Initial policy management implementation

Add a new service node, "management". Implement API for updating and querying policies via this node. Signed-off-by: Sergei Trofimov <[email protected]>
veraison · Jul 24, 2023 · 0829c96 · 0829c96
1 parent 27f3f3d
commit 0829c96
Show file tree

Hide file tree

Showing 24 changed files with 940 additions and 11 deletions.
diff --git a/.gitignore b/.gitignore
@@ -19,6 +19,7 @@ integration-tests/.built
 __generated__
 __pycache__
 __debug_bin
+management/cmd/management-service/management-service
 
 # Test binary, built with `go test -c`
 *.test

diff --git a/Makefile b/Makefile
@@ -8,6 +8,7 @@ SUBDIR += config
 SUBDIR += handler
 SUBDIR += kvstore
 SUBDIR += log
+SUBDIR += management
 SUBDIR += plugin
 SUBDIR += policy
 SUBDIR += proto

diff --git a/deployments/docker/Makefile b/deployments/docker/Makefile
@@ -24,6 +24,7 @@ SRC_DIR := $(THIS_DIR)src/
 BUILDER_CONTEXT := $(CONTEXT_DIR)/builder
 
 vts_FLAGS := -v $(STORES_VOLUME):/opt/veraison/stores
+management_FLAGS := -v $(STORES_VOLUME):/opt/veraison/stores -p $(MANAGEMENT_PORT):$(MANAGEMENT_PORT)
 provisioning_FLAGS := -p $(PROVISIONING_PORT):$(PROVISIONING_PORT)
 verification_FLAGS := -p $(VERIFICATION_PORT):$(VERIFICATION_PORT)
 
@@ -85,7 +86,8 @@ services:
 	@# image targets (possibly because of the need to recursively resolve %,
 	@# but I haven't looked too much into it). Recursively calling $(MAKE) here
 	@# resolves the issue.
-	$(MAKE) .built/vts-container .built/provisioning-container .built/verification-container
+	$(MAKE) .built/vts-container .built/provisioning-container .built/verification-container \
+		.built/management-container
 
 .PHONY: vts
 vts: deploy .built/vts-container
@@ -105,6 +107,12 @@ verification: deploy .built/verification-container
 .PHONY: verification-image
 verification-image: deploy .built/verification-image
 
+.PHONY: management
+management: deploy .built/management-container
+
+.PHONY: management-image
+management-image: deploy .built/management-image
+
 .PHONY: network
 network: .built/network
 
@@ -165,7 +173,7 @@ docker-clean:
 		docker volume rm -f $(DEPLOY_DEST); \
 	fi
 	@# -f ensures exit code 0, even if image doesn't exist
-	docker container rm -f vts-service provisioning-service verification-service
+	docker container rm -f vts-service provisioning-service verification-service management-service
 	docker volume rm -f veraison-logs veraison-stores
 	@# ubuntu uses an older version of docker without -f option for network; hence the || : cludge
 	docker network rm $(VERAISON_NETWORK) || :

diff --git a/deployments/docker/deployment.cfg b/deployments/docker/deployment.cfg
@@ -12,6 +12,7 @@ VERAISON_NETWORK=veraison-net
 VTS_PORT=50051
 PROVISIONING_PORT=8888
 VERIFICATION_PORT=8080
+MANAGEMENT_PORT=8088
 
 # Deploy destination is either an absolute path to a directory on the host, or
 # the name of a docker volume.

diff --git a/deployments/docker/src/builder-dispatcher b/deployments/docker/src/builder-dispatcher
@@ -31,7 +31,7 @@ function deploy() {
     cp $BUILD_DIR/provisioning/cmd/provisioning-service/provisioning-service $DEPLOY_DIR/
     cp $BUILD_DIR/verification/cmd/verification-service/verification-service $DEPLOY_DIR/
     cp $BUILD_DIR/vts/cmd/vts-service/vts-service $DEPLOY_DIR/
-    cp $BUILD_DIR/vts/cmd/vts-service/vts-service $DEPLOY_DIR/
+    cp $BUILD_DIR/management/cmd/management-service/management-service $DEPLOY_DIR/
     cp $BUILD_DIR/scheme/bin/* $DEPLOY_DIR/plugins/
     cp $BUILD_DIR/deployments/docker/src/skey.jwk $DEPLOY_DIR/
     cp $BUILD_DIR/deployments/docker/src/service-entrypoint $DEPLOY_DIR/

diff --git a/deployments/docker/src/config.yaml.template b/deployments/docker/src/config.yaml.template
@@ -7,6 +7,8 @@ provisioning:
   listen-addr: 0.0.0.0:${PROVISIONING_PORT}
 verification:
   listen-addr: 0.0.0.0:${VERIFICATION_PORT}
+management:
+  listen-addr: 0.0.0.0:${MANAGEMENT_PORT}
 vts:
   server-addr: vts-service:${VTS_PORT}
 ear-signer:

diff --git a/deployments/docker/src/load-config.mk b/deployments/docker/src/load-config.mk
@@ -10,6 +10,7 @@ VERAISON_NETWORK ?= veraison-net
 VTS_PORT ?= 50051
 PROVISIONING_PORT ?= 8888
 VERIFICATION_PORT ?= 8080
+MANAGEMENT_PORT ?= 8088
 
 # Deploy destination is either an absolute path to a directory on the host, or
 # the name of a docker volume.

diff --git a/deployments/docker/src/management.docker b/deployments/docker/src/management.docker
@@ -0,0 +1,28 @@
+# Management service container.
+# The context for building this image is assumed to be the Veraison deployment
+# directory (/tmp/veraison is the default for make build).
+FROM debian as veraison-management
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install \
+        --assume-yes \
+        --no-install-recommends \
+	uuid-runtime \
+    && uuidgen | tr -d - > /etc/machine-id \
+    && apt-get clean \
+    && apt-get autoremove --assume-yes \
+    && rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp/*
+
+RUN groupadd -g 616 veraison && \
+    useradd -m  -g veraison  --system veraison
+
+USER veraison
+
+WORKDIR /opt/veraison
+
+ADD --chown=veraison:nogroup plugins plugins
+ADD --chown=veraison:nogroup config.yaml management-service service-entrypoint ./
+
+ENTRYPOINT ["/opt/veraison/service-entrypoint"]
+CMD ["/opt/veraison/management-service"]
+
diff --git a/deployments/docker/veraison b/deployments/docker/veraison
@@ -8,19 +8,21 @@ function status() {
     local vts=$(_get_container_state vts-service)
     local prov=$(_get_container_state provisioning-service)
     local verif=$(_get_container_state verification-service)
+    local manage=$(_get_container_state management-service)
 
     if [[ $_quiet == true ]]; then
         local vts=$(_strip_color $vts)
         local prov=$(_strip_color $prov)
         local verif=$(_strip_color $verif)
+        local manage=$(_strip_color $manage)
 
         local status="${_yell}stopped${_reset}"
 
-        if [[ "$vts" == "running" || "$prov" == "running" || "$verif" == "running" ]]; then
+        if [[ "$vts" == "running" || "$prov" == "running" || "$verif" == "running" || "$manage" == "running" ]]; then
             status="${_yell}partial${_yell}"
         fi
 
-        if [[ "$vts" == "running" && "$prov" == "running" && "$verif" == "running" ]]; then
+        if [[ "$vts" == "running" && "$prov" == "running" && "$verif" == "running"  && "$manage" == "running" ]]; then
             status="${_green}running${_reset}"
         fi
 
@@ -29,6 +31,7 @@ function status() {
         echo -e "         vts: $vts"
         echo -e "provisioning: $prov"
         echo -e "verification: $verif"
+        echo -e "  management: $manage"
     fi
 }
 
@@ -40,12 +43,15 @@ function start() {
         sleep 0.5 # wait for vts to start before starting the services that depend on it.
         start_provisioning
         start_verification
+        start_management
     elif [[ "$what" == "vts" || "$what" == "vts-service" ]]; then
         start_vts
     elif [[ "$what" == "provisioning" || "$what" == "provisioning-service" ]]; then
         start_provisioning
     elif [[ "$what" == "verification" || "$what" == "verification-service" ]]; then
         start_verification
+    elif [[ "$what" == "management" || "$what" == "management-service" ]]; then
+        start_management
     else
         echo -e "$_error: unknown service: $what"
         exit 1
@@ -56,6 +62,7 @@ function stop() {
     local what=$1
 
     if [[ "x$what" == "x" ]]; then
+        stop_management
         stop_verification
         stop_provisioning
         stop_vts
@@ -65,6 +72,8 @@ function stop() {
         stop_provisioning
     elif [[ "$what" == "verification" || "$what" == "verification-service" ]]; then
         stop_verification
+    elif [[ "$what" == "management" || "$what" == "management-service" ]]; then
+        stop_management
     else
         echo -e "$_error: unknown service: $what"
         exit 1
@@ -80,6 +89,8 @@ function follow() {
         follow_provisioning
     elif [[ "$what" == "verification" || "$what" == "verification-service" ]]; then
         follow_verification
+    elif [[ "$what" == "management" || "$what" == "management-service" ]]; then
+        follow_management
     else
         echo -e "$_error: unknown service: $what"
         exit 1
@@ -122,6 +133,18 @@ function follow_verification() {
     docker container logs --follow --timestamps verification-service
 }
 
+function start_management() {
+    docker container start management-service
+}
+
+function stop_management() {
+    docker container stop management-service
+}
+
+function follow_management() {
+    docker container logs --follow --timestamps management-service
+}
+
 function manager() {
     docker container run --rm -t \
 	    --network veraison-net \

diff --git a/integration-tests/Makefile b/integration-tests/Makefile
@@ -26,11 +26,6 @@ CONTAINER_FLAGS := --env-file  $(DEPLOYMENT_SRC_DIR)deployment.cfg --network ver
 		   -v $(THIS_DIR):/integration-tests \
 		   -v $(STORES_VOLUME):/opt/veraison/stores
 
-DEPLOYMENT_DEPS := $(DEPLOYMENT_SRC_DIR).built/network \
-		   $(DEPLOYMENT_SRC_DIR).built/vts-container \
-		   $(DEPLOYMENT_SRC_DIR).built/provisioning-container \
-		   $(DEPLOYMENT_SRC_DIR).built/verification-container
-
 CLEANFILES := .pytest_cache utils/__pycache__ __generated__
 
 .PHONY: image

diff --git a/integration-tests/data/policies/psa-short.rego b/integration-tests/data/policies/psa-short.rego
@@ -0,0 +1,3 @@
+package policy
+
+executables = APPROVED_RT
diff --git a/integration-tests/data/policies/psa.rego b/integration-tests/data/policies/psa.rego
@@ -0,0 +1,9 @@
+package policy
+
+executables = APPROVED_RT {
+  some i
+
+  evidence["psa-software-components"][i]["measurement-type"] == "BL"
+
+  semver_cmp(evidence["psa-software-components"][i].version, "3.5") >= 0
+} else =  UNSAFE_RT
diff --git a/integration-tests/docker/bashrc b/integration-tests/docker/bashrc
@@ -2,6 +2,7 @@ export PATH=~/.local/bin:$PATH
 export PYTHONPATH=$PYTHONPATH:/integration-testing/utils
 export PROVISIONING_HOST=provisioning-service
 export VERIFICATION_HOST=verification-service
+export MANAGEMENT_HOST=management-service
 export PS1='\e[0;32m\u@debug-container \e[0;34m\w\n\e[0;32m$\e[0m '
 
 alias ll='ls -lh --color=auto'

diff --git a/integration-tests/tests/common.yaml b/integration-tests/tests/common.yaml
@@ -4,6 +4,7 @@ description: Common test information
 variables:
   provisioning-service: '{tavern.env_vars.PROVISIONING_HOST}.{tavern.env_vars.VERAISON_NETWORK}:{tavern.env_vars.PROVISIONING_PORT}'
   verification-service: '{tavern.env_vars.VERIFICATION_HOST}.{tavern.env_vars.VERAISON_NETWORK}:{tavern.env_vars.VERIFICATION_PORT}'
+  management-service: '{tavern.env_vars.MANAGEMENT_HOST}.{tavern.env_vars.VERAISON_NETWORK}:{tavern.env_vars.MANAGEMENT_PORT}'
   good-nonce: QUp8F0FBs9DpodKK8xUg8NQimf6sQAfe2J1ormzZLxk=
   bad-nonce: Ppfdfe2JzZLOk=
   endorsements-content-types: