COCOS - 397 - Agent certificate generation via CA service #410

jovan-djukic · 2025-03-21T11:16:58Z

What type of PR is this?

This is a feature because it adds the following functionality: Agent certificate generation via CA service

What does this do?

If agent is provided with CA service URL via env variables, it will generate a CSR which will be passed to CA service for certificate generation.

Which issue(s) does this PR fix/relate to?

Related Issue Feature: Sign the Agent TLS certificate with the CA of the CSP #397

Have you included tests for your changes?

No.

Did you document any new/modified feature?

Yes

Notes

…o issue-397

SammyOina · 2025-03-21T11:29:03Z

agent/README.md

+| AGENT_CVM_GRPC_SERVER_KEY      | Path to gRPC server key in pem format                                      | ""                             |
+| AGENT_CVM_GRPC_SERVER_CA_CERTS | Path to gRPC server CA certificate                                         | ""                             |
+| AGENT_CVM_GRPC_CLIENT_CA_CERTS | Path to gRPC client CA certificate                                         | ""                             |
+| AGENT_CA_URL                   | URL for CA service, if provided it will be used for certificate generation | ""                             |


make this env configurable through manager

cocos/manager/service.go

Line 408 in ebe1196

func tmpEnvironment(id string, req *CreateReq) (string, error) {

SammyOina · 2025-03-21T11:30:01Z

agent/README.md

+| AGENT_CVM_GRPC_SERVER_KEY      | Path to gRPC server key in pem format                                      | ""                             |
+| AGENT_CVM_GRPC_SERVER_CA_CERTS | Path to gRPC server CA certificate                                         | ""                             |
+| AGENT_CVM_GRPC_CLIENT_CA_CERTS | Path to gRPC client CA certificate                                         | ""                             |
+| AGENT_CA_URL                   | URL for CA service, if provided it will be used for certificate generation | ""                             |


make this env configurable through manager

cocos/manager/service.go

Line 408 in ebe1196

func tmpEnvironment(id string, req *CreateReq) (string, error) {

SammyOina

you also need to set this variable from cli here

cocos/cli/manager.go

Line 67 in ebe1196

cmd.Flags().StringVar(&agentLogLevel, logLevel, "", "Agent Log level")

SammyOina · 2025-03-21T12:40:52Z

cmd/agent/main.go

+	LogLevel    string `env:"AGENT_LOG_LEVEL" envDefault:"debug"`
+	Vmpl        int    `env:"AGENT_VMPL" envDefault:"2"`
+	CAUrl       string `env:"AGENT_CVM_CA_URL" envDefault:""`
+	CVMEntityId string `env:"AGENT_CVM_ENTITY_ID" envDefault:""`


we can simplify to AGENT_CVM_ID

…o issue-397

SammyOina · 2025-03-25T10:44:29Z

internal/server/grpc/grpc.go

-		Subject: pkix.Name{
+	var certDERBytes []byte
+
+	if caUrl == "" || cvmId == "" {


currently for client (cli) we disable tls verification when atls is enabled since cert is generated by agent. However with this change we can allow provision of ca cert to cli and in this case we don't have to skip tls verification. so enable tls verification for atls when ca is provided and load the ca cert on client ca pool

cocos/pkg/clients/grpc/atls.go

Line 30 in ebe1196

InsecureSkipVerify: true,

dborovcanin · 2025-03-26T14:46:09Z

@jovan-djukic Please rebase and address remarks.

