fix: [stable-9.0][OCISDEV-1687] pass enabletls to the jsoncs3 share manager and OCM

changelog/unreleased/bugfix-sharing-jsoncs3-events-tls.md

@@ -0,0 +1,10 @@
+Bugfix: Turn on the events TLS in the jsoncs3 share manager and in OCM
+
+The sharing service now gives the `OCIS_EVENTS_ENABLE_TLS` setting to the
+jsoncs3 share manager. The ocm service now gives this setting to the
+sciencemesh and the ocmcore event connections. Before, these connections did
+not turn on TLS for the connection to the events broker. Thus they did not use
+the root CA certificate. The connection to a NATS server with a private CA
+failed. The services tried again for up to 15 minutes.
+
+https://github.com/owncloud/ocis/pull/13444

services/ocm/pkg/revaconfig/config.go

@@ -89,6 +89,7 @@ func OCMConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]inter
 						"natsclusterid":        cfg.Events.Cluster,
 						"tlsinsecure":          cfg.Events.TLSInsecure,
 						"tlsrootcacertificate": cfg.Events.TLSRootCACertificate,
+						"enabletls":            cfg.Events.EnableTLS,
 						"authusername":         cfg.Events.AuthUsername,
 						"authpassword":         cfg.Events.AuthPassword,
 						"credsfile":            cfg.Events.CredsFile,
@@ -189,6 +190,7 @@ func OCMConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]inter
 						"natsclusterid":        cfg.Events.Cluster,
 						"tlsinsecure":          cfg.Events.TLSInsecure,
 						"tlsrootcacertificate": cfg.Events.TLSRootCACertificate,
+						"enabletls":            cfg.Events.EnableTLS,
 						"authusername":         cfg.Events.AuthUsername,
 						"authpassword":         cfg.Events.AuthPassword,
 						"credsfile":            cfg.Events.CredsFile,

services/ocm/pkg/revaconfig/config_test.go

@@ -0,0 +1,69 @@
+package revaconfig
+
+import (
+	"testing"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	"github.com/owncloud/ocis/v2/ocis-pkg/shared"
+	"github.com/owncloud/ocis/v2/services/ocm/pkg/config/defaults"
+)
+
+// TestEventsNatsSettings checks that each events map in the reva config of the
+// ocm service gets all the connection, TLS and authentication settings of the
+// events broker.
+func TestEventsNatsSettings(t *testing.T) {
+	cfg := defaults.FullDefaultConfig()
+	// The runtime sets the shared settings and the gRPC TLS settings. The defaults do not.
+	cfg.Commons = &shared.Commons{OcisURL: "https://ocis.example.com"}
+	cfg.GRPC.TLS = &shared.GRPCServiceTLS{}
+	cfg.Events.Endpoint = "nats.example.com:4222"
+	cfg.Events.Cluster = "ocis-cluster"
+	cfg.Events.EnableTLS = true
+	cfg.Events.TLSInsecure = true
+	cfg.Events.TLSRootCACertificate = "/etc/ocis/ca.crt"
+	cfg.Events.AuthUsername = "nats-user"
+	cfg.Events.AuthPassword = "nats-password"
+	cfg.Events.CredsFile = "/etc/ocis/nats.creds"
+	cfg.Events.Creds = "creds-content"
+
+	revaCfg := OCMConfigFromStruct(cfg, log.NopLogger())
+
+	httpServices := revaCfg["http"].(map[string]interface{})["services"].(map[string]interface{})
+	grpcServices := revaCfg["grpc"].(map[string]interface{})["services"].(map[string]interface{})
+
+	want := map[string]interface{}{
+		"natsaddress":          "nats.example.com:4222",
+		"natsclusterid":        "ocis-cluster",
+		"enabletls":            true,
+		"tlsinsecure":          true,
+		"tlsrootcacertificate": "/etc/ocis/ca.crt",
+		"authusername":         "nats-user",
+		"authpassword":         "nats-password",
+		"credsfile":            "/etc/ocis/nats.creds",
+		"creds":                "creds-content",
+	}
+
+	tests := []struct {
+		name   string
+		events map[string]interface{}
+	}{
+		{
+			name:   "sciencemesh",
+			events: httpServices["sciencemesh"].(map[string]interface{})["events"].(map[string]interface{}),
+		},
+		{
+			name:   "ocmcore",
+			events: grpcServices["ocmcore"].(map[string]interface{})["events"].(map[string]interface{}),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			for key, value := range want {
+				if got := tt.events[key]; got != value {
+					t.Errorf("%s = %v, want %v", key, got, value)
+				}
+			}
+		})
+	}
+}

