From 1d01d0407ee08c3da338a323a168c454ecdd3bdf Mon Sep 17 00:00:00 2001 From: Afreen Misbah Date: Sat, 14 Sep 2024 22:28:44 +0530 Subject: [PATCH] mgr/dashboard: Add mTLS support - enables mTLS support from dashboard - adds unit tests related to mTLS support - can enable mTLS - can disable mTLS - inlcuded refactoring from prev commit Fixes https://tracker.ceph.com/issues/66416 Signed-off-by: Afreen Misbah --- .../service-form/service-form.component.html | 123 ++++++++++++++++- .../service-form.component.spec.ts | 63 ++++++++- .../service-form/service-form.component.ts | 124 +++++++++++++----- .../pool-details.component.spec.ts | 1 + .../app/shared/models/service.interface.ts | 5 + 5 files changed, 280 insertions(+), 36 deletions(-) diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html index 641d25a8dc29c..46d28f74e6b3b 100644 --- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html +++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html @@ -96,7 +96,7 @@ name="pool" class="form-select" formControlName="pool" - (change)="onBlockPoolChange()"> + (change)="setNvmeServiceId()"> @@ -131,7 +131,7 @@ class="form-control" type="text" formControlName="group" - (change)="onNvmeofGroupChange($event.target.value)"> + (change)="setNvmeServiceId()"> The name of the gateway group. @@ -1272,6 +1272,125 @@ i18n> Modifying the default settings could lead to a weaker security configuration + + + +
+
+
+ + + Enables mutual TLS (mTLS) between the client and the gateway server. +
+
+
+ + +
+ +
+ + + This field is required. +
+
+ + +
+ +
+ + + This field is required. +
+
+ + +
+ +
+ + + This field is required. +
+
+ + +
+ +
+ + + This field is required. +
+
+ + +
+ +
+ + + This field is required. +
+
+
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts index 0e931d485d0fe..cbecc908e87d4 100644 --- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts +++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts @@ -469,7 +469,41 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA== expect(countEl).toBeNull(); }); - it('should submit nvmeof', () => { + it('should not show certs and keys field with mTLS disabled', () => { + formHelper.setValue('ssl', true); + fixture.detectChanges(); + const root_ca_cert = fixture.debugElement.query(By.css('#root_ca_cert')); + const client_cert = fixture.debugElement.query(By.css('#client_cert')); + const client_key = fixture.debugElement.query(By.css('#client_key')); + const server_cert = fixture.debugElement.query(By.css('#server_cert')); + const server_key = fixture.debugElement.query(By.css('#server_key')); + expect(root_ca_cert).toBeNull(); + expect(client_cert).toBeNull(); + expect(client_key).toBeNull(); + expect(server_cert).toBeNull(); + expect(server_key).toBeNull(); + }); + + it('should submit nvmeof without mTLS', () => { + component.onSubmit(); + expect(cephServiceService.create).toHaveBeenCalledWith({ + service_type: 'nvmeof', + service_id: 'rbd.default', + placement: {}, + unmanaged: false, + pool: 'rbd', + group: 'default', + enable_auth: false + }); + }); + + it('should submit nvmeof with mTLS', () => { + formHelper.setValue('enable_mtls', true); + formHelper.setValue('root_ca_cert', 'root_ca_cert'); + formHelper.setValue('client_cert', 'client_cert'); + formHelper.setValue('client_key', 'client_key'); + formHelper.setValue('server_cert', 'server_cert'); + formHelper.setValue('server_key', 'server_key'); component.onSubmit(); expect(cephServiceService.create).toHaveBeenCalledWith({ service_type: 'nvmeof', @@ -477,7 +511,13 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA== placement: {}, unmanaged: false, pool: 'rbd', - group: 'default' + group: 'default', + enable_auth: true, + root_ca_cert: 'root_ca_cert', + client_cert: 'client_cert', + client_key: 'client_key', + server_cert: 'server_cert', + server_key: 'server_key' }); }); }); @@ -721,6 +761,25 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA== const groupId = fixture.debugElement.query(By.css('#group')).nativeElement; expect(groupId.disabled).toBeTruthy(); }); + + it('should update nvmeof service to disable mTLS', () => { + spyOn(cephServiceService, 'update').and.stub(); + component.serviceType = 'nvmeof'; + formHelper.setValue('service_type', 'nvmeof'); + formHelper.setValue('pool', 'rbd'); + formHelper.setValue('group', 'default'); + // mTLS disabled + formHelper.setValue('enable_auth', false); + component.onSubmit(); + expect(cephServiceService.update).toHaveBeenCalledWith({ + service_type: 'nvmeof', + placement: {}, + unmanaged: false, + pool: 'rbd', + group: 'default', + enable_auth: false + }); + }); }); }); }); diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts index 27477a845f792..aa50aeab0b4a5 100644 --- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts +++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts @@ -217,6 +217,67 @@ export class ServiceFormComponent extends CdForm implements OnInit { service_type: 'nvmeof' }) ], + enable_mtls: [false], + root_ca_cert: [ + null, + [ + CdValidators.composeIf( + { + service_type: 'nvmeof', + enable_mtls: true + }, + [Validators.required] + ) + ] + ], + client_cert: [ + null, + [ + CdValidators.composeIf( + { + service_type: 'nvmeof', + enable_mtls: true + }, + [Validators.required] + ) + ] + ], + client_key: [ + null, + [ + CdValidators.composeIf( + { + service_type: 'nvmeof', + enable_mtls: true + }, + [Validators.required] + ) + ] + ], + server_cert: [ + null, + [ + CdValidators.composeIf( + { + service_type: 