X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/e31f6c9eb427302eb48150d431afcc962954b061..fe45b1b66c730f2546d78a7899375707c0816518:/sdk/go/arvadosclient/arvadosclient.go?ds=inline

diff --git a/sdk/go/arvadosclient/arvadosclient.go b/sdk/go/arvadosclient/arvadosclient.go
index aeb81f9317..021b9471ff 100644
--- a/sdk/go/arvadosclient/arvadosclient.go
+++ b/sdk/go/arvadosclient/arvadosclient.go
@@ -5,16 +5,20 @@ package arvadosclient
 import (
 	"bytes"
 	"crypto/tls"
+	"crypto/x509"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net/http"
 	"net/url"
 	"os"
 	"regexp"
 	"strings"
 	"time"
+
+	"git.curoverse.com/arvados.git/sdk/go/arvados"
 )
 
 type StringMatcher func(string) bool
@@ -101,22 +105,73 @@ type ArvadosClient struct {
 	Retries int
 }
 
+var CertFiles = []string{
+	"/etc/arvados/ca-certificates.crt",
+	"/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu/Gentoo etc.
+	"/etc/pki/tls/certs/ca-bundle.crt",   // Fedora/RHEL
+}
+
+// MakeTLSConfig sets up TLS configuration for communicating with Arvados and Keep services.
+func MakeTLSConfig(insecure bool) *tls.Config {
+	tlsconfig := tls.Config{InsecureSkipVerify: insecure}
+
+	if !insecure {
+		// Look for /etc/arvados/ca-certificates.crt in addition to normal system certs.
+		certs := x509.NewCertPool()
+		for _, file := range CertFiles {
+			data, err := ioutil.ReadFile(file)
+			if err == nil {
+				success := certs.AppendCertsFromPEM(data)
+				if !success {
+					fmt.Printf("Unable to load any certificates from %v", file)
+				} else {
+					tlsconfig.RootCAs = certs
+					break
+				}
+			}
+		}
+		// Will use system default CA roots instead.
+	}
+
+	return &tlsconfig
+}
+
+// New returns an ArvadosClient using the given arvados.Client
+// configuration. This is useful for callers who load arvados.Client
+// fields from configuration files but still need to use the
+// arvadosclient.ArvadosClient package.
+func New(c *arvados.Client) (*ArvadosClient, error) {
+	ac := &ArvadosClient{
+		Scheme:      "https",
+		ApiServer:   c.APIHost,
+		ApiToken:    c.AuthToken,
+		ApiInsecure: c.Insecure,
+		Client: &http.Client{Transport: &http.Transport{
+			TLSClientConfig: MakeTLSConfig(c.Insecure)}},
+		External:          false,
+		Retries:           2,
+		lastClosedIdlesAt: time.Now(),
+	}
+
+	return ac, nil
+}
+
 // MakeArvadosClient creates a new ArvadosClient using the standard
 // environment variables ARVADOS_API_HOST, ARVADOS_API_TOKEN,
 // ARVADOS_API_HOST_INSECURE, ARVADOS_EXTERNAL_CLIENT, and
 // ARVADOS_KEEP_SERVICES.
-func MakeArvadosClient() (ac ArvadosClient, err error) {
+func MakeArvadosClient() (ac *ArvadosClient, err error) {
 	var matchTrue = regexp.MustCompile("^(?i:1|yes|true)$")
 	insecure := matchTrue.MatchString(os.Getenv("ARVADOS_API_HOST_INSECURE"))
 	external := matchTrue.MatchString(os.Getenv("ARVADOS_EXTERNAL_CLIENT"))
 
-	ac = ArvadosClient{
+	ac = &ArvadosClient{
 		Scheme:      "https",
 		ApiServer:   os.Getenv("ARVADOS_API_HOST"),
 		ApiToken:    os.Getenv("ARVADOS_API_TOKEN"),
 		ApiInsecure: insecure,
 		Client: &http.Client{Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: insecure}}},
+			TLSClientConfig: MakeTLSConfig(insecure)}},
 		External: external,
 		Retries:  2}
 
@@ -146,7 +201,7 @@ func MakeArvadosClient() (ac ArvadosClient, err error) {
 
 // CallRaw is the same as Call() but returns a Reader that reads the
 // response body, instead of taking an output object.
-func (c ArvadosClient) CallRaw(method string, resourceType string, uuid string, action string, parameters Dict) (reader io.ReadCloser, err error) {
+func (c *ArvadosClient) CallRaw(method string, resourceType string, uuid string, action string, parameters Dict) (reader io.ReadCloser, err error) {
 	scheme := c.Scheme
 	if scheme == "" {
 		scheme = "https"
@@ -292,7 +347,7 @@ func newAPIServerError(ServerAddress string, resp *http.Response) APIServerError
 // Returns a non-nil error if an error occurs making the API call, the
 // API responds with a non-successful HTTP status, or an error occurs
 // parsing the response body.
-func (c ArvadosClient) Call(method, resourceType, uuid, action string, parameters Dict, output interface{}) error {
+func (c *ArvadosClient) Call(method, resourceType, uuid, action string, parameters Dict, output interface{}) error {
 	reader, err := c.CallRaw(method, resourceType, uuid, action, parameters)
 	if reader != nil {
 		defer reader.Close()
@@ -311,22 +366,22 @@ func (c ArvadosClient) Call(method, resourceType, uuid, action string, parameter
 }
 
 // Create a new resource. See Call for argument descriptions.
-func (c ArvadosClient) Create(resourceType string, parameters Dict, output interface{}) error {
+func (c *ArvadosClient) Create(resourceType string, parameters Dict, output interface{}) error {
 	return c.Call("POST", resourceType, "", "", parameters, output)
 }
 
 // Delete a resource. See Call for argument descriptions.
-func (c ArvadosClient) Delete(resource string, uuid string, parameters Dict, output interface{}) (err error) {
+func (c *ArvadosClient) Delete(resource string, uuid string, parameters Dict, output interface{}) (err error) {
 	return c.Call("DELETE", resource, uuid, "", parameters, output)
 }
 
 // Modify attributes of a resource. See Call for argument descriptions.
-func (c ArvadosClient) Update(resourceType string, uuid string, parameters Dict, output interface{}) (err error) {
+func (c *ArvadosClient) Update(resourceType string, uuid string, parameters Dict, output interface{}) (err error) {
 	return c.Call("PUT", resourceType, uuid, "", parameters, output)
 }
 
 // Get a resource. See Call for argument descriptions.
-func (c ArvadosClient) Get(resourceType string, uuid string, parameters Dict, output interface{}) (err error) {
+func (c *ArvadosClient) Get(resourceType string, uuid string, parameters Dict, output interface{}) (err error) {
 	if !UUIDMatch(uuid) && !(resourceType == "collections" && PDHMatch(uuid)) {
 		// No object has uuid == "": there is no need to make
 		// an API call. Furthermore, the HTTP request for such
@@ -338,7 +393,7 @@ func (c ArvadosClient) Get(resourceType string, uuid string, parameters Dict, ou
 }
 
 // List resources of a given type. See Call for argument descriptions.
-func (c ArvadosClient) List(resource string, parameters Dict, output interface{}) (err error) {
+func (c *ArvadosClient) List(resource string, parameters Dict, output interface{}) (err error) {
 	return c.Call("GET", resource, "", "", parameters, output)
 }