Skip to content

Definition import: allow for arbitrary (and pluggable) sources #3311

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Merged
merged 3 commits into from
Aug 17, 2021

Conversation

michaelklishin
Copy link
Collaborator

@michaelklishin michaelklishin commented Aug 14, 2021

Proposed Changes

This makes the definition import mechanism generic and pluggable
(think peer discovery mechanisms) and not tied to a local file
or directory of files. This can be particularly convenient in environments
where running RabbitMQ in a container is the preferred or the only option,
such as GitLab or GitHub service containers used in integration tests.
See docker-library/rabbitmq#508 for some background on this.

The classic local filesystem source is still supported
using the same traditional configuration key, load_definitions.

Configuration schema follows peer discovery in spirit:

  • definitions.import_backend configures the mechanism to use,
    which can be a module provided by a plugin
  • definitions.* keys can be defined by plugins and contain any
    keys a specific mechanism needs

For example, the classic local filesystem source can now be
configured like this:

definitions.import_backend = local_filesystem
definitions.local.path = /path/to/definitions.d/definition.json
definitions.import_backend = https
definitions.https.url = https://hostname/path/to/definitions.json

definitions.tls.versions.1 = tlsv1.2
definitions.tls.log_level   = error

definitions.tls.ciphers.1  = ECDHE-ECDSA-AES256-GCM-SHA384
definitions.tls.ciphers.2  = ECDHE-RSA-AES256-GCM-SHA384
definitions.tls.ciphers.3  = ECDH-ECDSA-AES256-GCM-SHA384
definitions.tls.ciphers.4  = ECDH-RSA-AES256-GCM-SHA384
definitions.tls.ciphers.5  = DHE-RSA-AES256-GCM-SHA384
definitions.tls.ciphers.6  = DHE-DSS-AES256-GCM-SHA384
definitions.tls.ciphers.7  = ECDHE-ECDSA-AES128-GCM-SHA256
definitions.tls.ciphers.8  = ECDHE-RSA-AES128-GCM-SHA256
definitions.tls.ciphers.9  = ECDH-ECDSA-AES128-GCM-SHA256
definitions.tls.ciphers.10 = ECDH-RSA-AES128-GCM-SHA256
definitions.tls.ciphers.11 = DHE-RSA-AES128-GCM-SHA256
definitions.tls.ciphers.12 = DHE-DSS-AES128-GCM-SHA256

HTTPS may require additional configuration keys related to TLS/x.509
peer verification. Such extra keys will be added as the need for them
becomes evident.

Types of Changes

  • Bug fix (non-breaking change which fixes issue #NNNN)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause an observable behavior change in existing systems)
  • Documentation improvements (corrections, new content, etc)
  • Cosmetic change (whitespace, formatting, etc)

Checklist

Put an x in the boxes that apply. You can also fill these out after creating
the PR. If you're unsure about any of them, don't hesitate to ask on the
mailing list. We're here to help! This is simply a reminder of what we are
going to look for before merging your code.

  • I have read the CONTRIBUTING.md document
  • I have signed the CA (see https://cla.pivotal.io/sign/rabbitmq)
  • All tests pass locally with my changes
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)
  • Any dependent changes have been merged and published in related repositories

Further Comments

References #3249.

The classic local filesystem source is still supported
using the same traditional configuration key, load_definitions.

Configuration schema follows peer discovery in spirit:

 * definitions.import_backend configures the mechanism to use,
   which can be a module provided by a plugin
 * definitions.* keys can be defined by plugins and contain any
   keys a specific mechanism needs

For example, the classic local filesystem source can now be
configured like this:

``` ini
definitions.import_backend = local_filesystem
definitions.local.path = /path/to/definitions.d/definition.json
```

``` ini
definitions.import_backend = https
definitions.https.url = https://hostname/path/to/definitions.json
```

HTTPS may require additional configuration keys related to TLS/x.509
peer verification. Such extra keys will be added as the need for them
becomes evident.

References #3249
currently only used by the HTTPS mechanism but can be used by
any other.
@michaelklishin michaelklishin changed the title WIP Refactor definition import to allow for arbitrary sources Definition import: allow for arbitrary (and pluggable) sources Aug 17, 2021
@michaelklishin michaelklishin marked this pull request as ready for review August 17, 2021 18:15
@michaelklishin michaelklishin merged commit 645a076 into master Aug 17, 2021
@michaelklishin michaelklishin deleted the rabbitmq-server-3249 branch August 17, 2021 19:16
@michaelklishin
Copy link
Collaborator Author

@Mergifyio backport v3.9.x

@mergify
Copy link

mergify bot commented Aug 17, 2021

Command backport v3.9.x: success

Backports have been created

michaelklishin added a commit that referenced this pull request Aug 17, 2021
Definition import: allow for arbitrary (and pluggable) sources (backport #3311)
@michaelklishin michaelklishin added this to the 3.10.0 milestone Feb 16, 2022
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant