CHE-6648: Added authentication to installers bootstrapper.

Added authentication to installers bootstrapper.
Signed-off-by: Oleksandr Garagatyi <ogaragat@redhat.com>

agents/go-agents/bootstrapper/cfg/cfg.go

@@ -32,6 +32,12 @@ var (
 	// PushLogsEndpoint where to push logs.
 	PushLogsEndpoint string
 
+	// AuthEnabled whether authentication is needed
+	AuthEnabled bool
+
+	// Token to access wsmaster API
+	Token string
+
 	// RuntimeID the id of workspace runtime this machine belongs to.
 	RuntimeID    booter.RuntimeID
 	runtimeIDRaw string
@@ -72,6 +78,12 @@ func init() {
 		"",
 		"WebSocket endpoint where to push logs",
 	)
+	flag.BoolVar(
+		&AuthEnabled,
+		"enable-auth",
+		false,
+		"Whether authenication on workspace master is needed",
+	)
 	flag.StringVar(
 		&runtimeIDRaw,
 		"runtime-id",
@@ -124,6 +136,11 @@ func Parse() {
 		log.Fatal("Push logs endpoint protocol must be either ws or wss")
 	}
 
+	// auth-enabled - fetch USER_TOKEN
+	if AuthEnabled {
+		Token = os.Getenv("USER_TOKEN")
+	}
+
 	// runtime-id
 	if len(runtimeIDRaw) == 0 {
 		log.Fatal("Runtime ID required(set it with -runtime-id argument)")
@@ -152,6 +169,7 @@ func Print() {
 	log.Print("Bootstrapper configuration")
 	log.Printf("  Push endpoint: %s", PushStatusesEndpoint)
 	log.Printf("  Push logs endpoint: %s", PushLogsEndpoint)
+	log.Printf("  Auth enabled: %t", AuthEnabled)
 	log.Print("  Runtime ID:")
 	log.Printf("    Workspace: %s", RuntimeID.Workspace)
 	log.Printf("    Environment: %s", RuntimeID.Environment)

agents/go-agents/bootstrapper/main.go

@@ -37,16 +37,19 @@ func main() {
 	booter.AddAll(cfg.ReadInstallersConfig())
 
 	// push statuses
-	statusTun := connectOrFail(cfg.PushStatusesEndpoint)
+	statusTun := connectOrFail(cfg.PushStatusesEndpoint, cfg.Token)
 	booter.PushStatuses(statusTun)
 
 	// push logs
 	if len(cfg.PushLogsEndpoint) != 0 {
-		connector := &wsDialConnector{cfg.PushLogsEndpoint}
+		connector := &wsDialConnector{
+			endpoint: cfg.PushLogsEndpoint,
+			token:    cfg.Token,
+		}
 		if cfg.PushLogsEndpoint == cfg.PushStatusesEndpoint {
 			booter.PushLogs(statusTun, connector)
 		} else {
-			booter.PushLogs(connectOrFail(cfg.PushLogsEndpoint), connector)
+			booter.PushLogs(connectOrFail(cfg.PushLogsEndpoint, cfg.Token), connector)
 		}
 	}
 
@@ -55,22 +58,25 @@ func main() {
 	}
 }
 
-func connectOrFail(endpoint string) *jsonrpc.Tunnel {
-	tunnel, err := connect(endpoint)
+func connectOrFail(endpoint string, token string) *jsonrpc.Tunnel {
+	tunnel, err := connect(endpoint, token)
 	if err != nil {
 		log.Fatalf("Couldn't connect to endpoint '%s', due to error '%s'", endpoint, err)
 	}
 	return tunnel
 }
 
-func connect(endpoint string) (*jsonrpc.Tunnel, error) {
-	conn, err := jsonrpcws.Dial(endpoint)
+func connect(endpoint string, token string) (*jsonrpc.Tunnel, error) {
+	conn, err := jsonrpcws.Dial(endpoint, token)
 	if err != nil {
 		return nil, err
 	}
 	return jsonrpc.NewManagedTunnel(conn), nil
 }
 
-type wsDialConnector struct{ endpoint string }
+type wsDialConnector struct {
+	endpoint string
+	token    string
+}
 
-func (c *wsDialConnector) Connect() (*jsonrpc.Tunnel, error) { return connect(c.endpoint) }
+func (c *wsDialConnector) Connect() (*jsonrpc.Tunnel, error) { return connect(c.endpoint, c.token) }

agents/go-agents/core/jsonrpc/jsonrpcws/jsonrpc_impl.go

@@ -14,7 +14,7 @@
 // The example:
 //
 // Client:
-//	conn, err := jsonrpcws.Dial("ws://host:port/path")
+//	conn, err := jsonrpcws.Dial("ws://host:port/path", token123456798)
 //	if err != nil {
 //      	panic(err)
 //      }
@@ -50,8 +50,15 @@ var (
 )
 
 // Dial establishes a new client WebSocket connection.
-func Dial(url string) (*NativeConnAdapter, error) {
-	conn, _, err := websocket.DefaultDialer.Dial(url, nil)
+// If argument 'token' is empty authentication won't be used,
+// otherwise authorization token will be added.
+func Dial(url string, token string) (*NativeConnAdapter, error) {
+	var headers http.Header
+	if token != "" {
+		headers = make(map[string][]string)
+		headers.Add("Authorization", token)
+	}
+	conn, _, err := websocket.DefaultDialer.Dial(url, headers)
 	if err != nil {
 		return nil, err
 	}

infrastructures/docker/src/main/java/org/eclipse/che/workspace/infrastructure/docker/bootstrap/DockerBootstrapper.java

@@ -100,6 +100,7 @@ public class DockerBootstrapper extends AbstractBootstrapper {
             + installerWebsocketEndpoint
             + " -push-logs-endpoint "
             + outputWebsocketEndpoint
+            + " -enable-auth"
             + " -server-check-period "
             + serverCheckPeriodSeconds
             + " -installer-timeout "

infrastructures/openshift/src/main/java/org/eclipse/che/workspace/infrastructure/openshift/bootstrapper/OpenShiftBootstrapper.java

@@ -98,6 +98,7 @@ public class OpenShiftBootstrapper extends AbstractBootstrapper {
             + outputWebsocketEndpoint
             + " -server-check-period "
             + Integer.toString(serverCheckPeriodSeconds)
+            + " -enable-auth"
             + " -installer-timeout "
             + Integer.toString(installerTimeoutSeconds)
             + " -file "
@@ -106,14 +107,14 @@ public class OpenShiftBootstrapper extends AbstractBootstrapper {
   }
 
   private void injectBootstrapper() throws InfrastructureException {
-    LOG.info("Creating folder for bootstrapper");
+    LOG.debug("Creating folder for bootstrapper");
     openShiftMachine.exec("mkdir", "-p", BOOTSTRAPPER_DIR);
-    LOG.info("Downloading bootstrapper binary");
+    LOG.debug("Downloading bootstrapper binary");
     openShiftMachine.exec(
         "curl", "-o", BOOTSTRAPPER_DIR + BOOTSTRAPPER_FILE, bootstrapperBinaryUrl);
     openShiftMachine.exec("chmod", "+x", BOOTSTRAPPER_DIR + BOOTSTRAPPER_FILE);
 
-    LOG.info("Creating bootstrapper config file");
+    LOG.debug("Creating bootstrapper config file");
     openShiftMachine.exec(
         "sh",
         "-c",