Allow Connections to Remote Docker via secured TLS

build.gradle → build.gradle.kts

@@ -1,89 +1,74 @@
+object Dependency {
+    const val KOTLIN = "1.4.10"
+    const val MICRONAUT = "2.0.3"
+}
+
 plugins {
-    id "org.jetbrains.kotlin.jvm" version "${kotlinVersion}"
-    id "org.jetbrains.kotlin.kapt" version "${kotlinVersion}"
-    id "org.jetbrains.kotlin.plugin.allopen" version "${kotlinVersion}"
-    id "com.github.johnrengelman.shadow" version "6.0.0"
-    id "com.gorylenko.gradle-git-properties" version "2.2.3"
-    id "application"
+    kotlin("jvm") version "1.4.10"
+    kotlin("kapt") version "1.4.10"
+    kotlin("plugin.allopen") version "1.4.10"
+    id("com.github.johnrengelman.shadow") version "5.2.0"
+    application
 }
 
-version "0.1"
-group "com.ilunos.agent.docker"
+version = "0.1"
+group = "com.ilunos.agent.docker"
 
 repositories {
+    maven("https://dl.bintray.com/nanabell/ilunos")
     mavenCentral()
     jcenter()
 }
 
-configurations {
-    // for dependencies that are needed for development only
-    developmentOnly
-}
+val developmentOnly = configurations.create("developmentOnly")
+
 
 dependencies {
-    kapt(platform("io.micronaut:micronaut-bom:$micronautVersion"))
+    kapt(platform("io.micronaut:micronaut-bom:${Dependency.MICRONAUT}"))
     kapt("io.micronaut:micronaut-inject-java")
     kapt("io.micronaut:micronaut-validation")
     kapt("io.micronaut.security:micronaut-security-annotations")
-    implementation(platform("io.micronaut:micronaut-bom:$micronautVersion"))
+
+    implementation(kotlin("stdlib-jdk8"))
+    implementation(kotlin("reflect"))
+    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.3.8")
+    implementation("com.ilunos.common:common:1.0.1")
+
+    implementation(platform("io.micronaut:micronaut-bom:${Dependency.MICRONAUT}"))
     implementation("io.micronaut:micronaut-inject")
     implementation("io.micronaut:micronaut-validation")
     implementation("io.micronaut:micronaut-management")
-    implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8")
-    implementation("org.jetbrains.kotlin:kotlin-reflect")
-    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.3.8")
     implementation("io.micronaut.kotlin:micronaut-kotlin-runtime")
     implementation("io.micronaut:micronaut-runtime")
-    implementation("javax.annotation:javax.annotation-api")
+
     implementation("io.micronaut:micronaut-http-server-netty")
     implementation("io.micronaut:micronaut-http-client")
     implementation("io.micronaut.security:micronaut-security")
     implementation("io.micronaut.security:micronaut-security-oauth2")
     implementation("io.micronaut.security:micronaut-security-jwt")
     implementation("io.micronaut.kotlin:micronaut-kotlin-extension-functions")
+    implementation("javax.annotation:javax.annotation-api")
+
     implementation("com.github.docker-java:docker-java:3.2.5")
     implementation("com.github.docker-java:docker-java-transport-httpclient5:3.2.5")
+
     runtimeOnly("ch.qos.logback:logback-classic")
     runtimeOnly("com.fasterxml.jackson.module:jackson-module-kotlin")
-    kaptTest(enforcedPlatform("io.micronaut:micronaut-bom:$micronautVersion"))
+
+    kaptTest(enforcedPlatform("io.micronaut:micronaut-bom:${Dependency.MICRONAUT}"))
     kaptTest("io.micronaut:micronaut-inject-java")
-    testImplementation(enforcedPlatform("io.micronaut:micronaut-bom:$micronautVersion"))
+
+    testImplementation(enforcedPlatform("io.micronaut:micronaut-bom:${Dependency.MICRONAUT}"))
     testImplementation("io.micronaut.test:micronaut-test-kotlintest")
     testImplementation("io.mockk:mockk:1.9.3")
     testImplementation("io.kotlintest:kotlintest-runner-junit5:3.3.2")
 }
 
-test.classpath += configurations.developmentOnly
-
-mainClassName = "com.ilunos.agent.docker.IlunosKt"
-
-// use JUnit 5 platform
-test {
-    useJUnitPlatform()
-}
-
-java {
-    sourceCompatibility = JavaVersion.toVersion('13')
-}
-
 allOpen {
-    annotation("io.micronaut.aop.Around")
-}
-compileKotlin {
-    kotlinOptions {
-        jvmTarget = '13'
-        //Will retain parameter names for Java reflection
-        javaParameters = true
-    }
-}
-compileTestKotlin {
-    kotlinOptions {
-        jvmTarget = '13'
-        javaParameters = true
-    }
+    annotations("io.micronaut.aop.Around", "io.micronaut.scheduling.annotation.Scheduled")
 }
+
 kapt {
-    correctErrorTypes = true
     arguments {
         arg("micronaut.processing.incremental", true)
         arg("micronaut.processing.annotations", "com.ilunos.agent.docker.*")
@@ -92,21 +77,32 @@ kapt {
     }
 }
 
