mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-02 06:08:23 +08:00
Marco André Dinis
a60d1c0f43
In the context of Teleport Discover we are trying to ease the usage of Teleport for the user's first interaction. When adding a new database resource the user must, among other things, generate the mTLS files Examples: https://goteleport.com/docs/database-access/guides/postgres-self-hosted/#step-25-create-a-certificatekey-pair https://goteleport.com/docs/database-access/guides/mysql-self-hosted/#step-24-create-a-certificatekey-pair This PR aims to reduce this friction: the user should be able to setup the resource without prior setup of local tools (`tsh login`) We're doing this by providing an endpoint that will return those exact files Demo ```shell marco@lenix ~/p/downloadmtls> curl --silent --insecure 'https://127.0.0.1.nip.io:3080/v1/webapi/sites/lenix/sign' --dat a '{"hostname":"discover.example.com", "ttl":"9999h", "format": "db"}' --header 'Authorization: Bearer 308bf3dd3019ddc4 2cff44a48e028480' --header 'Content-Type: application/json' -OJ marco@lenix ~/p/downloadmtls> tar -xvf teleport_mTLS_discover.example.com.tar.gz server.key server.crt server.cas marco@lenix ~/p/downloadmtls> head -1 server.* ==> server.cas <== -----BEGIN CERTIFICATE----- ==> server.crt <== -----BEGIN CERTIFICATE----- ==> server.key <== -----BEGIN RSA PRIVATE KEY----- ``` Fixes https://github.com/gravitational/teleport/issues/14049
73 lines
1.9 KiB
Go
73 lines
1.9 KiB
Go
/*
|
|
Copyright 2022 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package utils
|
|
|
|
import (
|
|
"archive/tar"
|
|
"bytes"
|
|
"compress/gzip"
|
|
"io/fs"
|
|
|
|
"github.com/gravitational/trace"
|
|
)
|
|
|
|
// ReadStatFS combines two interfaces: fs.ReadFileFS and fs.StatFS
|
|
// We need both when creating the archive to be able to:
|
|
// - read file contents - `ReadFile` provided by fs.ReadFileFS
|
|
// - set the correct file permissions - `Stat() ... Mode()` provided by fs.StatFS
|
|
type ReadStatFS interface {
|
|
fs.ReadFileFS
|
|
fs.StatFS
|
|
}
|
|
|
|
// CompressTarGzArchive creates a Tar Gzip archive in memory, reading the files using the provided file reader
|
|
func CompressTarGzArchive(files []string, fileReader ReadStatFS) (*bytes.Buffer, error) {
|
|
archiveBytes := &bytes.Buffer{}
|
|
|
|
gzipWriter := gzip.NewWriter(archiveBytes)
|
|
defer gzipWriter.Close()
|
|
|
|
tarWriter := tar.NewWriter(gzipWriter)
|
|
defer tarWriter.Close()
|
|
|
|
for _, filename := range files {
|
|
bs, err := fileReader.ReadFile(filename)
|
|
if err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
|
|
fileStat, err := fileReader.Stat(filename)
|
|
if err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
|
|
if err := tarWriter.WriteHeader(&tar.Header{
|
|
Name: filename,
|
|
Size: int64(len(bs)),
|
|
Mode: int64(fileStat.Mode()),
|
|
}); err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
|
|
if _, err := tarWriter.Write(bs); err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
}
|
|
|
|
return archiveBytes, nil
|
|
}
|