coordinator: add POST /v1/manifest handler - #2564
Conversation
a68de69 to
1605956
Compare
1605956 to
c1f98ec
Compare
c1f98ec to
d60f163
Compare
d60f163 to
b7a8468
Compare
| // PreviousTransitionHash is the expected hash of the latest transition, used for | ||
| // compare-and-swap. If unset, the update is not conditional. | ||
| PreviousTransitionHash []byte `json:"previous_transition_hash,omitempty"` |
There was a problem hiding this comment.
The mandatory signature is over the candidate transition, which includes the previous transition hash. Thus, the signature is sufficient to guarantee atomicity, and we don't need this argument.
| // Over HTTP this is the only supported way to authorize an update to an existing | ||
| // manifest, because the Coordinator can't authenticate the caller by its client | ||
| // certificate as it does for aTLS-based gRPC calls. | ||
| Signature []byte `json:"signature,omitempty"` |
There was a problem hiding this comment.
We did not care too much about 0/1/N signatures in proto because that's all the same encoding: https://protobuf.dev/programming-guides/proto3/#conditionally-safe-changes. That does not hold in JSON, so we should go for a slice of signatures to allow for future multi-party manifest updates. The code today should assert that it's either 0 or 1, though.
| // RootCA is the PEM-encoded certificate of the deployment's root CA. | ||
| RootCA []byte `json:"root_ca"` | ||
| // MeshCA is the PEM-encoded certificate of the deployment's mesh CA. | ||
| MeshCA []byte `json:"mesh_ca"` | ||
| // SeedSharesDoc is only set when the initial manifest was set. | ||
| SeedSharesDoc *SeedShareDocument `json:"seed_shares_doc,omitempty"` |
There was a problem hiding this comment.
These are all not trustworthy until covered by attestation - we could create reportdata content similar to /attest, though.
| // maxSetManifestBodySize limits the accepted request body size. A manifest and its policies | ||
| // are much smaller than this, but they're the largest input the Coordinator accepts. | ||
| const maxSetManifestBodySize = 16 << 20 // 16 MiB |
There was a problem hiding this comment.
Assuming a typical policy entry of 128B, this allows for > 100k entries. I had trouble estimating that without doing the calculation, maybe leave a hint.
Slightly unrealistic upper bound: 150k pods, and each pod having a unique policy.
Totally unrealistic upper bound: 130k nodes * 110 pods/node
| contentType := r.Header.Get("Content-Type") | ||
| mediaType, _, err := mime.ParseMediaType(contentType) | ||
| if err != nil { | ||
| writeJSONError(w, http.StatusBadRequest, err) | ||
| return | ||
| } | ||
| if mediaType != "application/json" { | ||
| writeJSONError(w, http.StatusUnsupportedMediaType, errContentType) | ||
| return | ||
| } |
There was a problem hiding this comment.
This is probably common to all endpoints. A pattern I liked was the mux middleware, but we can also just have a common checkMediaType function.
2 participants
No description provided.