[wip][do not review] auth support for dbnode

src/cluster/client/etcd/config.go

@@ -21,6 +21,7 @@
 package etcd
 
 import (
+	"fmt"
 	"os"
 	"time"
 
@@ -52,6 +53,8 @@ type ClusterConfig struct {
 	AutoSyncInterval time.Duration `yaml:"autoSyncInterval"`
 	DialTimeout      time.Duration `yaml:"dialTimeout"`
 
+	Auth *AuthConfig `yaml:"auth"`
+
 	DialOptions []grpc.DialOption `yaml:"-"` // nonserializable
 }
 
@@ -68,7 +71,6 @@ func (c ClusterConfig) NewCluster() Cluster {
 		SetDialOptions(c.DialOptions).
 		SetKeepAliveOptions(keepAliveOpts).
 		SetTLSOptions(c.TLS.newOptions())
-
 	// Autosync should *always* be on, unless the user very explicitly requests it to be off. They can do this via a
 	// negative value (in which case we can assume they know what they're doing).
 	// Therefore, only update if it's nonzero, on the assumption that zero is just the empty value.
@@ -119,6 +121,23 @@ func (c *KeepAliveConfig) NewOptions() KeepAliveOptions {
 		SetKeepAliveTimeout(c.Timeout)
 }
 
+// AuthConfig configures authentication behavior.
+type AuthConfig struct {
+	Enabled  bool   `yaml:"enabled"`
+	UserName string `yaml:"username"`
+	Password string `yaml:"password"`
+}
+
+// Validate validates the AuthConfig.
+func (a *AuthConfig) Validate() error {
+	if a.Enabled {
+		if a.UserName == "" || a.Password == "" {
+			return fmt.Errorf("credentials must be set for client's outbound")
+		}
+	}
+	return nil
+}
+
 // Configuration is for config service client.
 type Configuration struct {
 	Zone              string                 `yaml:"zone"`
@@ -129,6 +148,7 @@ type Configuration struct {
 	SDConfig          services.Configuration `yaml:"m3sd"`
 	WatchWithRevision int64                  `yaml:"watchWithRevision"`
 	NewDirectoryMode  *os.FileMode           `yaml:"newDirectoryMode"`
+	Auth              *AuthConfig            `yaml:"auth"`
 
 	Retry                  retry.Configuration `yaml:"retry"`
 	RequestTimeout         time.Duration       `yaml:"requestTimeout"`

src/cmd/services/m3dbnode/config/auth.go

@@ -0,0 +1,190 @@
+// Copyright (c) 2023 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+package config
+
+import "fmt"
+
+// AuthConfig is the top level config that includes secrets of inbound and
+// outbound of a dbnode.
+type AuthConfig struct {
+	Outbound *Outbounds `yaml:"outbounds"`
+	Inbound  *Inbound   `yaml:"inbounds"`
+}
+
+// Validate validates the AuthConfig. We use this method to validate fields
+// where the validator package falls short.
+func (c *AuthConfig) Validate() error {
+	if c.Outbound == nil {
+		return fmt.Errorf("outbound creds are not present")
+	}
+
+	if err := c.Outbound.Validate(); err != nil {
+		return err
+	}
+
+	if c.Inbound != nil {
+		if err := c.Inbound.Validate(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Outbounds consist secrets for outbounds connections for m3dbnodes and
+// etcd.
+type Outbounds struct {
+	M3DB *ServicesConfig `yaml:"m3db"`
+	Etcd *ServicesConfig `yaml:"etcd"`
+}
+
+// Validate validates the Outbounds.
+func (c *Outbounds) Validate() error {
+	if c.M3DB == nil {
+		return fmt.Errorf("incomplete outbound creds, m3db node creds not provided")
+	}
+
+	if err := c.M3DB.Validate(); err != nil {
+		return err
+	}
+
+	if c.Etcd == nil {
+		return fmt.Errorf("incomplete outbound creds, etcd node creds not provided")
+	}
+	if err := c.Etcd.Validate(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Inbound consist secrets for Inbound connections for m3dbnodes.
+type Inbound struct {
+	M3DB *InboundConfig `yaml:"m3db"`
+}
+
+// Validate validates the Inbound.
+func (c *Inbound) Validate() error {
+	if c.M3DB == nil {
+		return fmt.Errorf("incomplete inboundcreds, m3db config not provided")
+	}
+
+	if err := c.M3DB.Validate(); err != nil {
+		return err
+	}
+	return nil
+}
+
+// InboundConfig consist credentials and auth mode for inbound request.
+type InboundConfig struct {
+	Mode        *string               `yaml:"mode"`
+	Credentials []*InboundCredentials `yaml:"credentials"`
+}
+
+// Validate validates the InboundConfig.
+func (c *InboundConfig) Validate() error {
+	if c.Mode == nil {
+		return fmt.Errorf("incomplete inboundcreds, mode not provided")
+	}
+
+	for _, node := range c.Credentials {
+		if err := node.Validate(); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// ServicesConfig consist of service level config.
+type ServicesConfig struct {
+	NodeConfig []*ServiceConfig `yaml:"services"`
+}
+
+// Validate validates the ServicesConfig.
+func (c *ServicesConfig) Validate() error {
+	if c.NodeConfig == nil || len(c.NodeConfig) == 0 {
+		return fmt.Errorf("incomplete creds, service level creds not provided")
+	}
+
+	for _, node := range c.NodeConfig {
+		if err := node.Validate(); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// ServiceConfig consist of service level config.
+type ServiceConfig struct {
+	Service *OutboundCredentials `yaml:"service"`
+}
+
+// Validate validates the ServiceConfig.
+func (c *ServiceConfig) Validate() error {
+	if c.Service == nil {
+		return fmt.Errorf("incomplete creds, service level creds not provided")
+	}
+
+	if err := c.Service.Validate(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// OutboundCredentials is the bottom most struct consist used for storing outbounds creds.
+type OutboundCredentials struct {
+	Zone     string
+	Username *string
+	Password *string
+}
+
+// Validate validates the Credentials.
+func (c *OutboundCredentials) Validate() error {
+	if c.Username == nil {
+		return fmt.Errorf("incomplete creds, username not provided for outbounds")
+	}
+	if c.Password == nil {
+		return fmt.Errorf("incomplete creds, password not provided for outbounds")
+	}
+
+	return nil
+}
+
+// InboundCredentials is the bottom most struct consist used for storing outbounds creds.
+type InboundCredentials struct {
+	Zone     string  `yaml:"zone"`
+	Username *string `yaml:"username"`
+	Digest   *string `yaml:"digest"`
+}
+
+// Validate validates the Credentials.
+func (c *InboundCredentials) Validate() error {
+	if c.Username == nil {
+		return fmt.Errorf("incomplete creds, username not provided for inbounds")
+	}
+	if c.Digest == nil {
+		return fmt.Errorf("incomplete creds, digest password not provided for inbounds")
+	}
+
+	return nil
+}