@@ -5,6 +5,13 @@ defmodule SpawnOperator.K8s.System.Secret.ActorSystemSecret do
5
5
6
6
import Bonny.Config , only: [ conn: 0 ]
7
7
8
+ @ erlang_profiles % {
9
+ insecure_erl_flags:
10
+ "+C multi_time_warp -mode embedded +sbwt none +sbwtdcpu none +sbwtdio none" ,
11
+ tls_erl_flags:
12
+ " -proto_dist inet_tls -ssl_dist_optfile /app/mtls.ssl.conf +C multi_time_warp -mode embedded +sbwt none +sbwtdcpu none +sbwtdio none"
13
+ }
14
+
8
15
@ impl true
9
16
def manifest ( resource , _opts \\ [ ] ) , do: gen_secret ( resource )
10
17
@@ -26,7 +33,7 @@ defmodule SpawnOperator.K8s.System.Secret.ActorSystemSecret do
26
33
27
34
data =
28
35
Map . merge ( distributed_options , storage_options )
29
- |> maybe_use_nats_cluster ( name , ns , params )
36
+ |> maybe_use_nats_cluster ( name , ns , cluster_params )
30
37
31
38
% {
32
39
"apiVersion" => "v1" ,
@@ -85,9 +92,20 @@ defmodule SpawnOperator.K8s.System.Secret.ActorSystemSecret do
85
92
end
86
93
87
94
defp get_dist_options ( system , ns , params ) do
88
-
89
95
kind = Map . get ( params , "kind" , "erlang" )
90
96
97
+ features =
98
+ Map . get ( params , "features" , % { "erlangMtls" => % { "enabled" => false } } )
99
+
100
+ erlang_mtls_enabled =
101
+ Map . get ( features , "erlangMtls" , % { } )
102
+ |> Map . get ( "enabled" , false )
103
+
104
+ erlang_profile =
105
+ if erlang_mtls_enabled ,
106
+ do: @ erlang_profiles . tls_erl_flags ,
107
+ else: @ erlang_profiles . insecure_erl_flags
108
+
91
109
case String . to_existing_atom ( kind ) do
92
110
:erlang ->
93
111
cookie = Map . get ( params , "cookie" , default_cookie ( ns ) ) |> Base . encode64 ( )
@@ -97,6 +115,8 @@ defmodule SpawnOperator.K8s.System.Secret.ActorSystemSecret do
97
115
cluster_heartbeat = "240000" |> Base . encode64 ( )
98
116
99
117
% {
118
+ "ERL_CLUSTER_MTL_ENABLED" => Base . encode64 ( "#{ erlang_mtls_enabled } " ) ,
119
+ "ERL_FLAGS" => Base . encode64 ( erlang_profile ) ,
100
120
"RELEASE_COOKIE" => cookie ,
101
121
"PROXY_ACTOR_SYSTEM_NAME" => Base . encode64 ( system ) ,
102
122
"PROXY_CLUSTER_POLLING" => cluster_poolling ,
@@ -112,8 +132,6 @@ defmodule SpawnOperator.K8s.System.Secret.ActorSystemSecret do
112
132
% {
113
133
"PROXY_CLUSTER_STRATEGY" => cluster_strategy ,
114
134
"PROXY_HEADLESS_SERVICE" => cluster_service
115
- # "PROXY_TLS_CERT_PATH" => "",
116
- # "PROXY_TLS_KEY_PATH" => ""
117
135
}
118
136
119
137
_other ->
@@ -122,28 +140,40 @@ defmodule SpawnOperator.K8s.System.Secret.ActorSystemSecret do
122
140
end
123
141
124
142
defp maybe_use_nats_cluster ( config , _name , namespace , params ) do
125
- cluster_params = Map . get ( params , "cluster" , % { } )
126
- features = Map . get ( cluster_params , "features" , % { } )
143
+ features =
144
+ Map . get ( params , "features" , % {
145
+ "nats" => % {
146
+ "enabled" => false ,
147
+ "url" => "nats://nats.eigr-functions.svc.cluster.local:4222" ,
148
+ "credentialsSecretRef" => "nats-connectin-secret"
149
+ }
150
+ } )
151
+
127
152
nats_params = Map . get ( features , "nats" , % { } )
128
- enabled = "#{ Map . get ( nats_params , "enabled" , false ) } "
153
+
154
+ nats_enabled =
155
+ Map . get ( nats_params , "enabled" )
156
+
157
+ nats_url =
158
+ Map . get ( nats_params , "url" )
129
159
130
160
nats_config =
131
- case enabled do
132
- " false" ->
161
+ case nats_enabled do
162
+ false ->
133
163
% { }
134
164
135
- " true" ->
165
+ true ->
136
166
nats_secret_ref = Map . fetch! ( nats_params , "credentialsSecretRef" )
137
167
138
168
{ :ok , secret } =
139
169
K8s.Client . get ( "v1" , :secret ,
140
- namespace: namespace ,
170
+ namespace: "eigr-functions" ,
141
171
name: nats_secret_ref
142
172
)
143
173
|> then ( & K8s.Client . run ( conn ( ) , & 1 ) )
144
174
145
175
secret_data = Map . get ( secret , "data" )
146
- nats_host_url = Map . get ( secret_data , "url" , nats_params [ "url" ] )
176
+ nats_host_url = nats_url |> Base . encode64 ( )
147
177
nats_auth = Map . get ( secret_data , "authEnabled" , "false" )
148
178
nats_user = Map . get ( secret_data , "username" )
149
179
nats_secret = Map . get ( secret_data , "password" )
0 commit comments