-shadowJar {
-    mergeServiceFiles()
-}
+tasks {
+    compileKotlin {
+        kotlinOptions {
+            jvmTarget = "13"
+            javaParameters = true
+        }
+    }
+    compileTestKotlin {
+        kotlinOptions {
+            jvmTarget = "13"
+            javaParameters = true
+        }
+    }
 
-tasks.withType(JavaExec) {
-    classpath += configurations.developmentOnly
-    jvmArgs('-XX:TieredStopAtLevel=1', '-Dcom.sun.management.jmxremote')
-    if (gradle.startParameter.continuous) {
-        systemProperties(
-                'micronaut.io.watch.restart': 'true',
-                'micronaut.io.watch.enabled': 'true',
-                "micronaut.io.watch.paths": "src/main"
-        )
+    shadowJar {
+        mergeServiceFiles()
     }
-}
 
+    // use JUnit 5 platform
+    test {
+        useJUnitPlatform()
+    }
+}
 
 
+tasks.withType<JavaCompile> {
+    classpath += developmentOnly
+    options.compilerArgs.addAll(arrayOf("-XX:TieredStopAtLevel=1", "-Dcom.sun.management.jmxremote"))
+}

src/main/kotlin/com/ilunos/agent/docker/Ilunos.kt

@@ -1,6 +1,6 @@
 package com.ilunos.agent.docker
 
-import com.ilunos.agent.docker.util.ConfigUtils
+import com.ilunos.common.config.ConfigUtils
 import io.micronaut.context.ApplicationContext
 import io.micronaut.context.annotation.Context
 import io.micronaut.context.env.Environment

src/main/kotlin/com/ilunos/agent/docker/config/AgentConfig.kt

@@ -5,14 +5,12 @@ import com.ilunos.agent.docker.Ilunos
 import edu.umd.cs.findbugs.annotations.NonNull
 import io.micronaut.context.annotation.ConfigurationProperties
 import io.micronaut.core.annotation.Introspected
-import jdk.jfr.BooleanFlag
 import java.io.Serializable
 
 @Introspected
 @ConfigurationProperties("agent")
 class AgentConfig : Serializable {
 
-    @BooleanFlag
     @JsonProperty("auto-connect")
     var autoConnect: Boolean = true
 

src/main/kotlin/com/ilunos/agent/docker/config/AgentSSLConfig.kt

@@ -0,0 +1,26 @@
+package com.ilunos.agent.docker.config
+
+import com.fasterxml.jackson.annotation.JsonProperty
+import io.micronaut.context.annotation.ConfigurationProperties
+import java.nio.file.Path
+
+@ConfigurationProperties("agent.ssl")
+class AgentSSLConfig {
+
+    var type: AgentSSLType = AgentSSLType.NONE
+
+    @JsonProperty("keystore-file")
+    var keystoreFile: Path? = null
+
+    @JsonProperty("keystore-pass")
+    var keystorePass: String? = null
+
+    @JsonProperty("pem-directory")
+    var pemDirectory: Path? = null
+
+    enum class AgentSSLType {
+        NONE,
+        KEYSTORE,
+        PEM_FILES
+    }
+}

src/main/kotlin/com/ilunos/agent/docker/config/OrchestratorConfig.kt

@@ -11,6 +11,8 @@ class OrchestratorConfig {
 
     lateinit var url: URI
 
+    var enabled: Boolean = false
+
     @Nullable
     var token: String? = null
 }

src/main/kotlin/com/ilunos/agent/docker/domain/OrchestratorConnectRequest.kt

@@ -0,0 +1,9 @@
+package com.ilunos.agent.docker.domain
+
+data class OrchestratorConnectRequest(
+        val name: String,
+        val token: String?,
+        val hostname: String,
+        val port: Int
+) {
+}

src/main/kotlin/com/ilunos/agent/docker/domain/OrchestratorConnectResponse.kt

@@ -0,0 +1,7 @@
+package com.ilunos.agent.docker.domain
+
+data class OrchestratorConnectResponse(
+        val token: String?,
+        val connected: Boolean,
+        val errorMessage: String?
+)

src/main/kotlin/com/ilunos/agent/docker/service/DockerContext.kt

@@ -8,10 +8,8 @@ import com.github.dockerjava.api.model.Container
 import com.github.dockerjava.api.model.Image
 import com.github.dockerjava.api.model.Info
 import com.github.dockerjava.api.model.Version
-import com.github.dockerjava.core.DefaultDockerClientConfig
-import com.github.dockerjava.core.DockerClientBuilder
-import com.github.dockerjava.httpclient5.ApacheDockerHttpClient
 import com.ilunos.agent.docker.config.AgentConfig
+import com.ilunos.agent.docker.config.AgentSSLConfig
 import com.ilunos.agent.docker.exception.AgentNotConnectedException
 import com.ilunos.agent.docker.model.ConnectionStatus
 import io.micronaut.context.annotation.Context
@@ -24,12 +22,11 @@ import java.util.*
 