'nvmeof', + enable_mtls: true + }, + [Validators.required] + ) + ] + ], + server_key: [ + null, + [ + CdValidators.composeIf( + { + service_type: 'nvmeof', + enable_mtls: true + }, + [Validators.required] + ) + ] + ], // RGW rgw_frontend_port: [null, [CdValidators.number(false)]], realm_name: [null], @@ -633,6 +694,12 @@ export class ServiceFormComponent extends CdForm implements OnInit { case 'nvmeof': this.serviceForm.get('pool').setValue(response[0].spec.pool); this.serviceForm.get('group').setValue(response[0].spec.group); + this.serviceForm.get('enable_auth').setValue(response[0].spec.enable_auth); + this.serviceForm.get('root_ca_cert').setValue(response[0].spec.root_ca_cert); + this.serviceForm.get('client_cert').setValue(response[0].spec.client_cert); + this.serviceForm.get('client_key').setValue(response[0].spec.client_key); + this.serviceForm.get('server_cert').setValue(response[0].spec.server_cert); + this.serviceForm.get('server_key').setValue(response[0].spec.server_key); break; case 'rgw': this.serviceForm @@ -961,31 +1028,27 @@ export class ServiceFormComponent extends CdForm implements OnInit { ); } - onNvmeofGroupChange(groupName: string) { + setNvmeServiceId() { const pool = this.serviceForm.get('pool').value; - if (pool) this.serviceForm.get('service_id').setValue(`${pool}.${groupName}`); - else this.serviceForm.get('service_id').setValue(groupName); - } - - getDefaultBlockPool(): string { - // returns 'rbd' pool otherwise the first block pool - return ( - this.rbdPools?.find((p: Pool) => p.pool_name === 'rbd')?.pool_name || - this.rbdPools?.[0].pool_name - ); - } - - setNvmeofServiceIdAndPool(): void { - const defaultBlockPool: string = this.getDefaultBlockPool(); - const group: string = this.serviceForm.get('group').value; - if (defaultBlockPool && group) { - this.serviceForm.get('pool').setValue(defaultBlockPool); - this.serviceForm.get('service_id').setValue(`${defaultBlockPool}.${group}`); + const group = this.serviceForm.get('group').value; + if (pool && group) { + this.serviceForm.get('service_id').setValue(`${pool}.${group}`); + } else if (pool) { + this.serviceForm.get('service_id').setValue(pool); + } else if (group) { + this.serviceForm.get('service_id').setValue(group); } else { this.serviceForm.get('service_id').setValue(null); } } + setNvmeDefaultPool() { + const defaultPool = + this.rbdPools?.find((p: Pool) => p.pool_name === 'rbd')?.pool_name || + this.rbdPools?.[0].pool_name; + this.serviceForm.get('pool').setValue(defaultPool); + } + requiresServiceId(serviceType: string) { return ['mds', 'rgw', 'nfs', 'iscsi', 'nvmeof', 'smb', 'ingress'].includes(serviceType); } @@ -993,7 +1056,8 @@ export class ServiceFormComponent extends CdForm implements OnInit { setServiceId(serviceId: string): void { const requiresServiceId: boolean = this.requiresServiceId(serviceId); if (requiresServiceId && serviceId === 'nvmeof') { - this.setNvmeofServiceIdAndPool(); + this.setNvmeDefaultPool(); + this.setNvmeServiceId(); } else if (requiresServiceId) { this.serviceForm.get('service_id').setValue(null); } else { @@ -1029,18 +1093,6 @@ export class ServiceFormComponent extends CdForm implements OnInit { } } - onBlockPoolChange() { - const selectedBlockPool = this.serviceForm.get('pool').value; - const group = this.serviceForm.get('group').value; - if (selectedBlockPool && group) { - this.serviceForm.get('service_id').setValue(`${selectedBlockPool}.${group}`); - } else if (selectedBlockPool) { - this.serviceForm.get('service_id').setValue(selectedBlockPool); - } else { - this.serviceForm.get('service_id').setValue(null); - } - } - disableForEditing(serviceType: string) { const disableForEditKeys = ['service_type', 'service_id']; disableForEditKeys.forEach((key) => { @@ -1138,6 +1190,14 @@ export class ServiceFormComponent extends CdForm implements OnInit { case 'nvmeof': serviceSpec['pool'] = values['pool']; serviceSpec['group'] = values['group']; + serviceSpec['enable_auth'] = values['enable_mtls']; + if (values['enable_mtls']) { + serviceSpec['root_ca_cert'] = values['root_ca_cert']; + serviceSpec['client_cert'] = values['client_cert']; + serviceSpec['client_key'] = values['client_key']; + serviceSpec['server_cert'] = values['server_cert']; + serviceSpec['server_key'] = values['server_key']; + } break; case 'iscsi': serviceSpec['pool'] = values['pool']; diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-details/pool-details.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-details/pool-details.component.spec.ts index f30f954b5b652..40a0ae365a5f2 100644 --- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-details/pool-details.component.spec.ts +++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-details/pool-details.component.spec.ts @@ -123,6 +123,7 @@ describe('PoolDetailsComponent', () => { expectedChange( { poolDetails: { + application_metadata: ['rbd'], pg_num: 256, pg_num_target: 256, pg_placement_num: 256, diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts index 172cfd28018e0..f07e85a07951a 100644 --- a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts +++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts @@ -32,6 +32,11 @@ export interface CephServiceAdditionalSpec { virtual_interface_networks: string[]; pool: string; group: string; + root_ca_cert: string; + client_cert: string; + client_key: string; + server_cert: string; + server_key: string; rgw_frontend_ssl_certificate: string; ssl: boolean; ssl_cert: string; -- 2.39.5