55package cluster
66
77import (
8+ "bytes"
89 "context"
10+ "encoding/base64"
911 "errors"
1012 "fmt"
1113 "math/big"
@@ -23,6 +25,8 @@ import (
2325 "github.com/dustin/go-humanize"
2426 "github.com/google/uuid"
2527 "github.com/hashicorp/go-getter/v2"
28+ "github.com/klauspost/compress/zstd"
29+ "github.com/siderolabs/crypto/x509"
2630 "github.com/siderolabs/gen/maps"
2731 "github.com/siderolabs/go-blockdevice/v2/encryption"
2832 "github.com/siderolabs/go-kubeconfig"
@@ -40,10 +44,12 @@ import (
4044 clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config"
4145 "github.com/siderolabs/talos/pkg/machinery/config"
4246 "github.com/siderolabs/talos/pkg/machinery/config/bundle"
47+ "github.com/siderolabs/talos/pkg/machinery/config/configloader"
4348 "github.com/siderolabs/talos/pkg/machinery/config/configpatcher"
4449 "github.com/siderolabs/talos/pkg/machinery/config/encoder"
4550 "github.com/siderolabs/talos/pkg/machinery/config/generate"
4651 "github.com/siderolabs/talos/pkg/machinery/config/machine"
52+ "github.com/siderolabs/talos/pkg/machinery/config/types/security"
4753 "github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
4854 "github.com/siderolabs/talos/pkg/machinery/constants"
4955 "github.com/siderolabs/talos/pkg/machinery/nethelpers"
@@ -752,6 +758,24 @@ func create(ctx context.Context) error {
752758 )
753759 }
754760
761+ var slb * siderolinkBuilder
762+
763+ if withSiderolinkAgent .IsEnabled () {
764+ slb , err = newSiderolinkBuilder (gatewayIPs [0 ].String (), withSiderolinkAgent .IsTLS ())
765+ if err != nil {
766+ return err
767+ }
768+ }
769+
770+ if trustedRootsConfig := slb .TrustedRootsConfig (); trustedRootsConfig != nil {
771+ trustedRootsPatch , err := configloader .NewFromBytes (trustedRootsConfig )
772+ if err != nil {
773+ return fmt .Errorf ("error loading trusted roots config: %w" , err )
774+ }
775+
776+ configBundleOpts = append (configBundleOpts , bundle .WithPatch ([]configpatcher.Patch {configpatcher .NewStrategicMergePatch (trustedRootsPatch )}))
777+ }
778+
755779 configBundle , err := bundle .NewBundle (configBundleOpts ... )
756780 if err != nil {
757781 return err
@@ -795,15 +819,6 @@ func create(ctx context.Context) error {
795819 extraKernelArgs = procfs .NewCmdline (extraBootKernelArgs )
796820 }
797821
798- var slb * siderolinkBuilder
799-
800- if withSiderolinkAgent .IsEnabled () {
801- slb , err = newSiderolinkBuilder (gatewayIPs [0 ].String ())
802- if err != nil {
803- return err
804- }
805- }
806-
807822 err = slb .SetKernelArgs (extraKernelArgs , withSiderolinkAgent .IsTunnel ())
808823 if err != nil {
809824 return err
@@ -1255,7 +1270,7 @@ func init() {
12551270 Cmd .AddCommand (createCmd )
12561271}
12571272
1258- func newSiderolinkBuilder (wgHost string ) (* siderolinkBuilder , error ) {
1273+ func newSiderolinkBuilder (wgHost string , useTLS bool ) (* siderolinkBuilder , error ) {
12591274 prefix , err := networkPrefix ("" )
12601275 if err != nil {
12611276 return nil , err
@@ -1268,6 +1283,16 @@ func newSiderolinkBuilder(wgHost string) (*siderolinkBuilder, error) {
12681283 nodeIPv6Addr : prefix .Addr ().Next ().String (),
12691284 }
12701285
1286+ if useTLS {
1287+ ca , err := x509 .NewSelfSignedCertificateAuthority (x509 .ECDSA (true ), x509 .IPAddresses ([]net.IP {net .ParseIP (wgHost )}))
1288+ if err != nil {
1289+ return nil , err
1290+ }
1291+
1292+ result .apiCert = ca .CrtPEM
1293+ result .apiKey = ca .KeyPEM
1294+ }
1295+
12711296 var resultErr error
12721297
12731298 for range 10 {
@@ -1312,6 +1337,9 @@ type siderolinkBuilder struct {
13121337 apiPort int
13131338 sinkPort int
13141339 logPort int
1340+
1341+ apiCert []byte
1342+ apiKey []byte
13151343}
13161344
13171345// DefineIPv6ForUUID defines an IPv6 address for a given UUID. It is safe to call this method on a nil pointer.
@@ -1340,6 +1368,8 @@ func (slb *siderolinkBuilder) SiderolinkRequest() provision.SiderolinkRequest {
13401368 return provision.SiderolinkRequest {
13411369 WireguardEndpoint : net .JoinHostPort (slb .wgHost , strconv .Itoa (slb .wgPort )),
13421370 APIEndpoint : ":" + strconv .Itoa (slb .apiPort ),
1371+ APICertificate : slb .apiCert ,
1372+ APIKey : slb .apiKey ,
13431373 SinkEndpoint : ":" + strconv .Itoa (slb .sinkPort ),
13441374 LogEndpoint : ":" + strconv .Itoa (slb .logPort ),
13451375 SiderolinkBind : maps .ToSlice (slb .binds , func (k uuid.UUID , v netip.Addr ) provision.SiderolinkBind {
@@ -1351,6 +1381,24 @@ func (slb *siderolinkBuilder) SiderolinkRequest() provision.SiderolinkRequest {
13511381 }
13521382}
13531383
1384+ // TrustedRootsConfig returns the trusted roots config for the current builder.
