Skip to content

Commit

Permalink
Add gRPC calls for Fulcio on prober (#1062)
Browse files Browse the repository at this point in the history 
* creating poc for getting TrustBundle via grpc

Signed-off-by: Javan lacerda <javanlacerda@google.com>

* Adding grpc call for reading fulcio methods on prober

Signed-off-by: Javan lacerda <javanlacerda@google.com>

* (ref) keeping only GetTrustBundle request, metrics improvement

Signed-off-by: Javan lacerda <javanlacerda@google.com>

* using status code instead of number directly

Signed-off-by: Javan lacerda <javanlacerda@google.com>

---------

Signed-off-by: Javan lacerda <javanlacerda@google.com>
  • Loading branch information
@javanlacerda
javanlacerda authored Apr 16, 2024
1 parent f54c748 commit 38b0c7e
Show file tree
Hide file tree
Showing 4 changed files with 176 additions and 4 deletions.
45 changes: 41 additions & 4 deletions cmd/prober/prober.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ import (
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
"crypto/tls"
"encoding/json"
"flag"
"log"
Expand All @@ -28,11 +29,15 @@ import (
"time"

retryablehttp "github.com/hashicorp/go-retryablehttp"

"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/promhttp"
fulciopb "github.com/sigstore/fulcio/pkg/generated/protobuf"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials"
"google.golang.org/grpc/status"
"sigs.k8s.io/release-utils/version"

"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
_ "github.com/sigstore/cosign/v2/pkg/providers/all"
"go.uber.org/zap"
"go.uber.org/zap/zapcore"
Expand Down Expand Up @@ -100,6 +105,7 @@ var (
addr string
rekorURL string
fulcioURL string
fulcioGrpcURL string
oneTime bool
runWriteProber bool
versionInfo version.Info
Expand All @@ -114,6 +120,7 @@ func init() {

flag.StringVar(&rekorURL, "rekor-url", "https://rekor.sigstore.dev", "Set to the Rekor URL to run probers against")
flag.StringVar(&fulcioURL, "fulcio-url", "https://fulcio.sigstore.dev", "Set to the Fulcio URL to run probers against")
flag.StringVar(&fulcioGrpcURL, "fulcio-grpc-url", "fulcio.sigstore.dev", "Set to the Fulcio GRPC URL to run probers against")

flag.BoolVar(&oneTime, "one-time", false, "Whether to run only one time and exit.")
flag.BoolVar(&runWriteProber, "write-prober", false, " [Kubernetes only] run the probers for the write endpoints.")
Expand Down Expand Up @@ -170,8 +177,11 @@ func main() {
verificationCounter.With(prometheus.Labels{verifiedLabel: "false"}).Add(0)
verificationCounter.With(prometheus.Labels{verifiedLabel: "true"}).Add(0)

go runProbers(ctx, frequency, oneTime)

if fulcioClient, err := NewFulcioGrpcClient(); err != nil {
Logger.Fatalf("error creating fulcio grpc client %v", err)
} else {
go runProbers(ctx, frequency, oneTime, fulcioClient)
}
// Expose the registered metrics via HTTP.
http.Handle("/metrics", promhttp.HandlerFor(
reg,
Expand All @@ -185,7 +195,18 @@ func main() {
Logger.Fatal(http.ListenAndServe(addr, nil))
}

func runProbers(ctx context.Context, freq int, runOnce bool) {
func NewFulcioGrpcClient() (fulciopb.CAClient, error) {
opts := []grpc.DialOption{grpc.WithUserAgent(options.UserAgent())}
transportCreds := credentials.NewTLS(&tls.Config{MinVersion: tls.VersionTLS12})
opts = append(opts, grpc.WithTransportCredentials(transportCreds))
conn, err := grpc.NewClient(fulcioGrpcURL, opts...)
if err != nil {
return nil, err
}
return fulciopb.NewCAClient(conn), nil
}

func runProbers(ctx context.Context, freq int, runOnce bool, fulcioGrpcClient fulciopb.CAClient) {
for {
hasErr := false

Expand All @@ -201,6 +222,13 @@ func runProbers(ctx context.Context, freq int, runOnce bool) {
Logger.Errorf("error running request %s: %v", r.Endpoint, err)
}
}

// Performing requests for GetTrustBundle against Fulcio gRPC API
if err := observeGrcpGetTrustBundleRequest(ctx, fulcioGrpcClient); err != nil {
hasErr = true
Logger.Errorf("error running request %s: %v", "GetTrustBundle", err)
}

if runWriteProber {
priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
if err != nil {
Expand Down Expand Up @@ -258,6 +286,15 @@ func observeRequest(host string, r ReadProberCheck) error {
return nil
}

func observeGrcpGetTrustBundleRequest(ctx context.Context, fulcioGrpcClient fulciopb.CAClient) error {
s := time.Now()
_, err := fulcioGrpcClient.GetTrustBundle(ctx, &fulciopb.GetTrustBundleRequest{})

latency := time.Since(s).Milliseconds()
exportGrpcDataToPrometheus(status.Code(err), "grpc://"+fulcioGrpcURL, "GetTrustBundle", "GET", latency)
return err
}

func httpRequest(host string, r ReadProberCheck) (*retryablehttp.Request, error) {
req, err := retryablehttp.NewRequest(r.Method, host+r.Endpoint, bytes.NewBuffer([]byte(r.Body)))
if err != nil {
Expand Down
13 changes: 13 additions & 0 deletions cmd/prober/prometheus.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ import (

"github.com/prometheus/client_golang/prometheus"
"go.uber.org/zap"
"google.golang.org/grpc/codes"
)

var (
Expand Down Expand Up @@ -72,6 +73,18 @@ func exportDataToPrometheus(resp *http.Response, host, endpoint, method string,
Logger.With(zap.Int("status", statusCode), zap.Int("bytes", int(resp.ContentLength)), zap.Duration("latency", time.Duration(latency)*time.Millisecond)).Infof("[DEBUG] %v %v", method, host+endpoint)
}

func exportGrpcDataToPrometheus(statusCode codes.Code, host string, endpoint string, method string, latency int64) {
labels := prometheus.Labels{
endpointLabel: endpoint,
statusCodeLabel: fmt.Sprintf("%d", statusCode),
hostLabel: host,
methodLabel: method,
}
endpointLatenciesSummary.With(labels).Observe(float64(latency))
endpointLatenciesHistogram.With(labels).Observe(float64(latency))
Logger.With(zap.Int32("status", int32(statusCode)), zap.Duration("latency", time.Duration(latency)*time.Millisecond)).Infof("[DEBUG] %v %v %v", method, endpoint, host)
}

// NewVersionCollector returns a collector that exports metrics about current version
// information.
func NewVersionCollector(program string) prometheus.Collector {
Expand Down
38 changes: 38 additions & 0 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -68,13 +68,36 @@ require (
cloud.google.com/go/trace v1.10.5 // indirect
contrib.go.opencensus.io/exporter/stackdriver v0.13.14 // indirect
filippo.io/edwards25519 v1.1.0 // indirect
github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0 // indirect
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.10.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1 // indirect
github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 // indirect
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.1.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.0 // indirect
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
github.com/Azure/go-autorest/autorest v0.11.29 // indirect
github.com/Azure/go-autorest/autorest/adal v0.9.23 // indirect
github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 // indirect
github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
github.com/Azure/go-autorest/logger v0.2.1 // indirect
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
github.com/Microsoft/go-winio v0.6.1 // indirect
github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c // indirect
github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4 // indirect
github.com/alibabacloud-go/cr-20160607 v1.0.1 // indirect
github.com/alibabacloud-go/cr-20181201 v1.0.10 // indirect
github.com/alibabacloud-go/darabonba-openapi v0.2.1 // indirect
github.com/alibabacloud-go/debug v1.0.0 // indirect
github.com/alibabacloud-go/endpoint-util v1.1.1 // indirect
github.com/alibabacloud-go/openapi-util v0.1.0 // indirect
github.com/alibabacloud-go/tea v1.2.1 // indirect
github.com/alibabacloud-go/tea-utils v1.4.5 // indirect
github.com/alibabacloud-go/tea-xml v1.1.3 // indirect
github.com/aliyun/credentials-go v1.3.1 // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/aws/aws-sdk-go v1.51.6 // indirect
github.com/aws/aws-sdk-go-v2 v1.26.0 // indirect
Expand All @@ -84,13 +107,16 @@ require (
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.4 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
github.com/aws/aws-sdk-go-v2/service/ecr v1.20.2 // indirect
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.18.2 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.6 // indirect
github.com/aws/aws-sdk-go-v2/service/kms v1.30.0 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.20.3 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.3 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.28.5 // indirect
github.com/aws/smithy-go v1.20.1 // indirect
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20231024185945-8841054dbdb8 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver v3.5.1+incompatible // indirect
github.com/blendle/zapdriver v1.3.1 // indirect
Expand All @@ -99,6 +125,9 @@ require (
github.com/buildkite/interpolate v0.0.0-20200526001904-07f35b4ae251 // indirect
github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/chrismellard/docker-credential-acr-env v0.0.0-20230304212654-82a0ddb27589 // indirect
github.com/clbanning/mxj/v2 v2.7.0 // indirect
github.com/cloudflare/circl v1.3.7 // indirect
github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa // indirect
github.com/cockroachdb/cockroach-go/v2 v2.3.5 // indirect
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
Expand All @@ -110,6 +139,7 @@ require (
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
github.com/dimchansky/utfbom v1.1.1 // indirect
github.com/docker/cli v24.0.7+incompatible // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect
github.com/docker/docker v24.0.9+incompatible // indirect
Expand All @@ -134,21 +164,25 @@ require (
github.com/go-openapi/spec v0.21.0 // indirect
github.com/go-openapi/validate v0.24.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/mock v1.6.0 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/golang/snappy v0.0.4 // indirect
github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
github.com/google/go-containerregistry v0.19.1 // indirect
github.com/google/go-github/v55 v55.0.0 // indirect
github.com/google/go-querystring v1.1.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/s2a-go v0.1.7 // indirect
github.com/google/tink/go v1.7.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
github.com/googleapis/gax-go/v2 v2.12.3 // indirect
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 // indirect
github.com/hashicorp/vault/api v1.12.2 // indirect
github.com/imdario/mergo v0.3.16 // indirect
github.com/in-toto/in-toto-golang v0.9.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jackc/chunkreader/v2 v2.0.1 // indirect
Expand All @@ -173,6 +207,7 @@ require (
github.com/miekg/pkcs11 v1.1.1 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/mozillazg/docker-credential-acr-helper v0.3.0 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481 // indirect
github.com/oklog/ulid v1.3.1 // indirect
Expand Down Expand Up @@ -210,9 +245,12 @@ require (
github.com/spiffe/go-spiffe/v2 v2.2.0 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
github.com/thales-e-security/pool v0.0.2 // indirect
github.com/tjfoc/gmsm v1.4.1 // indirect
github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce // indirect
github.com/transparency-dev/merkle v0.0.2 // indirect
github.com/vbatts/tar-split v0.11.5 // indirect
github.com/xanzy/go-gitlab v0.102.0 // indirect
github.com/zeebo/errs v1.3.0 // indirect
go.etcd.io/etcd/api/v3 v3.6.0-alpha.0 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.6.0-alpha.0 // indirect
Expand Down
Loading

0 comments on commit 38b0c7e

Please sign in to comment.