Skip to content
This repository was archived by the owner on Nov 8, 2022. It is now read-only.

Commit ce1976a

Browse files
committed
incorporated code review feedback
1 parent 02460d1 commit ce1976a

1 file changed

Lines changed: 23 additions & 51 deletions

File tree

README.md

Lines changed: 23 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -305,93 +305,65 @@ $ snaptel -p task create -t mock-file.yml
305305
### Secure GRPC plugins
306306
Snap supports TLS for GRPC plugins. Referring to [secure plugin communication](https://github.com/intelsdi-x/snap/blob/master/docs/SECURE_PLUGIN_COMMUNICATION.md) for details. How to setup TLS on both server and client? The [Setup TLS Certificates](https://github.com/intelsdi-x/snap/blob/master/docs/SETUP_TLS_CERTIFICATES.md) has everything.
307307
308-
#### Sample Use Cases
308+
#### Examples
309309
310-
Here is a list of good and bad command use cases.
310+
##### Definition of flags
311311
312312
| Flag | Description |
313313
| ------ | ------ |
314-
| tls-cert | TLS client certificate |
315-
| tls-key | TLS client private key |
316-
| ca-cert-paths | TLS client CA certificates |
317314
| plugin-cert | TLS server certificate |
318315
| plugin-key | TLS server private key |
319316
| plugin-ca-certs | TLS server CA certificates |
320317
321-
##### Case 1: Start `snapteld` with TLS certs
318+
##### Starting `snapteld`
322319
323320
Snap is a client for all GRPC plugins. Note that Snap loads CA certificates from your OS certificate trust store if it's not specified.
324321
325322
```sh
326323
$snapteld -t 0 -l 1 --tls-cert snaptest-cli.crt --tls-key snaptest-cli.key --ca-cert-paths snaptest-ca.crt
327324
```
328-
##### Case 1: Run `snaptel`
325+
326+
##### Running `snaptel`
329327
330328
```sh
331-
▶ snaptel plugin load --plugin-cert snaptest-srv.crt --plugin-key snaptest-srv.key --plugin-ca-certs snaptest-ca.crt ../snap-plugin-lib-go/rand-collector
332-
Error: Both plugin certification and key are mandatory. The request has to use HTTPS
333-
Usage: load <plugin_path> [--plugin-cert=<plugin_cert_path> --plugin-key=<plugin_key_path> --plugin-ca-certs=<ca_cert_paths>]
329+
▶ snaptel plugin load --plugin-cert=snaptest-srv.crt --plugin-key=snaptest-srv.key --plugin-ca-certs=snaptest-ca.crt ../snap-plugin-lib-go/rand-collector
330+
Plugin loaded
331+
Name: test-rand-collector
332+
Version: 1
333+
Type: collector
334+
Signed: false
335+
Loaded Time: Mon, 14 Aug 2017 22:25:16 PDT
334336
```
335337
336-
> :collision: Urgh! Loading a secured GRPC plugin has to use HTTPS
338+
##### Error One
337339
338340
```sh
339-
▶ snaptel --url https://localhost:8181 plugin load --plugin-cert snaptest-srv.crt --plugin-key snaptest-srv.key --plugin-ca-certs snaptest-ca.crt ../snap-plugin-lib-go/rand-collector
340-
Error: Error: Post https://localhost:8181/v2/plugins: http: server gave HTTP response to HTTPS client
341+
▶ snaptel plugin load --plugin-cert=snaptest-srv.crt --plugin-ca-certs=snaptest-ca.crt ../snap-plugin-lib-go/rand-collector
342+
Error: Both plugin certification and key are mandatory.
341343
Usage: load <plugin_path> [--plugin-cert=<plugin_cert_path> --plugin-key=<plugin_key_path> --plugin-ca-certs=<ca_cert_paths>]
342344
```
343345
344-
> :collision: Urgh! The server was not started using HTTPs
346+
> What happened: Both `plugin-cert` and `plugin-key` are mandatory.
345347
346-
##### Case 2: Start `snapteld` with TLS certs and HTTPS
347348
348-
Snap only requires the verificate of HTTPS's server certificate.
349+
##### Error Two
349350
350351
```sh
351-
▶ snapteld -t 0 -l 1 --rest-https --rest-cert snaphttps-srv.crt --rest-key snaphttps-srv.key --tls-cert snaptest-cli.crt --tls-key snaptest-cli.key --ca-cert-paths snaptest-ca.crt
352-
```
353-
354-
> :white_check_mark: using this setting to start `snapteld` for a seured GRPC plugin communication.
355-
356-
##### Case 2: Run `snaptel`
357-
358-
```sh
359-
▶ snaptel --url https://localhost:8181 plugin load --plugin-cert snaptest-srv.crt --plugin-key snaptest-srv.key --plugin-ca-certs snaptest-ca.crt ../snap-plugin-lib-go/rand-collector
360-
Error: Error: Post https://localhost:8181/v2/plugins: x509: certificate signed by unknown authority
352+
▶ snaptel plugin load --plugin-cert=snaptest-srv.crt --plugin-key=snaptest-srv.key --plugin-ca-certs=snaptest-ca.crt ../snap-plugin-lib-go/rand-collector
353+
Error: rpc error: code = Internal desc = connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority"
361354
Usage: load <plugin_path> [--plugin-cert=<plugin_cert_path> --plugin-key=<plugin_key_path> --plugin-ca-certs=<ca_cert_paths>]
362-
```
363355
364-
> :collision: Urgh! HTTPS does not have a trusted CA. There is no way to specify a CA using a flag for HTTPS currently. Putting the trusted CA in your OS trust store in production. Using --insecure flag for your testing convenience.
365-
366-
```sh
367-
▶ snaptel --url https://localhost:8181 --insecure plugin load --plugin-cert snaptest-srv.crt --plugin-key snaptest-srv.key --plugin-ca-certs snaptest-ca.crt ../snap-plugin-lib-go/rand-collector
368-
Plugin loaded
369-
Name: test-rand-collector
370-
Version: 1
371-
Type: collector
372-
Signed: false
373-
Loaded Time: Wed, 02 Aug 2017 15:23:09 PDT
374-
```
375-
376-
>:white_check_mark: The secured GRPC plugin loaded! You may omit the `plugin-ca-certs` flag if it's in the trust store of your OS/App.
377-
378-
Only loading a GRPC plugin requires TLS certs. Not any other commands.
379-
380-
```sh
381-
▶ snaptel --url https://localhost:8181 --insecure plugin list
382-
NAME VERSION TYPE SIGNED STATUS LOADED TIME
383-
test-rand-collector 1 collector false loaded Wed, 02 Aug 2017 15:23:09 PDT
384356
```
385357
386-
##### Case 3: Caveat
358+
> What happened: Did you start `snapteld` with CA cert or put the trusted CA in your OS/APP trust store?
387359
388-
Starting `snapteld` same as case 2. Loading a non GRPC plugin.
360+
##### Error Three
389361
390362
```sh
391-
▶ snaptel --url https://localhost:8181 --insecure plugin load --plugin-cert snaptest-srv.crt --plugin-key snaptest-srv.key --plugin-ca-certs snaptest-ca.crt ../snap/build/darwin/x86_64/plugins/snap-plugin-collector-mock1
363+
▶ snaptel plugin load --plugin-cert snaptest-srv.crt --plugin-key snaptest-srv.key --plugin-ca-certs snaptest-ca.crt ../snap/snap-plugin-collector-mock1
392364
Error: secure framework can't connect to insecure plugin; plugin_name: mock
393365
Usage: load <plugin_path> [--plugin-cert=<plugin_cert_path> --plugin-key=<plugin_key_path> --plugin-ca-certs=<ca_cert_paths>]
394366
```
395367
396-
>:collision: Urgh! Currently, no TLS is available for non-grpc plugins. Restarting `snapteld` without TLS to load non-grpc plugins.
368+
>What happened: The TLS is only supported for GRPC plugins. Restarting `snapteld` without TLS to load non-GRPC plugins.
397369

0 commit comments

Comments
 (0)