change yurthub's protocol from http to https

cmd/yurthub/app/config/config.go

@@ -53,6 +53,9 @@ type YurtHubConfiguration struct {
 	HubAgentDummyIfName         string
 	StorageWrapper              cachemanager.StorageWrapper
 	SerializerManager           *serializer.SerializerManager
+	CAFile                      string
+	CertFile                    string
+	KeyFile                     string
 }
 
 // Complete converts *options.YurtHubOptions to *YurtHubConfiguration
@@ -94,6 +97,9 @@ func Complete(options *options.YurtHubOptions) (*YurtHubConfiguration, error) {
 		HubAgentDummyIfName:         options.HubAgentDummyIfName,
 		StorageWrapper:              storageWrapper,
 		SerializerManager:           serializerManager,
+		CAFile:                      options.CAFile,
+		CertFile:                    options.CertFile,
+		KeyFile:                     options.KeyFile,
 	}
 
 	return cfg, nil

cmd/yurthub/app/options/options.go

@@ -55,6 +55,9 @@ type YurtHubOptions struct {
 	HubAgentDummyIfIP         string
 	HubAgentDummyIfName       string
 	DiskCachePath             string
+	CAFile                    string
+	CertFile                  string
+	KeyFile                   string
 }
 
 // NewYurtHubOptions creates a new YurtHubOptions with a default config.
@@ -92,6 +95,18 @@ func ValidateOptions(options *YurtHubOptions) error {
 		return fmt.Errorf("server-address is empty")
 	}
 
+	if len(options.CAFile) == 0 {
+		return fmt.Errorf("CA is empty")
+	}
+
+	if len(options.CertFile) == 0 {
+		return fmt.Errorf("tls cert is empty")
+	}
+
+	if len(options.KeyFile) == 0 {
+		return fmt.Errorf("tls key is empty")
+	}
+
 	if !util.IsSupportedLBMode(options.LBMode) {
 		return fmt.Errorf("lb mode(%s) is not supported", options.LBMode)
 	}
@@ -130,6 +145,9 @@ func (o *YurtHubOptions) AddFlags(fs *pflag.FlagSet) {
 	fs.StringVar(&o.HubAgentDummyIfIP, "dummy-if-ip", o.HubAgentDummyIfIP, "the ip address of dummy interface that used for container connect hub agent(exclusive ips: 169.254.31.0/24, 169.254.1.1/32)")
 	fs.StringVar(&o.HubAgentDummyIfName, "dummy-if-name", o.HubAgentDummyIfName, "the name of dummy interface that is used for hub agent")
 	fs.StringVar(&o.DiskCachePath, "disk-cache-path", o.DiskCachePath, "the path for kubernetes to storage metadata")
+	fs.StringVar(&o.CAFile, "ca-file", "", "the CA for yurthub to verify client")
+	fs.StringVar(&o.CertFile, "tls-cert-file", "", "the tls cert of yurthub")
+	fs.StringVar(&o.KeyFile, "tls-private-key-file", "", "the tls key of yurthub")
 }
 
 // verifyDummyIP verify the specified ip is valid or not

pkg/yurthub/server/server.go

@@ -17,7 +17,10 @@ limitations under the License.
 package server
 
 import (
+	"crypto/tls"
+	"crypto/x509"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"net/http"
 
@@ -27,6 +30,7 @@ import (
 
 	"github.com/gorilla/mux"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"k8s.io/klog"
 )
 
 // Server is an interface for providing http service for yurthub
@@ -38,6 +42,12 @@ type Server interface {
 // and hubServer handles requests by hub agent itself, like profiling, metrics, healthz
 // and proxyServer does not handle requests locally and proxy requests to kube-apiserver
 type yurtHubServer struct {
+	CAFile string
+	// CertFile the tls cert file for proxyhub's https server
+	CertFile string
+	// KeyFile the tls key file for proxyhub's https server
+	KeyFile string
+
 	hubServer        *http.Server
 	proxyServer      *http.Server
 	dummyProxyServer *http.Server
@@ -55,9 +65,21 @@ func NewYurtHubServer(cfg *config.YurtHubConfiguration,
 		MaxHeaderBytes: 1 << 20,
 	}
 
+	caFile, err := ioutil.ReadFile(cfg.CAFile)
+	if err != nil {
+		klog.Errorf("Read ca file err: %v", err)
+		return nil, err
+	}
+	certPool := x509.NewCertPool()
+	certPool.AppendCertsFromPEM([]byte(caFile))
+
 	proxyServer := &http.Server{
-		Addr:           cfg.YurtHubProxyServerAddr,
-		Handler:        proxyHandler,
+		Addr:    cfg.YurtHubProxyServerAddr,
+		Handler: proxyHandler,
+		TLSConfig: &tls.Config{
+			ClientCAs:  certPool,
+			ClientAuth: tls.VerifyClientCertIfGiven,
+		},
 		MaxHeaderBytes: 1 << 20,
 	}
 
@@ -75,6 +97,9 @@ func NewYurtHubServer(cfg *config.YurtHubConfiguration,
 	}
 
 	return &yurtHubServer{
+		CAFile:           cfg.CAFile,
+		CertFile:         cfg.CertFile,
+		KeyFile:          cfg.KeyFile,
 		hubServer:        hubServer,
 		proxyServer:      proxyServer,
 		dummyProxyServer: dummyProxyServer,
@@ -99,7 +124,7 @@ func (s *yurtHubServer) Run() {
 		}()
 	}
 
-	err := s.proxyServer.ListenAndServe()
+	err := s.proxyServer.ListenAndServeTLS(s.CertFile, s.KeyFile)
 	if err != nil {
 		panic(err)
 	}