 @Context
 @Infrastructure
-class DockerContext(private val agentConfig: AgentConfig) {
+class DockerContext(private val agentConfig: AgentConfig, private val agentSSLConfig: AgentSSLConfig) {
 
     private val logger: Logger = LoggerFactory.getLogger(DockerContext::class.java)
 
     private lateinit var client: DockerClient
-
     private var status: ConnectionStatus = ConnectionStatus.UNKNOWN
 
     init {
@@ -156,22 +153,13 @@ class DockerContext(private val agentConfig: AgentConfig) {
 
     fun connect() {
         disconnect()
-
-        val clientConfig = DefaultDockerClientConfig.createDefaultConfigBuilder()
-                .withDockerHost(agentConfig.url)
-                .build()
-
-        val httpClient = ApacheDockerHttpClient.Builder()
-                .dockerHost(clientConfig.dockerHost)
-                .sslConfig(clientConfig.sslConfig)
-                .build()
-
         this.status = ConnectionStatus.BUILDING
 
         try {
-            this.client = DockerClientBuilder.getInstance(clientConfig).withDockerHttpClient(httpClient).build()
-            client.pingCmd().exec()
+            this.client = DockerContextBuilder(agentConfig, agentSSLConfig).build()
+            logger.debug("Attempting to connect to Docker System at '${agentConfig.url}'")
 
+            client.pingCmd().exec()
             this.status = ConnectionStatus.CONNECTED
             logger.info("Connected to Docker System at ${agentConfig.url}")
 

src/main/kotlin/com/ilunos/agent/docker/service/DockerContextBuilder.kt

@@ -0,0 +1,68 @@
+package com.ilunos.agent.docker.service
+
+import com.github.dockerjava.api.DockerClient
+import com.github.dockerjava.core.*
+import com.github.dockerjava.httpclient5.ApacheDockerHttpClient
+import com.ilunos.agent.docker.config.AgentConfig
+import com.ilunos.agent.docker.config.AgentSSLConfig
+import org.slf4j.LoggerFactory
+import java.nio.file.Files
+import javax.naming.ConfigurationException
+
+class DockerContextBuilder(private val agentConfig: AgentConfig, private val agentSSLConfig: AgentSSLConfig) {
+
+    private val logger = LoggerFactory.getLogger(DockerContextBuilder::class.java)
+
+    fun build(): DockerClient {
+        logger.debug("Start building new DockerClient...")
+
+        val configBuilder = DefaultDockerClientConfig.createDefaultConfigBuilder().withDockerHost(agentConfig.url)
+        val clientConfig = loadSSlConfig(configBuilder)
+
+        val httpClient = ApacheDockerHttpClient.Builder()
+                .dockerHost(clientConfig.dockerHost)
+                .sslConfig(clientConfig.sslConfig)
+                .build()
+
+        return DockerClientImpl.getInstance(clientConfig, httpClient)
+    }
+
+
+    private fun loadSSlConfig(builder: DefaultDockerClientConfig.Builder): DockerClientConfig {
+        return when (agentSSLConfig.type) {
+            AgentSSLConfig.AgentSSLType.NONE -> loadNoSSL(builder)
+            AgentSSLConfig.AgentSSLType.KEYSTORE -> loadKeystoreSSl(builder)
+            AgentSSLConfig.AgentSSLType.PEM_FILES -> loadPemSSL(builder)
+        }
+    }
+
+    private fun loadNoSSL(builder: DefaultDockerClientConfig.Builder): DockerClientConfig {
+        logger.debug("Building DockerClient without SSL Config")
+
+        return builder.build()
+    }
+
+    private fun loadKeystoreSSl(builder: DefaultDockerClientConfig.Builder): DockerClientConfig {
+        logger.debug("Building DockerClient with Keystore SSL Config")
+
+        TODO("Keystore SSL Config is not yet implemented")
+    }
+
+    private fun loadPemSSL(builder: DefaultDockerClientConfig.Builder): DockerClientConfig {
+        logger.debug("Building DockerClient with PemDirectory SSL Config")
+
+        val directory = agentSSLConfig.pemDirectory
+                ?: throw ConfigurationException("Property 'agent.ssl.pem-directory' is required when using SSL Type 'PEM_FILES'!")
+
+        if (!Files.isDirectory(directory))
+            throw ConfigurationException("Property 'agent.ssl.pem-directory' does not exist or is not a directory!")
+
+        logger.debug("Using PemDirectory at '$directory'")
+        return builder
+                .withCustomSslConfig(LocalDirectorySSLConfig(directory.toAbsolutePath().toString()))
+                .withDockerTlsVerify(true)
+                .build()
+    }
+
+
+}