1385+ func (slb * siderolinkBuilder ) TrustedRootsConfig () []byte {
1386+ if slb == nil || slb .apiCert == nil {
1387+ return nil
1388+ }
1389+
1390+ trustedRootsConfig := security .NewTrustedRootsConfigV1Alpha1 ()
1391+ trustedRootsConfig .MetaName = "siderolink-ca"
1392+ trustedRootsConfig .Certificates = string (slb .apiCert )
1393+
1394+ marshaled , err := encoder .NewEncoder (trustedRootsConfig , encoder .WithComments (encoder .CommentsDisabled )).Encode ()
1395+ if err != nil {
1396+ panic (fmt .Sprintf ("failed to marshal trusted roots config: %s" , err ))
1397+ }
1398+
1399+ return marshaled
1400+ }
1401+
13541402// SetKernelArgs sets the kernel arguments for the current builder. It is safe to call this method on a nil pointer.
13551403func (slb * siderolinkBuilder ) SetKernelArgs (extraKernelArgs * procfs.Cmdline , tunnel bool ) error {
13561404 switch {
@@ -1361,7 +1409,13 @@ func (slb *siderolinkBuilder) SetKernelArgs(extraKernelArgs *procfs.Cmdline, tun
13611409 extraKernelArgs .Get ("talos.logging.kernel" ) != nil :
13621410 return errors .New ("siderolink kernel arguments are already set, cannot run with --with-siderolink" )
13631411 default :
1364- apiLink := "grpc://" + net .JoinHostPort (slb .wgHost , strconv .Itoa (slb .apiPort )) + "?jointoken=foo"
1412+ scheme := "grpc://"
1413+
1414+ if slb .apiCert != nil {
1415+ scheme = "https://"
1416+ }
1417+
1418+ apiLink := scheme + net .JoinHostPort (slb .wgHost , strconv .Itoa (slb .apiPort )) + "?jointoken=foo"
13651419
13661420 if tunnel {
13671421 apiLink += "&grpc_tunnel=true"
@@ -1371,6 +1425,26 @@ func (slb *siderolinkBuilder) SetKernelArgs(extraKernelArgs *procfs.Cmdline, tun
13711425 extraKernelArgs .Append ("talos.events.sink" , net .JoinHostPort (slb .nodeIPv6Addr , strconv .Itoa (slb .sinkPort )))
13721426 extraKernelArgs .Append ("talos.logging.kernel" , "tcp://" + net .JoinHostPort (slb .nodeIPv6Addr , strconv .Itoa (slb .logPort )))
13731427
1428+ if trustedRootsConfig := slb .TrustedRootsConfig (); trustedRootsConfig != nil {
1429+ var buf bytes.Buffer
1430+
1431+ zencoder , err := zstd .NewWriter (& buf )
1432+ if err != nil {
1433+ return fmt .Errorf ("failed to create zstd encoder: %w" , err )
1434+ }
1435+
1436+ _ , err = zencoder .Write (trustedRootsConfig )
1437+ if err != nil {
1438+ return fmt .Errorf ("failed to write zstd data: %w" , err )
1439+ }
1440+
1441+ if err = zencoder .Close (); err != nil {
1442+ return fmt .Errorf ("failed to close zstd encoder: %w" , err )
1443+ }
1444+
1445+ extraKernelArgs .Append (constants .KernelParamConfigInline , base64 .StdEncoding .EncodeToString (buf .Bytes ()))
1446+ }
1447+
13741448 return nil
13751449 }
13761450}
@@ -1444,6 +1518,10 @@ func (a *agentFlag) String() string {
14441518 return "wireguard"
14451519 case 2 :
14461520 return "grpc-tunnel"
1521+ case 3 :
1522+ return "wireguard+tls"
1523+ case 4 :
1524+ return "grpc-tunnel+tls"
14471525 default :
14481526 return "none"
14491527 }
@@ -1455,13 +1533,18 @@ func (a *agentFlag) Set(s string) error {
14551533 * a = 1
14561534 case "tunnel" :
14571535 * a = 2
1536+ case "wireguard+tls" :
1537+ * a = 3
1538+ case "grpc-tunnel+tls" :
1539+ * a = 4
14581540 default :
1459- return fmt .Errorf ("unknown type: %s, possible values: 'true', 'wireguard' for the usual WG; 'tunnel' for WG over GRPC" , s )
1541+ return fmt .Errorf ("unknown type: %s, possible values: 'true', 'wireguard' for the usual WG; 'tunnel' for WG over GRPC, add '+tls' to enable TLS for API " , s )
14601542 }
14611543
14621544 return nil
14631545}
14641546
14651547func (a * agentFlag ) Type () string { return "agent" }
14661548func (a * agentFlag ) IsEnabled () bool { return * a != 0 }
1467- func (a * agentFlag ) IsTunnel () bool { return * a == 2 }
1549+ func (a * agentFlag ) IsTunnel () bool { return * a == 2 || * a == 4 }
1550+ func (a * agentFlag ) IsTLS () bool { return * a == 3 || * a == 4 }
0 commit comments