…o issue-397

SammyOina · 2025-03-28T11:35:14Z

agent/README.md

+| AGENT_CVM_GRPC_SERVER_KEY      | Path to gRPC server key in pem format                                      | ""                             |
+| AGENT_CVM_GRPC_SERVER_CA_CERTS | Path to gRPC server CA certificate                                         | ""                             |
+| AGENT_CVM_GRPC_CLIENT_CA_CERTS | Path to gRPC client CA certificate                                         | ""                             |
+| AGENT_CVM_CA_URL               | URL for CA service, if provided it will be used for certificate generation | ""                             |


only for atls at the moment

SammyOina · 2025-03-28T11:39:52Z

test/cvms/main.go

 	}

-	gs := grpcserver.New(ctx, cancel, svcName, grpcServerConfig, registerAgentServiceServer, logger, nil, nil)
+	gs := grpcserver.New(ctx, cancel, svcName, grpcServerConfig, registerAgentServiceServer, logger, nil, nil, "", "")


read the values from args, so we can test from using this tool as well

codecov · 2025-03-28T13:13:13Z

Codecov Report

Attention: Patch coverage is 29.72973% with 104 lines in your changes missing coverage. Please review.

Project coverage is 54.17%. Comparing base (ebe1196) to head (ed5ffe6).

Files with missing lines	Patch %	Lines
internal/server/grpc/grpc.go	25.45%	81 Missing and 1 partial ⚠️
pkg/clients/grpc/atls.go	46.66%	12 Missing and 4 partials ⚠️
agent/cvms/server/cvm.go	0.00%	4 Missing ⚠️
cli/manager.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #410      +/-   ##
==========================================
- Coverage   55.14%   54.17%   -0.97%     
==========================================
  Files          60       60              
  Lines        5239     5364     +125     
==========================================
+ Hits         2889     2906      +17     
- Misses       2047     2151     +104     
- Partials      303      307       +4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…travioletrs#411) * Add vtpm attestation support to agent service and server Signed-off-by: Sammy Oina <sammyoina@gmail.com> * Update mockery version to v2.53.2 and refactor VM factory to include logger Signed-off-by: Sammy Oina <sammyoina@gmail.com> * Send event notification when computation is stopped in agentService Signed-off-by: Sammy Oina <sammyoina@gmail.com> * Remove redundant assignment of Stderr in qemuVM Start method Signed-off-by: Sammy Oina <sammyoina@gmail.com> * Rename SVM references to CVM in tracing, logging, metrics, and service layers Signed-off-by: Sammy Oina <sammyoina@gmail.com> --------- Signed-off-by: Sammy Oina <sammyoina@gmail.com>

Bumps [github.com/docker/docker](https://github.com/docker/docker) from 28.0.1+incompatible to 28.0.4+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](moby/moby@v28.0.1...v28.0.4) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

) Bumps google.golang.org/protobuf from 1.36.5 to 1.36.6. --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ultravioletrs#396) * Disable SSH service and update user shell in cloud config Signed-off-by: Sammy Oina <sammyoina@gmail.com> * Remove SSH server and clean up dependencies in cloud config Signed-off-by: Sammy Oina <sammyoina@gmail.com> * Add firewall configuration and ensure iptables rules persist after reboot Signed-off-by: Sammy Oina <sammyoina@gmail.com> * Add algo_user configuration and setup script for container execution Signed-off-by: Sammy Oina <sammyoina@gmail.com> --------- Signed-off-by: Sammy Oina <sammyoina@gmail.com>

