f60d05686f
Summary of the new configuration option: The cluster operators add the container_sync middleware to their proxy pipeline and create a container-sync-realms.conf for their cluster and copy this out to all their proxy and container servers. This file specifies the available container sync "realms". A container sync realm is a group of clusters with a shared key that have agreed to provide container syncing to one another. The end user can then set the X-Container-Sync-To value on a container to //realm/cluster/account/container instead of the previously required URL. The allowed hosts list is not used with this configuration and instead every container sync request sent is signed using the realm key and user key. This offers better security as source hosts can be faked much more easily than faking per request signatures. Replaying signed requests, assuming it could easily be done, shouldn't be an issue as the X-Timestamp is part of the signature and so would just short-circuit as already current or as superceded. This also makes configuration easier for the end user, especially with difficult networking situations where a different host might need to be used for the container sync daemon since it's connecting from within a cluster. With this new configuration option, the end user just specifies the realm and cluster names and that is resolved to the proper endpoint configured by the operator. If the operator changes their configuration (key or endpoint), the end user does not need to change theirs. DocImpact Change-Id: Ie1704990b66d0434e4991e26ed1da8b08cb05a37
48 lines
1.9 KiB
Plaintext
48 lines
1.9 KiB
Plaintext
# [DEFAULT]
|
|
# The number of seconds between checking the modified time of this config file
|
|
# for changes and therefore reloading it.
|
|
# mtime_check_interval = 300
|
|
|
|
|
|
# [realm1]
|
|
# key = realm1key
|
|
# key2 = realm1key2
|
|
# cluster_name1 = https://host1/v1/
|
|
# cluster_name2 = https://host2/v1/
|
|
#
|
|
# [realm2]
|
|
# key = realm2key
|
|
# key2 = realm2key2
|
|
# cluster_name3 = https://host3/v1/
|
|
# cluster_name4 = https://host4/v1/
|
|
|
|
|
|
# Each section name is the name of a sync realm. A sync realm is a set of
|
|
# clusters that have agreed to allow container syncing with each other. Realm
|
|
# names will be considered case insensitive.
|
|
#
|
|
# The key is the overall cluster-to-cluster key used in combination with the
|
|
# external users' key that they set on their containers' X-Container-Sync-Key
|
|
# metadata header values. These keys will be used to sign each request the
|
|
# container sync daemon makes and used to validate each incoming container sync
|
|
# request.
|
|
#
|
|
# The key2 is optional and is an additional key incoming requests will be
|
|
# checked against. This is so you can rotate keys if you wish; you move the
|
|
# existing key to key2 and make a new key value.
|
|
#
|
|
# Any values in the realm section whose names begin with cluster_ will indicate
|
|
# the name and endpoint of a cluster and will be used by external users in
|
|
# their containers' X-Container-Sync-To metadata header values with the format
|
|
# "realm_name/cluster_name/container_name". Realm and cluster names are
|
|
# considered case insensitive.
|
|
#
|
|
# The endpoint is what the container sync daemon will use when sending out
|
|
# requests to that cluster. Keep in mind this endpoint must be reachable by all
|
|
# container servers, since that is where the container sync daemon runs. Note
|
|
# the the endpoint ends with /v1/ and that the container sync daemon will then
|
|
# add the account/container/obj name after that.
|
|
#
|
|
# Distribute this container-sync-realms.conf file to all your proxy servers
|
|
# and container servers.
|