feat(go): add config to disable tls for netmaker server grpc client;

config/config.go

@@ -108,6 +108,7 @@ type ServerConfig struct {
 	DefaultDomain              string        `yaml:"default_domain"`
 	PublicIp                   string        `yaml:"public_ip"`
 	GrpcEndpoint               string        `yaml:"grpc_endpoint"`
+	GrpcTLS                    string        `yaml:"grpc_tls"`
 }
 
 // SQLConfig - Generic SQL Config

grpc/auditlogs/client.go

@@ -54,7 +54,7 @@ func Client() *GrpcClient {
 	defaultClientOnce.Do(func() {
 		defaultClient = NewAuditLogsGrpcClient(
 			servercfg.GetGrpcEndpoint(),
-			options.WithTLS(&tls.Config{}),
+			options.WithTLSIf(servercfg.IsGrpcTLSEnabled(), &tls.Config{}),
 		)
 
 		// The default client is lazy. It connects only when an export is requested.

grpc/flow/client.go

@@ -2,6 +2,7 @@ package flow
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"io"
 	"sync"
@@ -47,7 +48,10 @@ func NewGrpcClient(serverAddr string, optFns ...func(*options.Options)) *GrpcCli
 
 func Client() *GrpcClient {
 	defaultClientOnce.Do(func() {
-		defaultClient = NewGrpcClient(servercfg.GetGrpcEndpoint())
+		defaultClient = NewGrpcClient(
+			servercfg.GetGrpcEndpoint(),
+			options.WithTLSIf(servercfg.IsGrpcTLSEnabled(), &tls.Config{}),
+		)
 	})
 	return defaultClient
 }

grpc/options/options.go

@@ -37,6 +37,15 @@ func WithTLS(cfg *tls.Config) func(*Options) {
 	return func(o *Options) { o.TLSCreds = credentials.NewTLS(cfg) }
 }
 
+// WithTLSIf applies WithTLS only when enabled is true.
+func WithTLSIf(enabled bool, cfg *tls.Config) func(*Options) {
+	return func(o *Options) {
+		if enabled {
+			WithTLS(cfg)(o)
+		}
+	}
+}
+
 func WithBatchSize(n int) func(*Options) {
 	return func(o *Options) { o.BatchSize = n }
 }

grpc/siem/client.go

@@ -39,7 +39,7 @@ func Client() *GrpcClient {
 	defaultClientOnce.Do(func() {
 		defaultClient = NewSIEMGrpcClient(
 			servercfg.GetGrpcEndpoint(),
-			options.WithTLS(&tls.Config{}),
+			options.WithTLSIf(servercfg.IsGrpcTLSEnabled(), &tls.Config{}),
 		)
 	})
 	return defaultClient

scripts/netmaker.default.env

@@ -111,4 +111,5 @@ NETMAKER_METRICS_TARGET=http://netmaker-exporter:8085  #https://netmaker-exporte
 METRICS_SECRET=
 
 GRPC_ENDPOINT=netmaker-exporter:50051
+GRPC_TLS=false
 

servercfg/serverconf.go

@@ -855,6 +855,19 @@ func GetGrpcEndpoint() string {
 	return fmt.Sprintf("grpc.%s", GetNmBaseDomain())
 }
 
+// IsGrpcTLSEnabled - returns true if the grpc clients should use TLS.
+// Defaults to TLS for the public grpc.<NM_DOMAIN> endpoint (fronted by the proxy)
+// and to plaintext when a custom endpoint is set (e.g. netmaker-exporter:50051).
+func IsGrpcTLSEnabled() bool {
+	if os.Getenv("GRPC_TLS") != "" {
+		return os.Getenv("GRPC_TLS") == "true"
+	} else if config.Config.Server.GrpcTLS != "" {
+		return config.Config.Server.GrpcTLS == "true"
+	}
+
+	return os.Getenv("GRPC_ENDPOINT") == "" && config.Config.Server.GrpcEndpoint == ""
+}
+
 // IsHA - returns true if running in High Availability mode (multiple replicas)
 func IsHA() bool {
 	return os.Getenv("IS_HA") == "true"