Skip to content

Conversation

@DmitriyH
Copy link
Contributor

Currently, there is the only option to provide SSL certificate for GRPC client: from file.
It makes impossible to use a certificate received from an external secret data provider without saving it to disk, while saving private key to disk could potentially lead to a security issue.

It is suggested to declare an abstract component ugrpc::client::ExternalCredentialsProvider, which is used by ugrpc::client::ClientFactoryComponent. If ugrpc::client::ExternalCredentialsProvider returns a certificate, then SSL auth is enabled and certificate file path specified for factory config is ignored.

A minimal example:

// .hpp/.ccp

#include <userver/ugrpc/client/external_credentials_provider.hpp>

class GrpcClientCredentialsProvider final : public userver::ugrpc::client::ExternalCredentialsProvider {
 public:
  GrpcClientCredentialsProvider(const userver::components::ComponentConfig& config,
                                const userver::components::ComponentContext& context);

  std::optional<grpc::SslCredentialsOptions> GetSslCredentialsOptions() override {
    grpc::SslCredentialsOptions options;
    options.pem_cert_chain = ...;
    options.pem_private_key = ...;
    options.pem_root_certs = ...;
    return options;
  }
  
  ...
};
// static_config.yaml

    components:
        ...

        external-grpc-client-credentials-provider:

        ...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant