Skip to content
This repository was archived by the owner on Sep 12, 2024. It is now read-only.

TLS support for docker endpoint#42

Open
kasra73 wants to merge 7 commits intotsuru:masterfrom
kasra73:master
Open

TLS support for docker endpoint#42
kasra73 wants to merge 7 commits intotsuru:masterfrom
kasra73:master

Conversation

@kasra73
Copy link

@kasra73 kasra73 commented Mar 5, 2020

What's the problem?

In order to prevent apps and other containers from unwanted access to docker endpoint, we can configure self-signed SSL for docker daemon. Tsuru support this feature in tsuru node-add command using cert flags. but this causes a connection problem when big-sibling try to get logs and containers info from the endpoint. After some digging we can find out docker.NewClient is not the function to be used for tls connection and docker.NewTLSClient should be used instead:
docker.NewTLSClient(endpoint, cert, key, ca)
reference: https://github.com/fsouza/go-dockerclient#using-with-tls

How to fix it?

I changed config to get tls support parameters in addition to docker endpoint. So the struct DockerConfig has been created for this purpose. Then we can use a volume for cert, key and ca files which will be available in /docker-certs path inside the container. If files doesn't exists, bs will simply ignore tls support.

How to use this feature?

First your node address must begin with https: and of course it will if you want to use tls connection. Then you should update bs service by tsuru command and attach cert files directory to your bs container as a volume:
tsuru node-container-update big-sibling -v /home/user/.docker:/docker-certs -v /proc:/prochost
Note that /proc:/prochost is required because using -v command will override volume config.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant