Skip to content

Commit f00b2a8

Browse files
peterSirotnakpeterSirotnak
authored
PMM-14643: Add support for encrypted PMM Client config (#196)
* PMM-14643: Skeleton of encrypted pmm client config * PMM-14643: Fix argument formatting in setup_ps function and add debug print statement * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file * PMM-14643: Skeleton for encrypted pmm client config file
1 parent d5f73ab commit f00b2a8

File tree

9 files changed

+77
-15
lines changed

9 files changed

+77
-15
lines changed

‎pmm_qa/mysql/mysql-setup.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
random_service_name_value: ""
2626
my_rocks: "{{ lookup('env', 'MY_ROCKS') | default(false, true) }}"
2727
container_prefix: "mysql_pmm{{ (setup_type|default('')) and '_' ~ setup_type }}_{{ mysql_version }}_"
28+
encrypted_client_config: "{{ lookup('env', 'ENCRYPTED_CLIENT_CONFIG') | default(false, true) | bool }}"
2829

2930
tasks:
3031
- name: Modify the node count for group replication

‎pmm_qa/percona-distribution-postgresql/percona-distribution-postgres-setup.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
docker_repo: "percona/percona-distribution-postgresql"
2424
container_prefix: "pdpgsql_pmm{{ (setup_type|default('')) and '_' ~ setup_type }}_{{ pdpgsql_version }}_"
2525
pgsm_branch: "{{ lookup('env', 'PGSM_BRANCH') }}"
26+
encrypted_client_config: "{{ lookup('env', 'ENCRYPTED_CLIENT_CONFIG') | default(false, true) | bool }}"
2627

2728
tasks:
2829
- name: Display setup type selected

‎pmm_qa/percona_server_for_mysql/percona-server-setup.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
random_service_name_value: ""
2626
my_rocks: "{{ lookup('env', 'MY_ROCKS') | default(false, true) }}"
2727
container_prefix: "ps_pmm{{ (setup_type|default('')) and '_' ~ setup_type }}_{{ ps_version }}_"
28+
encrypted_client_config: "{{ lookup('env', 'ENCRYPTED_CLIENT_CONFIG') | default(false, true) | bool }}"
2829

2930
tasks:
3031
- name: Modify the node count for group replication

‎pmm_qa/pmm-framework.py‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ def setup_ps(db_type, db_version=None, db_config=None, args=None):
7676
'CLIENT_VERSION': get_value('CLIENT_VERSION', db_type, args, db_config),
7777
'ADMIN_PASSWORD': os.getenv('ADMIN_PASSWORD') or args.pmm_server_password or 'admin',
7878
'MY_ROCKS': get_value('MY_ROCKS', db_type, args, db_config),
79+
'ENCRYPTED_CLIENT_CONFIG': get_value('ENCRYPTED_CLIENT_CONFIG', db_type, args, db_config),
7980
}
8081

8182
run_ansible_playbook('percona_server_for_mysql/percona-server-setup.yml', env_vars, args)
@@ -113,7 +114,8 @@ def setup_mysql(db_type, db_version=None, db_config=None, args=None):
113114
'QUERY_SOURCE': get_value('QUERY_SOURCE', db_type, args, db_config),
114115
'MS_TARBALL': get_value('TARBALL', db_type, args, db_config),
115116
'ADMIN_PASSWORD': os.getenv('ADMIN_PASSWORD') or args.pmm_server_password or 'admin',
116-
'PMM_QA_GIT_BRANCH': os.getenv('PMM_QA_GIT_BRANCH') or 'v3'
117+
'PMM_QA_GIT_BRANCH': os.getenv('PMM_QA_GIT_BRANCH') or 'v3',
118+
'ENCRYPTED_CLIENT_CONFIG': get_value('ENCRYPTED_CLIENT_CONFIG', db_type, args, db_config),
117119
}
118120

119121
run_ansible_playbook('mysql/mysql-setup.yml', env_vars, args)
@@ -174,7 +176,8 @@ def setup_pdpgsql(db_type, db_version=None, db_config=None, args=None):
174176
'DISTRIBUTION': '',
175177
'PMM_QA_GIT_BRANCH': os.getenv('PMM_QA_GIT_BRANCH') or 'v3',
176178
'SETUP_TYPE': setup_type_value,
177-
'PGSM_BRANCH': pgsm_branch
179+
'PGSM_BRANCH': pgsm_branch,
180+
'ENCRYPTED_CLIENT_CONFIG': get_value('ENCRYPTED_CLIENT_CONFIG', db_type, args, db_config),
178181
}
179182

180183
# Ansible playbook filename
@@ -237,7 +240,8 @@ def setup_pgsql(db_type, db_version=None, db_config=None, args=None):
237240
'ADMIN_PASSWORD': os.getenv('ADMIN_PASSWORD') or args.pmm_server_password or 'admin',
238241
'PGSQL_PGSS_PORT': 5448,
239242
'PMM_QA_GIT_BRANCH': os.getenv('PMM_QA_GIT_BRANCH') or 'v3',
240-
'SETUP_TYPE': setup_type_value
243+
'SETUP_TYPE': setup_type_value,
244+
'ENCRYPTED_CLIENT_CONFIG': get_value('ENCRYPTED_CLIENT_CONFIG', db_type, args, db_config),
241245
}
242246

243247
# Ansible playbook filename
@@ -764,7 +768,8 @@ def setup_valkey(db_type, db_version=None, db_config=None, args=None):
764768
'CLIENT_VERSION': get_value('CLIENT_VERSION', db_type, args, db_config),
765769
'ADMIN_PASSWORD': os.getenv('ADMIN_PASSWORD') or args.pmm_server_password or 'admin',
766770
'PMM_QA_GIT_BRANCH': os.getenv('PMM_QA_GIT_BRANCH') or 'v3',
767-
'SETUP_TYPE': setup_type_value
771+
'SETUP_TYPE': setup_type_value,
772+
'ENCRYPTED_CLIENT_CONFIG': get_value('ENCRYPTED_CLIENT_CONFIG', db_type, args, db_config),
768773
}
769774

770775
# Choose playbook based on SETUP_TYPE (cluster is default; sentinel only when explicitly requested)

‎pmm_qa/postgresql/postgresql-setup.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
metrics_mode: "auto"
2121
setup_type: "{{ lookup('env', 'SETUP_TYPE') }}"
2222
random_service_name_value: ""
23+
encrypted_client_config: "{{ lookup('env', 'ENCRYPTED_CLIENT_CONFIG') | default(false, true) | bool }}"
2324

2425
tasks:
2526
- name: Create Docker network

‎pmm_qa/scripts/database_options.py‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,12 @@
2525
"MYSQL": {
2626
"versions": ["5.7", "8.0", "8.4"],
2727
"configurations": {"QUERY_SOURCE": "perfschema", "SETUP_TYPE": "", "CLIENT_VERSION": "3-dev-latest",
28-
"TARBALL": ""}
28+
"TARBALL": "", "ENCRYPTED_CLIENT_CONFIG": "false"}
2929
},
3030
"PS": {
3131
"versions": ["5.7", "8.4", "8.0"],
3232
"configurations": {"QUERY_SOURCE": "perfschema", "SETUP_TYPE": "", "CLIENT_VERSION": "3-dev-latest",
33-
"TARBALL": "", "NODES_COUNT": 1, "MY_ROCKS": "false"}
33+
"TARBALL": "", "NODES_COUNT": 1, "MY_ROCKS": "false", "ENCRYPTED_CLIENT_CONFIG": "false"}
3434
},
3535
"SSL_MYSQL": {
3636
"versions": ["5.7", "8.4", "8.0"],
@@ -40,11 +40,12 @@
4040
"PGSQL": {
4141
"versions": ["11", "12", "13", "14", "15", "16", "18", "17"],
4242
"configurations": {"QUERY_SOURCE": "pgstatements", "CLIENT_VERSION": "3-dev-latest", "USE_SOCKET": "",
43-
"SETUP_TYPE": ""}
43+
"SETUP_TYPE": "", "ENCRYPTED_CLIENT_CONFIG": "false"}
4444
},
4545
"PDPGSQL": {
4646
"versions": ["11", "12", "13", "14", "15", "16", "18", "17"],
47-
"configurations": {"CLIENT_VERSION": "3-dev-latest", "USE_SOCKET": "", "SETUP_TYPE": "", "PGSM_BRANCH": ""}
47+
"configurations": {"CLIENT_VERSION": "3-dev-latest", "USE_SOCKET": "", "SETUP_TYPE": "", "PGSM_BRANCH": "",
48+
"ENCRYPTED_CLIENT_CONFIG": "false"}
4849
},
4950
"SSL_PDPGSQL": {
5051
"versions": ["11", "12", "13", "14", "15", "16", "17"],
@@ -79,6 +80,6 @@
7980
},
8081
"VALKEY": {
8182
"versions": ["7", "8"],
82-
"configurations": {"CLIENT_VERSION": "3-dev-latest", "SETUP_TYPE": "", "TARBALL": ""}
83+
"configurations": {"CLIENT_VERSION": "3-dev-latest", "SETUP_TYPE": "", "TARBALL": "", "ENCRYPTED_CLIENT_CONFIG": "false"}
8384
}
8485
}

‎pmm_qa/tasks/install_pmm_client.yml‎

Lines changed: 56 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,12 @@
147147
when:
148148
- client_version | regex_search('^https?://.*\\.tar\\.gz$') is not none
149149