services/sharing/pkg/revaconfig/config.go

@@ -74,6 +74,7 @@ func SharingConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string]
 								"natsclusterid":        cfg.Events.Cluster,
 								"tlsinsecure":          cfg.Events.TLSInsecure,
 								"tlsrootcacertificate": cfg.Events.TLSRootCACertificate,
+								"enabletls":            cfg.Events.EnableTLS,
 								"authusername":         cfg.Events.AuthUsername,
 								"authpassword":         cfg.Events.AuthPassword,
 								"credsfile":            cfg.Events.CredsFile,

services/sharing/pkg/revaconfig/config_test.go

@@ -0,0 +1,83 @@
+package revaconfig
+
+import (
+	"testing"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	"github.com/owncloud/ocis/v2/ocis-pkg/shared"
+	"github.com/owncloud/ocis/v2/services/sharing/pkg/config/defaults"
+)
+
+// TestEventsNatsSettings checks that each events map in the reva config of the
+// sharing service gets all the connection, TLS and authentication settings of
+// the events broker.
+func TestEventsNatsSettings(t *testing.T) {
+	cfg := defaults.FullDefaultConfig()
+	// The runtime sets the gRPC TLS settings. The defaults do not.
+	cfg.GRPC.TLS = &shared.GRPCServiceTLS{}
+	cfg.Events.Endpoint = "nats.example.com:4222"
+	cfg.Events.Cluster = "ocis-cluster"
+	cfg.Events.EnableTLS = true
+	cfg.Events.TLSInsecure = true
+	cfg.Events.TLSRootCACertificate = "/etc/ocis/ca.crt"
+	cfg.Events.AuthUsername = "nats-user"
+	cfg.Events.AuthPassword = "nats-password"
+	cfg.Events.CredsFile = "/etc/ocis/nats.creds"
+	cfg.Events.Creds = "creds-content"
+
+	revaCfg, err := SharingConfigFromStruct(cfg, log.NopLogger())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	grpc := revaCfg["grpc"].(map[string]interface{})
+	userShareProvider := grpc["services"].(map[string]interface{})["usershareprovider"].(map[string]interface{})
+	jsoncs3 := userShareProvider["drivers"].(map[string]interface{})["jsoncs3"].(map[string]interface{})
+
+	tests := []struct {
+		name   string
+		events map[string]interface{}
+		want   map[string]interface{}
+	}{
+		{
+			name:   "jsoncs3 share manager",
+			events: jsoncs3["events"].(map[string]interface{}),
+			want: map[string]interface{}{
+				"natsaddress":          "nats.example.com:4222",
+				"natsclusterid":        "ocis-cluster",
+				"enabletls":            true,
+				"tlsinsecure":          true,
+				"tlsrootcacertificate": "/etc/ocis/ca.crt",
+				"authusername":         "nats-user",
+				"authpassword":         "nats-password",
+				"credsfile":            "/etc/ocis/nats.creds",
+				"creds":                "creds-content",
+			},
+		},
+		{
+			name:   "events middleware",
+			events: grpc["interceptors"].(map[string]interface{})["eventsmiddleware"].(map[string]interface{}),
+			want: map[string]interface{}{
+				"address":          "nats.example.com:4222",
+				"clusterID":        "ocis-cluster",
+				"enable-tls":       true,
+				"tls-insecure":     true,
+				"tls-root-ca-cert": "/etc/ocis/ca.crt",
+				"username":         "nats-user",
+				"password":         "nats-password",
+				"creds-file":       "/etc/ocis/nats.creds",
+				"creds":            "creds-content",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			for key, value := range tt.want {
+				if got := tt.events[key]; got != value {
+					t.Errorf("%s = %v, want %v", key, got, value)
+				}
+			}
+		})
+	}
+}