implement NoTLS (--plaintext) support

.gitignore

@@ -59,3 +59,6 @@ go.work.sum
 
 # exclude DLV debugger generated binaries
 __debug_bin*
+
+# latest container test-snapshot
+.container-tag.env

.golangci.yaml

@@ -74,32 +74,37 @@ linters:
     - copyloopvar
     - dogsled
     - errcheck
+    - errname
     - exhaustive
     - funlen
     - gochecknoinits
     - goconst
     - gocritic
     - gocyclo
     - godot
+    - gosimple
     - err113
     - gofmt
     - goimports
     - goprintffuncname
     - gosec
     - gosimple
     - govet
+    - importas
     - ineffassign
     - misspell
     - nakedret
     - noctx
     - rowserrcheck
     - staticcheck
     - stylecheck
+    - testifylint
     - testpackage
     - typecheck
     - unconvert
     - unparam
     - unused
+    - wastedassign
 
   # don't enable:
     # - depguard

.goreleaser-test.yml

@@ -36,6 +36,8 @@ builds:
       - -X github.com/{{ .Env.ORG }}/{{ .Env.REPO }}/pkg/version.commit={{.ShortCommit}}
       - -X github.com/{{ .Env.ORG }}/{{ .Env.REPO }}/pkg/version.date={{.Date}}
     mod_timestamp: "{{ .CommitTimestamp }}"
+    hooks:
+      post: make container-tag
 
   - id: topaz
     main: ./cmd/topaz
@@ -57,7 +59,7 @@ builds:
 
 snapshot:
   # https://goreleaser.com/customization/snapshots/
-  version_template: "test-{{ .ShortCommit }}"
+  version_template: "0.0.0-test-{{ .ShortCommit }}"
 
 dockers:
   # https://goreleaser.com/customization/docker/

assets/assets.go

@@ -13,6 +13,13 @@ func ConfigReader() io.Reader {
 	return bytes.NewReader(config)
 }
 
+//go:embed config/config-no-tls.yaml
+var configNoTLS []byte
+
+func ConfigNoTLSReader() io.Reader {
+	return bytes.NewReader(configNoTLS)
+}
+
 //go:embed config/peoplefinder.yaml
 var configOnline []byte
 

assets/config/config-no-tls.yaml

@@ -0,0 +1,272 @@
+# yaml-language-server: $schema=https://topaz.sh/schema/config.json
+---
+# config schema version
+version: 2
+
+# logger settings.
+logging:
+  prod: true
+  log_level: info
+  grpc_log_level: info
+
+# edge directory configuration.
+directory:
+  db_path: '${TOPAZ_DB_DIR}/test-no-tls.db'
+  request_timeout: 5s # set as default, 5 secs.
+
+# remote directory is used to resolve the identity for the authorizer.
+remote_directory:
+  address: "0.0.0.0:9292" # set as default, it should be the same as the reader as we resolve the identity from the local directory service.
+  insecure: false
+  no_tls: true
+  tenant_id: ""
+  api_key: ""
+  token: ""
+  client_cert_path: ""
+  client_key_path: ""
+  ca_cert_path: ""
+  timeout_in_seconds: 5
+  headers:
+
+# default jwt validation configuration
+jwt:
+  acceptable_time_skew_seconds: 5 # set as default, 5 secs
+
+# authentication configuration
+auth:
+  keys:
+    # - "<API key>"
+    # - "<Password>"
+  options:
+    default:
+      enable_api_key: false
+      enable_anonymous: true
+    overrides:
+      paths:
+        - /aserto.authorizer.v2.Authorizer/Info
+        - /grpc.reflection.v1.ServerReflection/ServerReflectionInfo
+        - /grpc.reflection.v1alpha.ServerReflection/ServerReflectionInfo
+      override:
+        enable_api_key: false
+        enable_anonymous: true
+
+api:
+  health:
+    listen_address: "0.0.0.0:9494"
+
+  metrics:
+    listen_address: "0.0.0.0:9696"
+
+  services:
+    console:
+      grpc:
+        listen_address: "0.0.0.0:9292"
+        fqdn: ""
+      gateway:
+        listen_address: "0.0.0.0:9393"
+        fqdn: ""
+        allowed_headers:
+        - "Authorization"
+        - "Content-Type"
+        - "If-Match"
+        - "If-None-Match"
+        - "Depth"
+        allowed_methods:
+        - "GET"
+        - "POST"
+        - "HEAD"
+        - "DELETE"
+        - "PUT"
+        - "PATCH"
+        - "PROFIND"
+        - "MKCOL"
+        - "COPY"
+        - "MOVE"
+        allowed_origins:
+        - http://localhost
+        - http://localhost:*
+        - https://*.aserto.com
+        - https://*aserto-console.netlify.app
+        read_timeout: 2s
+        read_header_timeout: 2s
+        write_timeout: 2s
+        idle_timeout: 30s
+
+    model:
+      grpc:
+        listen_address: "0.0.0.0:9292"
+        fqdn: ""
+      gateway:
+        listen_address: "0.0.0.0:9393"
+        fqdn: ""
+        allowed_headers:
+        - "Authorization"
+        - "Content-Type"
+        - "If-Match"
+        - "If-None-Match"
+        - "Depth"
+        allowed_methods:
+        - "GET"
+        - "POST"
+        - "HEAD"
+        - "DELETE"
+        - "PUT"
+        - "PATCH"
+        - "PROFIND"
+        - "MKCOL"
+        - "COPY"
+        - "MOVE"
+        allowed_origins:
+        - http://localhost
+        - http://localhost:*
+        - https://*.aserto.com
+        - https://*aserto-console.netlify.app
+        read_timeout: 2s
+        read_header_timeout: 2s
+        write_timeout: 2s
+        idle_timeout: 30s
+
+    reader:
+      needs:
+        - model
+      grpc:
+        listen_address: "0.0.0.0:9292"
+        fqdn: ""
+        certs:
+      gateway:
+        listen_address: "0.0.0.0:9393"
+        fqdn: ""
+        allowed_headers:
+        - "Authorization"
+        - "Content-Type"
+        - "If-Match"
+        - "If-None-Match"
+        - "Depth"
+        allowed_methods:
+        - "GET"
+        - "POST"
+        - "HEAD"
+        - "DELETE"
+        - "PUT"
+        - "PATCH"
+        - "PROFIND"
+        - "MKCOL"
+        - "COPY"
+        - "MOVE"
+        allowed_origins:
+        - http://localhost
+        - http://localhost:*
+        - https://*.aserto.com
+        - https://*aserto-console.netlify.app
+        read_timeout: 2s # default 2 seconds
+        read_header_timeout: 2s
+        write_timeout: 2s
+        idle_timeout: 30s # default 30 seconds
+
+    writer:
+      needs:
+        - model
+      grpc:
+        listen_address: "0.0.0.0:9292"
+        fqdn: ""
+      gateway:
+        listen_address: "0.0.0.0:9393"
+        fqdn: ""
+        allowed_headers:
+        - "Authorization"
+        - "Content-Type"
+        - "If-Match"
+        - "If-None-Match"
+        - "Depth"
+        allowed_methods:
+        - "GET"
+        - "POST"
+        - "HEAD"
+        - "DELETE"
+        - "PUT"
+        - "PATCH"
+        - "PROFIND"
+        - "MKCOL"
+        - "COPY"
+        - "MOVE"
+        allowed_origins:
+        - http://localhost
+        - http://localhost:*
+        - https://*.aserto.com
+        - https://*aserto-console.netlify.app
+        read_timeout: 2s
+        read_header_timeout: 2s
+        write_timeout: 2s
+        idle_timeout: 30s
+
+    exporter:
+      grpc:
+        listen_address: "0.0.0.0:9292"
+        fqdn: ""
+
+    importer:
+      needs:
+        - model
+      grpc:
+        listen_address: "0.0.0.0:9292"
+        fqdn: ""
+
+    authorizer:
+      needs:
+        - reader
+      grpc:
+        connection_timeout_seconds: 2
+        listen_address: "0.0.0.0:9292"
+        fqdn: ""
+      gateway:
+        listen_address: "0.0.0.0:9393"
+        fqdn: ""
+        allowed_headers:
+        - "Authorization"
+        - "Content-Type"
+        - "If-Match"
+        - "If-None-Match"
+        - "Depth"
+        allowed_methods:
+        - "GET"
+        - "POST"
+        - "HEAD"
+        - "DELETE"
+        - "PUT"
+        - "PATCH"
+        - "PROFIND"
+        - "MKCOL"
+        - "COPY"
+        - "MOVE"
+        allowed_origins:
+        - http://localhost
+        - http://localhost:*
+        - https://*.aserto.com
+        - https://*aserto-console.netlify.app
+        read_timeout: 2s
+        read_header_timeout: 2s
+        write_timeout: 2s
+        idle_timeout: 30s
+
+opa:
+  instance_id: "-"
+  graceful_shutdown_period_seconds: 2
+  # max_plugin_wait_time_seconds: 30 set as default
+  local_bundles:
+    paths: []
+    skip_verification: true
+  config:
+    services:
+      ghcr:
+        url: https://ghcr.io
+        type: "oci"
+        response_header_timeout_seconds: 5
+    bundles:
+      test:
+        service: ghcr
+        resource: "ghcr.io/aserto-policies/policy-rebac:latest"
+        persist: false
+        config:
+          polling:
+            min_delay_seconds: 60
+            max_delay_seconds: 120

cmd/topaz/main.go

@@ -106,6 +106,7 @@ func run() (exitCode int) {
 			"authorizer_token":   cc.AuthorizerToken(),
 			"tenant_id":          cc.TenantID(),
 			"insecure":           strconv.FormatBool(cc.Insecure()),
+			"plaintext":          strconv.FormatBool(cc.Plaintext()),
 			"no_check":           strconv.FormatBool(cc.NoCheck()),
 			"no_color":           strconv.FormatBool(cc.NoColor()),
 			"active_config":      c.Config.Active.Config,