…o issue-397

jovan-djukic added 7 commits March 17, 2025 13:21

Initial commit, will be tested before creating a PR

ae0b5c4

Initial commit, will be tested before creating a PR

b85c65f

Fixed all issues

96710bb

Merge branch 'issue-397' of https://github.com/jovan-djukic/cocos int…

ca6b4d0

…o issue-397

Initial commit, will be tested before creating a PR

5b06f34

Merge branch 'issue-397' of https://github.com/jovan-djukic/cocos int…

9139a18

…o issue-397

Updated agent docs

cd6e395

SammyOina requested changes Mar 21, 2025

View reviewed changes

Fixed based on comments

2b5a2e5

SammyOina requested changes Mar 21, 2025

View reviewed changes

jovan-djukic added 6 commits March 21, 2025 12:46

Fixed based on comments

51cffed

Initial commit, will be tested before creating a PR

e71ca2b

Updated agent docs

bc2187f

Fixed based on comments

93daaac

Fixed based on comments

a44343f

Merge branch 'issue-397' of https://github.com/jovan-djukic/cocos int…

4b5aa2b

…o issue-397

SammyOina requested changes Mar 25, 2025

View reviewed changes

added certificate verification

a0989c4

jovan-djukic added 10 commits March 26, 2025 14:46

Initial commit, will be tested before creating a PR

981b401

Fixed all issues

ef3c20d

Initial commit, will be tested before creating a PR

763b3e5

Initial commit, will be tested before creating a PR

0be45da

Updated agent docs

a53b998

Fixed based on comments

2d88bf6

Fixed based on comments

4a7a0fa

added certificate verification

a779e15

Merge branch 'issue-397' of https://github.com/jovan-djukic/cocos int…

87b9abf

…o issue-397

Fixed rebase errors

ba84ef6

Fixed format error

f229567

SammyOina reviewed Mar 28, 2025

View reviewed changes

SammyOina requested changes Mar 28, 2025

View reviewed changes

Fixed based on comments

ed5ffe6

SammyOina approved these changes Mar 28, 2025

View reviewed changes

SammyOina and others added 21 commits April 1, 2025 21:59

Initial commit, will be tested before creating a PR

0e21ba3

Fixed all issues

af72f50

Initial commit, will be tested before creating a PR

b8ae1aa

Initial commit, will be tested before creating a PR

3f42602

Fixed based on comments

0cffb65

Fixed based on comments

e6e715d

added certificate verification

36a32e1

Initial commit, will be tested before creating a PR

d09d5bc

Fixed all issues

47cb6be

Initial commit, will be tested before creating a PR

46c4479

Initial commit, will be tested before creating a PR

ad92e2f

Fixed based on comments

1f15a65

Fixed rebase errors

fe6424f

Fixed format error

0a38017

Fixed based on comments

d767199

Merge branch 'issue-397' of https://github.com/jovan-djukic/cocos int…

2b65e73

…o issue-397

Fixed rebase errors

7bbe98c

dborovcanin approved these changes Apr 2, 2025

View reviewed changes

dborovcanin merged commit ec306c7 into ultravioletrs:main Apr 2, 2025
1 of 3 checks passed

dborovcanin mentioned this pull request Apr 9, 2025

Feature: Sign the Agent TLS certificate with the CA of the CSP #397

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

COCOS - 397 - Agent certificate generation via CA service #410

COCOS - 397 - Agent certificate generation via CA service #410

Uh oh!

jovan-djukic commented Mar 21, 2025

Uh oh!

SammyOina Mar 21, 2025

Uh oh!

SammyOina Mar 21, 2025

Uh oh!

SammyOina left a comment

Uh oh!

SammyOina Mar 21, 2025

Uh oh!

SammyOina Mar 25, 2025

Uh oh!

dborovcanin commented Mar 26, 2025

Uh oh!

SammyOina Mar 28, 2025

Uh oh!

SammyOina Mar 28, 2025

Uh oh!

codecov bot commented Mar 28, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

COCOS - 397 - Agent certificate generation via CA service #410

COCOS - 397 - Agent certificate generation via CA service #410

Uh oh!

Conversation

jovan-djukic commented Mar 21, 2025

What type of PR is this?

What does this do?

Which issue(s) does this PR fix/relate to?

Have you included tests for your changes?

Did you document any new/modified feature?

Notes

Uh oh!

SammyOina Mar 21, 2025

Choose a reason for hiding this comment

Uh oh!

SammyOina Mar 21, 2025

Choose a reason for hiding this comment

Uh oh!

SammyOina left a comment

Choose a reason for hiding this comment

Uh oh!

SammyOina Mar 21, 2025

Choose a reason for hiding this comment

Uh oh!

SammyOina Mar 25, 2025

Choose a reason for hiding this comment

Uh oh!

dborovcanin commented Mar 26, 2025

Uh oh!

SammyOina Mar 28, 2025

Choose a reason for hiding this comment

Uh oh!

SammyOina Mar 28, 2025

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Mar 28, 2025

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants