configserver

Current status : Work In Progress but usable 😃

Nowadays a wide range of solutions exists when it comes to managing your running pod configuration, from secrets to AzureKeyVaults - I tried a lot of them but none really fitted my needs. Therefore I decided to write configserver. (heavily) Inspired by spring-cloud-config, configserver is framework agnostic (written in goloang), and is aimed at cloud/kubernetes payloads to allows you to centrally manage your application configuration using gitops.

Configserver supports :

mutliple git repositories for one central instance
sensitive content encryption
client based repository access
and much more to come

Philosophy

Configserver aims at simplicity and security (well it tries to) and limit its dependencies to a strict minimum

Overview

flowchart LR
    A[[Repository-A/Branch-Integration]] 
    B[[Repository-A/Branch-Production]] 
    C[[Repository-B/Main]] 
    D{{ConfigServer}}
    D -->|Monitor| A
    D -->|Monitor| B
    D -->|Monitor| C
    E([POD Instance]) -.-> |GET http://svc.local/git/repository-a/configfile| D
    F([POD Instance]) --- G 
    G[Sidecar] -.-> |GET http://svc.local/git/repository-b/configfile| D

Getting Started

Prepare your configuration file

ConfigServer one single configuration file for all its needs :

environment:
  kind: production # If production logs are using JSON format if anything else logs are human readable
  home: /var/run/configserver # Not used yet

server:
  passPhrase: To infinity and beyond # Single passphrase used to encrypt sensitive content and generate client secrets
  listenOn: ":4200" # Port on which ConfigServer listens
  secretExpiryDays: 365 # Number of days a client secret is valid 
  validateSecretLifeSpan: false # If true will reject outdated secret, if false will only issue a warning in the logs

repositories:
  checkoutLocation: /tmp/configserver # Root path where the repositories are cloned
  configuration: # Configuration can contain multiple git repositories, they will be accessible via the /git/{name} url
    - name: configserver-samples-integration 
      url: https://github.com/fredjeck/configserver-samples
      branch: integration # Name of the branch to be checked out, if not provided defaults to main
      refreshIntervalSeconds: 3600 # Interval at which the repository is updated locally
      clients: # List of allowed client Ids
        - myclientid
        - sample_client

Run your configserver

In a pod simply run the configserver executable optionally using the -c switch to specify the configuration location. By default the configuration file configserver.yml will be located in /var/run/configserver

Prepare your repositories

If your configuration files contain sensitive contents, enclose the sensitive values within the {enc:} tag. For instance

password = 'SECRETPASSWORD'

will become

password = '{enc:SECRETPASSWORD}'

Then use the tokenize endpoint of your running endpoint to convert your file :

curl --request POST \
  --url http://localhost:4200/api/tokenize \
  --data 'password = '\''{enc:SECRETPASSWORD}'\'''

which would result in :

password = '{enc:HGSrEasO3EDYdTA5w+259/4hCxfmlIKh6i7wwZF9eFIg9kFwF7iMjg4T}'

And commit the resulting file in your repository

Using configserver

Configserver offers a simple API for all common tasks

Registering a new client

curl --request GET \
  --url 'http://localhost:4200/api/register?client_id=myclientid'

Will generate a client secret for the provided client id

{
  "client_id": "myclientid",
  "client_secret": "LjTo0NW7Fq0LLfpGFkJRWSlLvlETeEOt5T53zyWLJyqSI4BvlG8MehGK28RoG2LCJZ2VGDO2vU6PM3MwN/5TNw==",
  "expires_at": "2025-04-01T21:04:11.357903614+02:00"
}

Obtaining repository statistics

curl --request GET \
  --url http://localhost:4200/stats

returns

{
  "configserver-samples-integration": {
    "hitCount": 0,
    "lastUpdate": "2024-04-01T20:56:31.559944915+02:00",
    "nextUpdate": "2024-04-01T21:56:32.541023156+02:00",
    "lastError": null
  }
}

Accessing Content

Repository content requires the generated ClientID and Secret to be provided as part of a Basic Auth scheme See MDN docs.

Repositories are accessible via the /git/{repository name}/{path} endpoint where :

repository name is the name given in the configuration
path is a path fragment from the repository root

curl --request GET \
  --url http://localhost:4200/git/configserver-samples-integration/configuration/branch.md

Repository ACL

For a ClientID to be allowed to browse a repository, the ClientID must be declared in the clients section of the configserver.yml file for the repository.

# README