error) {
rootCABundle.Do(func() {
// from https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl#arch-overview-ssl-enabling-verification // from https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl#arch-overview-ssl-enabling-verification
knownRootLocations := []string{ knownRootLocations := []string{
"/etc/ssl/certs/ca-certificates.crt", "/etc/ssl/certs/ca-certificates.crt",
@ -214,22 +219,20 @@ func init() {
} }
for _, path := range knownRootLocations { for _, path := range knownRootLocations {
if _, err := os.Stat(path); err == nil { if _, err := os.Stat(path); err == nil {
rootCABundle = path rootCABundle.value = path
break break
} }
} }
if rootCABundle == "" { if rootCABundle.value == "" {
log.Error().Strs("known-locations", knownRootLocations). log.Error().Strs("known-locations", knownRootLocations).
Msgf("no root certificates were found in any of the known locations") Msgf("no root certificates were found in any of the known locations")
} else { } else {
log.Info().Msgf("using %s as the system root certificate authority bundle", rootCABundle) log.Info().Msgf("using %s as the system root certificate authority bundle", rootCABundle.value)
} }
} })
if rootCABundle.value == "" {
func getRootCertificateAuthority() (string, error) {
if rootCABundle == "" {
return "", fmt.Errorf("root certificates not found") return "", fmt.Errorf("root certificates not found")
} }
return rootCABundle, nil return rootCABundle.value, nil
} }