server

Documentation

Overview

Package server provides functionality so that other uses of sansshell can provide their own main.go without having to cargo-cult everything across for common use cases. i.e. adding additional modules that are locally defined.

Index

• func Run(ctx context.Context, opts ...Option)
• type Option
  • func WithAuthzHook(hook rpcauth.RPCAuthzHook) Option
  • func WithCredSource(credSource string) Option
  • func WithDebugPort(addr string) Option
  • func WithHostPort(hostport string) Option
  • func WithJustification(j bool) Option
  • func WithJustificationHook(hook func(string) error) Option
  • func WithLogger(l logr.Logger) Option
  • func WithMetricsPort(addr string) Option
  • func WithMetricsRecorder(recorder metrics.MetricsRecorder) Option
  • func WithOtelTracing(interceptorOpts ...otelgrpc.Option) Option
  • func WithParsedPolicy(policy *opa.AuthzPolicy) Option
  • func WithPolicy(policy string) Option
  • func WithRawServerOption(s func(*grpc.Server)) Option
  • func WithRefreshCredsOnSIGHUP() Option
  • func WithStreamInterceptor(i grpc.StreamServerInterceptor) Option
  • func WithTlsConfig(tlsConfig *tls.Config) Option
  • func WithUnaryInterceptor(i grpc.UnaryServerInterceptor) Option
  • func WithUnixSocket(socket string) Option
  • func WithUnixSocketConfigHook(h func(string) error) Option

Functions

func Run

func Run(ctx context.Context, opts ...Option)

Run takes the given context and RunState and starts up a sansshell server. As this is intended to be called from main() it doesn't return errors and will instead exit on any errors.

Types

type Option

type Option interface {
	// contains filtered or unexported methods
}

func WithAuthzHook

func WithAuthzHook(hook rpcauth.RPCAuthzHook) Option

WithAuthzHook adds an additional authz hook to be applied to the server.

func WithCredSource

func WithCredSource(credSource string) Option

WithCredSource applies a registered credential source with the mtls package.

func WithDebugPort

func WithDebugPort(addr string) Option

WithDebugPort opens an additional port for a http debug page.

This is meant for humans. The format of the debug pages may change over time.

func WithHostPort

func WithHostPort(hostport string) Option

WithHostport applies the host:port to run the server.

func WithJustification

func WithJustification(j bool) Option

WithJustification applies the justification param. Justification if true requires justification to be set in the incoming RPC context Metadata (to the key defined in the telemetry package).

func WithJustificationHook

func WithJustificationHook(hook func(string) error) Option

WithJustificationFunc applies a justification function. This function will be called if Justication is true and a justification entry is found. The supplied function can then do any validation it wants in order to ensure it's compliant.

func WithLogger

func WithLogger(l logr.Logger) Option

WithLogger applies a logger that is used for all logging. A discard based one is used if none is supplied.

func WithMetricsPort

func WithMetricsPort(addr string) Option

WithMetricsPort opens a HTTP endpoint for publishing metrics at the given addr and initializes metrics exporter. This endpoint is to be scraped by a Prometheus-style metrics scraper. It can be accessed at http://{addr}/metrics

func WithMetricsRecorder

func WithMetricsRecorder(recorder metrics.MetricsRecorder) Option

WithMetricsRecorder enables metric instrumentations by inserting grpc metric interceptors and attaching recorder to the server runstate

func WithOtelTracing

func WithOtelTracing(interceptorOpts ...otelgrpc.Option) Option

WithOtelTracing adds the OpenTelemetry gRPC interceptors to both stream and unary servers The interceptors collect and export tracing data for gRPC requests and responses

func WithParsedPolicy

func WithParsedPolicy(policy *opa.AuthzPolicy) Option

WithParsedPolicy applies an already-parsed OPA policy used against incoming RPC requests.

func WithPolicy

func WithPolicy(policy string) Option

WithPolicy applies an OPA policy used against incoming RPC requests.

func WithRawServerOption

func WithRawServerOption(s func(*grpc.Server)) Option

WithRawServerOption allows one access to the RPC Server object. Generally this is done to add additional registration functions for RPC services to be done before starting the server.

func WithRefreshCredsOnSIGHUP

func WithRefreshCredsOnSIGHUP() Option

WithRefreshCredsOnSIGHUP will make sansshell-server refresh its credentials via its credential loader when it receives a SIGHUP signal. This is useful if you want to make sansshell immediately refresh its identity and trust configuration via `systemctl reload`.

func WithStreamInterceptor

func WithStreamInterceptor(i grpc.StreamServerInterceptor) Option

WithStreamInterceptor adds an additional stream server interceptor. These become any additional interceptors to be added to streaming RPCs served from this instance. They will be added after logging and authz checks.

func WithTlsConfig

func WithTlsConfig(tlsConfig *tls.Config) Option

WithTlsConfig applies a supplied tls.Config object to the gRPC server.

func WithUnaryInterceptor

func WithUnaryInterceptor(i grpc.UnaryServerInterceptor) Option

WithUnaryInterceptor adds an additional unary server interceptor. These become any additional interceptors to be added to unary RPCs served from this instance. They will be added after logging and authz checks.

func WithUnixSocket

func WithUnixSocket(socket string) Option

WithUnixSocket specifies the path of a Unix socket which should be opened for the server to listen on, in addition to the TCP socket specified in WithHostPort.

func WithUnixSocketConfigHook

func WithUnixSocketConfigHook(h func(string) error) Option

WithUnixSocketConfigHook allows for a hook to be called with the Unix socket path after it is created but before the server starts. This allows callers to set proper permissions and ownership on the socket.