150-
- name: Connect pmm client to pmm server using metrics mode
150+
- name: Generate keys for encrypted client config
151+
shell: |
152+
docker exec --user root {{ container_name }} openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -aes256 -pass pass:testpass -out "/usr/local/percona/pmm/config/pmm-key.pem"
153+
when: encrypted_client_config | default(false) | bool
154+
155+
- name: Connect pmm client to pmm server using metrics mode without encrypted client config
151156
shell: |
152157
docker exec --user root {{ container_name }} \
153158
pmm-agent setup \
@@ -158,28 +163,74 @@
158163
--server-username=admin \
159164
--server-password={{ admin_password }} \
160165
{{ container_name }}
161-
when: metrics_mode | length > 0
166+
when:
167+
- metrics_mode | length > 0
168+
- not (encrypted_client_config | default(false) | bool)
169+
170+
- name: Connect pmm client to pmm server using default metrics mode without encrypted client config
171+
shell: |
172+
docker exec --user root {{ container_name }} \
173+
pmm-agent setup \
174+
--config-file=/usr/local/percona/pmm/config/pmm-agent.yaml \
175+
--server-address={{ pmm_server_ip }}:{{ pmm_server_port }} \
176+
--server-insecure-tls \
177+
--server-username=admin \
178+
--server-password={{ admin_password }} \
179+
{{ container_name }}
180+
when:
181+
- metrics_mode | length == 0
182+
- not (encrypted_client_config | default(false) | bool)
183+
184+
- name: Connect pmm client to pmm server using default metrics mode with encrypted client config
185+
shell: |
186+
docker exec --user root {{ container_name }} \
187+
pmm-agent setup \
188+
--config-file=/usr/local/percona/pmm/config/pmm-agent.yaml \
189+
--server-address={{ pmm_server_ip }}:{{ pmm_server_port }} \
190+
--custom-labels="role=pmm-client, encrypted=true, password=true" \
191+
--server-insecure-tls \
192+
--server-username=admin \
193+
--server-password={{ admin_password }} \
194+
--config-file-key-file="/usr/local/percona/pmm/config/pmm-key.pem" \
195+
--config-file-key-password="testpass" \
196+
{{ container_name }}
197+
when:
198+
- metrics_mode | length == 0
199+
- encrypted_client_config | default(false) | bool
162200

163-
- name: Connect pmm client to pmm server using default metrics mode
201+
- name: Connect pmm client to pmm server using metrics mode with encrypted client config
164202
shell: |
165203
docker exec --user root {{ container_name }} \
166204
pmm-agent setup \
167205
--config-file=/usr/local/percona/pmm/config/pmm-agent.yaml \
168206
--server-address={{ pmm_server_ip }}:{{ pmm_server_port }} \
207+
--custom-labels="role=pmm-client, encrypted=true, password=true" \
169208
--server-insecure-tls \
209+
--metrics-mode={{ metrics_mode }} \
170210
--server-username=admin \
171211
--server-password={{ admin_password }} \
212+
--config-file-key-file="/usr/local/percona/pmm/config/pmm-key.pem" \
213+
--config-file-key-password="testpass" \
172214
{{ container_name }}
173-
when: metrics_mode | length == 0
215+
when:
216+
- metrics_mode | length > 0
217+
- encrypted_client_config | default(false) | bool
174218

175219
- name: Wait 5 seconds for connection to complete
176220
pause:
177221
seconds: 5
178222

179-
- name: Start pmm client
223+
- name: Start pmm client without encrypted client config
180224
shell: |
181225
docker exec --user root {{ container_name }} \
182226
sh -c 'nohup pmm-agent --config-file=/usr/local/percona/pmm/config/pmm-agent.yaml > /var/log/pmm-agent.log 2>&1 &'
227+
when: not (encrypted_client_config | default(false) | bool)
228+
229+
- name: Start pmm client with encrypted client config
230+
shell: |
231+
docker exec --user root {{ container_name }} \
232+
sh -c 'nohup pmm-agent --config-file=/usr/local/percona/pmm/config/pmm-agent.yaml --config-file-key-file="/usr/local/percona/pmm/config/pmm-key.pem" --config-file-key-password="testpass" > /var/log/pmm-agent.log 2>&1 &'
233+
when: encrypted_client_config | default(false) | bool
183234

184235
- name: Wait 5 seconds for start to complete
185236
pause:

‎pmm_qa/valkey/valkey-cluster.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
valkey_primary_prefix: "valkey-primary-"
2020
valkey_replica_prefix: "valkey-replica-"
2121
pmm_server_name: "pmm-server"
22+
encrypted_client_config: "{{ lookup('env', 'ENCRYPTED_CLIENT_CONFIG') | default(false, true) | bool }}"
2223

2324
tasks:
2425
- name: Set Random Number Fact

‎pmm_qa/valkey/valkey-sentinel.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
sentinel_count: 3
2020
sentinel_start_port: 26379
2121
sentinel_quorum: 2
22-
22+
encrypted_client_config: "{{ lookup('env', 'ENCRYPTED_CLIENT_CONFIG') | default(false, true) | bool }}"
2323
pmm_server_name: "pmm-server"
2424

2525
tasks:

0 commit comments

Comments
 (0)