From ab6a0c63b18b9722f422d1786bf50c76cbf8535f Mon Sep 17 00:00:00 2001 From: Simone Basso Date: Thu, 8 Oct 2026 11:27:13 +0200 Subject: [PATCH] feat(register): add output dir for credentials This patch adds a new flag: `-output-secure`. Its default value is the value used by `-output`, for backward compatibility with deployments that only specify the `-output` flag. The purpose of this patch is to allow a consumer like `byos-debian` to emit the service account key (and possibly other secrets in the future) into distinct dirs with distinct permissions. In turn, this ensures that network measurement services such as the `ndt-server` cannot read the service account key, which is anyway a secret it should not have access to, while still being able to source the public files it requires. We named the flag `-output-secure=` (as opposed to something like `-secure-output=`) because we want it to sort near the `-output=` flag for additional `-h/-help` clarity. --- cmd/register/main.go | 40 +++++++++++++++++++++++----------------- 1 file changed, 23 insertions(+), 17 deletions(-) diff --git a/cmd/register/main.go b/cmd/register/main.go index 5d9481b..0994b83 100644 --- a/cmd/register/main.go +++ b/cmd/register/main.go @@ -38,22 +38,23 @@ var ( // Replaced by the linker with the current version at build time. Version = "0.0.0" - endpoint = flag.String("endpoint", defaultRegisterJWTEndpoint, "Endpoint of the autojoin service") - tkEndpoint = flag.String("token-endpoint", defaultTokenEndpoint, "Token-exchange endpoint") - apiKey = flag.String("key", "", "API key for the autojoin service") - service = flag.String("service", "ndt", "Service name to register with the autojoin service") - iata = flagx.StringFile{} - ipv4 = flagx.StringFile{} - ipv6 = flagx.StringFile{} - machineType = flag.String("type", "", "The type of machine: physical or virtual") - uplink = flag.String("uplink", "", "The speed of the uplink e.g., 1g, 10g, etc.") - interval = flag.Duration("interval.expected", 1*time.Hour, "Expected registration interval") - intervalMin = flag.Duration("interval.min", 55*time.Minute, "Minimum registration interval") - intervalMax = flag.Duration("interval.max", 65*time.Minute, "Maximum registration interval") - outputPath = flag.String("output", "", "Output folder") - siteProb = flagx.StringFile{} - defaultProb = 1.0 - ports = flagx.StringArray{} + endpoint = flag.String("endpoint", defaultRegisterJWTEndpoint, "Endpoint of the autojoin service") + tkEndpoint = flag.String("token-endpoint", defaultTokenEndpoint, "Token-exchange endpoint") + apiKey = flag.String("key", "", "API key for the autojoin service") + service = flag.String("service", "ndt", "Service name to register with the autojoin service") + iata = flagx.StringFile{} + ipv4 = flagx.StringFile{} + ipv6 = flagx.StringFile{} + machineType = flag.String("type", "", "The type of machine: physical or virtual") + uplink = flag.String("uplink", "", "The speed of the uplink e.g., 1g, 10g, etc.") + interval = flag.Duration("interval.expected", 1*time.Hour, "Expected registration interval") + intervalMin = flag.Duration("interval.min", 55*time.Minute, "Minimum registration interval") + intervalMax = flag.Duration("interval.max", 65*time.Minute, "Maximum registration interval") + outputPath = flag.String("output", "", "Output directory for public files (default: current directory)") + outputSecurePath = flag.String("output-secure", "", "Output directory for credentials (default: use '-output' value)") + siteProb = flagx.StringFile{} + defaultProb = 1.0 + ports = flagx.StringArray{} hcAddr = flag.String("healthcheck-addr", "localhost:8001", "Address to serve the /ready endpoint on") registerSuccess atomic.Bool @@ -170,6 +171,7 @@ func register() { os.Exit(1) } + // TODO(bassosimone): `json.Unmarshal` can fail. var r v0.RegisterResponse json.Unmarshal(body, &r) if r.Error != nil { @@ -201,9 +203,13 @@ func register() { if r.Registration.Credentials == nil { log.Fatalf("Registration credentials are nil:\n%s", body) } + actualSecPath := *outputSecurePath + if actualSecPath == "" { + actualSecPath = *outputPath // keep backward compatibility + } key, err := base64.StdEncoding.DecodeString(r.Registration.Credentials.ServiceAccountKey) rtx.Must(err, "Failed to base64-decode the service-account credentials string") - serviceAccountFilePath := path.Join(*outputPath, serviceAccountFilename) + serviceAccountFilePath := path.Join(actualSecPath, serviceAccountFilename) rtx.Must( os.WriteFile(serviceAccountFilePath, key, 0600), "Failed to write the service-account-key file",