TLS support for docker endpoint

config/config.go

@@ -21,8 +21,17 @@ const (
 	DefaultDockerEndpoint = "unix:///var/run/docker.sock"
 )
 
+// DockerConfig is container for Endpoint and tls config
+type DockerConfig struct {
+	Endpoint string
+	UseTLS   bool
+	CertFile string
+	KeyFile  string
+	CaFile   string
+}
+
 var Config struct {
-	DockerEndpoint      string
+	DockerClientInfo    *DockerConfig
 	TsuruEndpoint       string
 	TsuruToken          string
 	MetricsInterval     time.Duration
@@ -42,7 +51,8 @@ func init() {
 
 func LoadConfig() {
 	bslog.Debug, _ = strconv.ParseBool(os.Getenv("BS_DEBUG"))
-	Config.DockerEndpoint = StringEnvOrDefault(DefaultDockerEndpoint, "DOCKER_ENDPOINT")
+	var dockerEndpoint = StringEnvOrDefault(DefaultDockerEndpoint, "DOCKER_ENDPOINT")
+	Config.DockerClientInfo = loadDockerConfig(dockerEndpoint)
 	Config.TsuruEndpoint = os.Getenv("TSURU_ENDPOINT")
 	Config.TsuruToken = os.Getenv("TSURU_TOKEN")
 	Config.SyslogListenAddress = os.Getenv("SYSLOG_LISTEN_ADDRESS")
@@ -56,6 +66,25 @@ func LoadConfig() {
 	Config.MetricsEnableHost = BoolEnvOrDefault(true, "METRICS_ENABLE_HOST")
 }
 
+func loadDockerConfig(dockerEndpoint string) *DockerConfig {
+	var config = &DockerConfig{
+		Endpoint: dockerEndpoint,
+		UseTLS:   false,
+		CertFile: "/docker-certs/cert.pem",
+		KeyFile:  "/docker-certs/key.pem",
+		CaFile:   "/docker-certs/ca.pem",
+	}
+	if strings.HasPrefix(dockerEndpoint, "https:") {
+		if fileAvailable(config.CertFile) && fileAvailable(config.KeyFile) && fileAvailable(config.CaFile) {
+			bslog.Debugf("Docker cert files found. Configuring TLS support.")
+			config.UseTLS = true
+		} else {
+			bslog.Warnf("A valid certificate is required for using https schema without cert files.")
+		}
+	}
+	return config
+}
+
 func envOrDefault(convert func(string) interface{}, defaultValue interface{}, envs ...string) interface{} {
 	for i, env := range envs {
 		val := os.Getenv(env)
@@ -128,3 +157,10 @@ func SecondsEnvOrDefault(defaultValue float64, envs ...string) time.Duration {
 		return val
 	}, defaultValue, envs...).(float64) * float64(time.Second))
 }
+
+func fileAvailable(name string) bool {
+	if _, err := os.Stat(name); err == nil {
+		return true
+	}
+	return false
+}

config/config_test.go

@@ -31,7 +31,13 @@ func (S) TestLoadConfig(c *check.C) {
 	os.Setenv("SYSLOG_LISTEN_ADDRESS", "udp://0.0.0.0:1514")
 	os.Setenv("LOG_BACKENDS", "b1, b2 ")
 	LoadConfig()
-	c.Check(Config.DockerEndpoint, check.Equals, "http://192.168.50.4:2375")
+	c.Check(Config.DockerClientInfo, check.DeepEquals, &DockerConfig{
+		Endpoint: "http://192.168.50.4:2375",
+		UseTLS:   false,
+		CertFile: "/docker-certs/cert.pem",
+		KeyFile:  "/docker-certs/key.pem",
+		CaFile:   "/docker-certs/ca.pem",
+	})
 	c.Check(Config.TsuruEndpoint, check.Equals, "http://192.168.50.4:8080")
 	c.Check(Config.TsuruToken, check.Equals, "sometoken")
 	c.Check(Config.StatusInterval, check.Equals, time.Duration(45e9))
@@ -49,7 +55,13 @@ func (S) TestLoadConfigInvalidDuration(c *check.C) {
 	os.Setenv("STATUS_INTERVAL", "four")
 	os.Setenv("HOST_PROC", "/prochost")
 	LoadConfig()
-	c.Check(Config.DockerEndpoint, check.Equals, "http://192.168.50.4:2375")
+	c.Check(Config.DockerClientInfo, check.DeepEquals, &DockerConfig{
+		Endpoint: "http://192.168.50.4:2375",
+		UseTLS:   false,
+		CertFile: "/docker-certs/cert.pem",
+		KeyFile:  "/docker-certs/key.pem",
+		CaFile:   "/docker-certs/ca.pem",
+	})
 	c.Check(Config.TsuruEndpoint, check.Equals, "http://192.168.50.4:8080")
 	c.Check(Config.TsuruToken, check.Equals, "sometoken")
 	c.Check(Config.StatusInterval, check.Equals, time.Duration(60e9))

container/container.go

@@ -11,6 +11,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/tsuru/bs/config"
+
 	docker "github.com/fsouza/go-dockerclient"
 	lru "github.com/hashicorp/golang-lru"
 	"github.com/tsuru/bs/bslog"
@@ -31,7 +33,7 @@ var (
 const containerIDTrimSize = 12
 
 type InfoClient struct {
-	endpoint       string
+	dockerInfo     *config.DockerConfig
 	client         *docker.Client
 	containerCache *lru.Cache
 
@@ -55,14 +57,19 @@ const (
 	fullTimeout = 1 * time.Minute
 )
 
-func NewClient(endpoint string) (*InfoClient, error) {
-	c := InfoClient{endpoint: endpoint}
+func NewClient(dockerInfo *config.DockerConfig) (*InfoClient, error) {
+	c := InfoClient{dockerInfo: dockerInfo}
 	var err error
 	c.containerCache, err = lru.New(100)
 	if err != nil {
 		return nil, err
 	}
-	c.client, err = docker.NewClient(endpoint)
+	if dockerInfo.UseTLS {
+		c.client, err = docker.NewTLSClient(dockerInfo.Endpoint, dockerInfo.CertFile,
+			dockerInfo.KeyFile, dockerInfo.CaFile)
+	} else {
+		c.client, err = docker.NewClient(dockerInfo.Endpoint)
+	}
 	if err != nil {
 		return nil, err
 	}

container/container_test.go

@@ -11,6 +11,7 @@ import (
 
 	docker "github.com/fsouza/go-dockerclient"
 	dTesting "github.com/fsouza/go-dockerclient/testing"
+	"github.com/tsuru/bs/config"
 	"gopkg.in/check.v1"
 )
 
@@ -22,6 +23,16 @@ func Test(t *testing.T) {
 
 type S struct{}
 
+func createDockerConfig(url string) *config.DockerConfig {
+	return &config.DockerConfig{
+		Endpoint: url,
+		UseTLS:   false,
+		CertFile: "/docker-certs/cert.pem",
+		KeyFile:  "/docker-certs/key.pem",
+		CaFile:   "/docker-certs/ca.pem",
+	}
+}
+
 func createContainer(c *check.C, url string, envs []string, labels map[string]string, name string) string {
 	dockerClient, err := docker.NewClient(url)
 	c.Assert(err, check.IsNil)
@@ -48,7 +59,8 @@ func (S) TestInfoClientGetContainer(c *check.C) {
 	})
 	c.Assert(err, check.IsNil)
 	id := createContainer(c, dockerServer.URL(), []string{"TSURU_PROCESSNAME=procx", "TSURU_APPNAME=coolappname"}, nil, "myContName")
-	client, err := NewClient(dockerServer.URL())
+	dockerConfig := createDockerConfig(dockerServer.URL())
+	client, err := NewClient(dockerConfig)
 	c.Assert(err, check.IsNil)
 	cont, err := client.GetContainer(id, true, []string{})
 	c.Assert(err, check.IsNil)
@@ -81,7 +93,8 @@ func (S) TestInfoClientGetContainerNonApp(c *check.C) {
 	})
 	c.Assert(err, check.IsNil)
 	id := createContainer(c, dockerServer.URL(), nil, nil, "myContName")
-	client, err := NewClient(dockerServer.URL())
+	dockerConfig := createDockerConfig(dockerServer.URL())
+	client, err := NewClient(dockerConfig)
 	c.Assert(err, check.IsNil)
 	cont, err := client.GetContainer(id, true, []string{})
 	c.Assert(err, check.IsNil)
@@ -100,7 +113,8 @@ func (S) TestInfoClientGetAppContainer(c *check.C) {
 	})
 	c.Assert(err, check.IsNil)
 	id := createContainer(c, dockerServer.URL(), []string{"TSURU_APPNAME=coolappname"}, nil, "myContName")
-	client, err := NewClient(dockerServer.URL())
+	dockerConfig := createDockerConfig(dockerServer.URL())
+	client, err := NewClient(dockerConfig)
 	c.Assert(err, check.IsNil)
 	cont, err := client.GetAppContainer(id, true)
 	c.Assert(err, check.IsNil)
@@ -161,7 +175,8 @@ func (S) TestInfoClientGetContainerRequiredEnv(c *check.C) {
 	dockerServer, err := dTesting.NewServer("127.0.0.1:0", nil, nil)
 	c.Assert(err, check.IsNil)
 	id := createContainer(c, dockerServer.URL(), []string{"MONITORED=1"}, nil, "myContName")
-	client, err := NewClient(dockerServer.URL())
+	dockerConfig := createDockerConfig(dockerServer.URL())
+	client, err := NewClient(dockerConfig)
 	c.Assert(err, check.IsNil)
 	_, err = client.GetContainer(id, true, []string{"NOTMONITORED"})
 	c.Assert(err, check.Equals, ErrTsuruVariablesNotFound)
@@ -173,7 +188,8 @@ func (S) TestInfoClientGetContainerRequiredEnv(c *check.C) {
 func (S) TestInfoClientGetContainerNotFound(c *check.C) {
 	dockerServer, err := dTesting.NewServer("127.0.0.1:0", nil, nil)
 	c.Assert(err, check.IsNil)
-	client, err := NewClient(dockerServer.URL())
+	dockerConfig := createDockerConfig(dockerServer.URL())
+	client, err := NewClient(dockerConfig)
 	c.Assert(err, check.IsNil)
 	_, err = client.GetContainer("xxxxxx", true, []string{"TSURU_APPNAME"})
 	c.Assert(err, check.ErrorMatches, "No such container: xxxxxx")
@@ -183,7 +199,8 @@ func (S) TestContainerHasEnvs(c *check.C) {
 	dockerServer, err := dTesting.NewServer("127.0.0.1:0", nil, nil)
 	id := createContainer(c, dockerServer.URL(), []string{"TSURU_APPNAME=coolappname"}, nil, "myContName")
 	c.Assert(err, check.IsNil)
-	client, err := NewClient(dockerServer.URL())
+	dockerConfig := createDockerConfig(dockerServer.URL())
+	client, err := NewClient(dockerConfig)
 	c.Assert(err, check.IsNil)
 	cont, err := client.GetAppContainer(id, false)
 	c.Assert(err, check.IsNil)
@@ -199,7 +216,8 @@ func (S) TestContainerIsIsolated(c *check.C) {
 	id3 := createContainer(c, dockerServer.URL(), []string{"TSURU_APPNAME=coolappname"}, map[string]string{"tsuru.io/is-isolated-run": "true"}, "withTsuruIOLabel")
 	id4 := createContainer(c, dockerServer.URL(), []string{"TSURU_APPNAME=coolappname"}, nil, "withoutLabel")
 	c.Assert(err, check.IsNil)
-	client, err := NewClient(dockerServer.URL())
+	dockerConfig := createDockerConfig(dockerServer.URL())
+	client, err := NewClient(dockerConfig)
 	c.Assert(err, check.IsNil)
 	cont1, err := client.GetAppContainer(id1, false)
 	c.Assert(err, check.IsNil)

log/log.go

@@ -36,14 +36,14 @@ var (
 type LogMessage interface{}
 
 type LogForwarder struct {
-	BindAddress     string
-	DockerEndpoint  string
-	EnabledBackends []string
-	infoClient      *container.InfoClient
-	server          *syslog.Server
-	backends        []logBackend
-	formatter       *LenientFormat
-	kubeStreamer    *kubernetesLogStreamer
+	BindAddress      string
+	DockerClientInfo *config.DockerConfig
+	EnabledBackends  []string
+	infoClient       *container.InfoClient
+	server           *syslog.Server
+	backends         []logBackend
+	formatter        *LenientFormat
+	kubeStreamer     *kubernetesLogStreamer
 }
 
 type forwarderBackend interface {
@@ -142,9 +142,9 @@ func (l *LogForwarder) Start() (err error) {
 	if len(l.backends) == 0 {
 		bslog.Warnf("no log backend enabled, discarding all received log messages.")
 	}
-	l.infoClient, err = container.NewClient(l.DockerEndpoint)
+	l.infoClient, err = container.NewClient(l.DockerClientInfo)
 	if err != nil {
-		err = fmt.Errorf("unable to initialize docker client %s: %s", l.DockerEndpoint, err)
+		err = fmt.Errorf("unable to initialize docker client %s: %s", l.DockerClientInfo.Endpoint, err)
 		return
 	}
 	l.formatter = &LenientFormat{}