stackrox · juanrh · Jan 17, 2022 · Dec 28, 2021 · Dec 28, 2021 · Jan 3, 2022
diff --git a/central/localscanner/certificates.go b/central/localscanner/certificates.go
@@ -1,15 +1,64 @@
 package localscanner
 
 import (
+	"github.com/hashicorp/go-multierror"
 	"github.com/pkg/errors"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/certgen"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/mtls"
 )
 
 // secretDataMap represents data stored as part of a secret.
 type secretDataMap = map[string][]byte
 
+// IssueLocalScannerCerts issue certificates for a local scanner running in secured clusters.
+func IssueLocalScannerCerts(namespace string, clusterID string) (*storage.TypedServiceCertificateSet, error) {
+	if !features.LocalImageScanning.Enabled() {
+		return nil, errors.Errorf("feature '%s' is disabled", features.LocalImageScanning.Name())
+	}
+	if namespace == "" {
+		return nil, errors.New("namespace is required to issue the certificates for the local scanner")
+	}
+
+	var certIssueError error
+	caPem, scannerCertificate, err := localScannerCertificatesFor(storage.ServiceType_SCANNER_SERVICE, namespace, clusterID)
+	if err != nil {
+		certIssueError = multierror.Append(certIssueError, err)
+	}
+	_, scannerDBCertificate, err := localScannerCertificatesFor(storage.ServiceType_SCANNER_DB_SERVICE, namespace, clusterID)
+	if err != nil {
+		certIssueError = multierror.Append(certIssueError, err)
+	}
+	if certIssueError != nil {
+		return nil, certIssueError
+	}
+
+	return &storage.TypedServiceCertificateSet{
+		CaPem: caPem,
+		ServiceCerts: []*storage.TypedServiceCertificate{
+			scannerCertificate,
+			scannerDBCertificate,
+		},
+	}, nil
+}
+
+func localScannerCertificatesFor(serviceType storage.ServiceType, namespace string, clusterID string) (caPem []byte, cert *storage.TypedServiceCertificate, err error) {
+	certificates, err := generateServiceCertMap(serviceType, namespace, clusterID)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "generating certificate for service %s", serviceType)
+	}
+	caPem = certificates[mtls.CACertFileName]
+	cert = &storage.TypedServiceCertificate{
+		ServiceType: serviceType,
+		Cert: &storage.ServiceCertificate{
+			CertPem: certificates[mtls.ServiceCertFileName],
+			KeyPem:  certificates[mtls.ServiceKeyFileName],
+		},
+	}
+	return caPem, cert, err
+}
+
 func generateServiceCertMap(serviceType storage.ServiceType, namespace string, clusterID string) (secretDataMap, error) {
 	if serviceType != storage.ServiceType_SCANNER_SERVICE && serviceType != storage.ServiceType_SCANNER_DB_SERVICE {
 		return nil, errors.Errorf("can only generate certificates for Scanner services, service type %s is not supported",

diff --git a/central/localscanner/certificates_test.go b/central/localscanner/certificates_test.go
@@ -9,6 +9,7 @@ import (
 	testutilsMTLS "github.com/stackrox/rox/central/testutils/mtls"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/certgen"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/mtls"
 	"github.com/stackrox/rox/pkg/testutils/envisolator"
 	"github.com/stretchr/testify/suite"
@@ -52,18 +53,19 @@ func (s *localScannerSuite) TestCertMapContainsExpectedFiles() {
 	}
 
 	for _, tc := range testCases {
-		certMap, err := generateServiceCertMap(tc.service, namespace, clusterID)
-		if tc.expectError {
-			s.Require().Error(err, tc.service)
-			continue
-		} else {
-			s.Require().NoError(err, tc.service)
-		}
-		expectedFiles := []string{"ca.pem", "cert.pem", "key.pem"}
-		s.Assert().Equal(len(expectedFiles), len(certMap))
-		for _, key := range expectedFiles {
-			s.Assert().Contains(certMap, key, tc.service)
-		}
+		s.Run(tc.service.String(), func() {
+			certMap, err := generateServiceCertMap(tc.service, namespace, clusterID)
+			if tc.expectError {
+				s.Require().Error(err)
+				return
+			}
+			s.Require().NoError(err)
+			expectedFiles := []string{"ca.pem", "cert.pem", "key.pem"}
+			s.Len(certMap, len(expectedFiles))
+			for _, key := range expectedFiles {
+				s.Contains(certMap, key)
+			}
+		})
 	}
 }
 
@@ -74,11 +76,13 @@ func (s *localScannerSuite) TestValidateServiceCertificate() {
 	}
 
 	for _, serviceType := range testCases {
-		certMap, err := generateServiceCertMap(serviceType, namespace, clusterID)
-		s.Require().NoError(err, serviceType)
-		validatingCA, err := mtls.LoadCAForValidation(certMap["ca.pem"])
-		s.Require().NoError(err, serviceType)
-		s.Assert().NoError(certgen.VerifyServiceCert(certMap, validatingCA, serviceType, ""), serviceType)
+		s.Run(serviceType.String(), func() {
+			certMap, err := generateServiceCertMap(serviceType, namespace, clusterID)
+			s.Require().NoError(err)
+			validatingCA, err := mtls.LoadCAForValidation(certMap["ca.pem"])
+			s.Require().NoError(err)
+			s.NoError(certgen.VerifyServiceCert(certMap, validatingCA, serviceType, ""))
+		})
 	}
 }
 
@@ -95,23 +99,67 @@ func (s *localScannerSuite) TestCertificateGeneration() {
 	}
 
 	for _, tc := range testCases {
-		certMap, err := generateServiceCertMap(tc.service, namespace, clusterID)
-		s.Require().NoError(err, tc.service)
-		cert, err := helpers.ParseCertificatePEM(certMap["cert.pem"])
-		s.Require().NoError(err, tc.service)
-
-		subject := cert.Subject
-		certOUs := subject.OrganizationalUnit
-		s.Assert().Equal(1, len(certOUs), tc.service)
-		s.Assert().Equal(tc.expectOU, certOUs[0], tc.service)
-
-		s.Assert().Equal(fmt.Sprintf("%s: %s", tc.expectOU, clusterID), subject.CommonName, tc.service)
-
-		certAlternativeNames := cert.DNSNames
-		s.Assert().Equal(len(tc.expectedAlternativeNames), len(certAlternativeNames), tc.service)
-		for _, name := range tc.expectedAlternativeNames {
-			s.Assert().Contains(certAlternativeNames, name, tc.service)
-		}
-		s.Assert().Equal(cert.NotBefore.Add(2*24*time.Hour), cert.NotAfter, tc.service)
+		s.Run(tc.service.String(), func() {
+			certMap, err := generateServiceCertMap(tc.service, namespace, clusterID)
+			s.Require().NoError(err)
+			cert, err := helpers.ParseCertificatePEM(certMap["cert.pem"])
+			s.Require().NoError(err)
+
+			subject := cert.Subject
+			certOUs := subject.OrganizationalUnit
+			s.Require().Len(certOUs, 1)
+			s.Equal(tc.expectOU, certOUs[0])
+
+			s.Equal(fmt.Sprintf("%s: %s", tc.expectOU, clusterID), subject.CommonName)
+
+			certAlternativeNames := cert.DNSNames
+			s.ElementsMatch(tc.expectedAlternativeNames, certAlternativeNames)
+			s.Equal(cert.NotBefore.Add(2*24*time.Hour), cert.NotAfter)
+		})
+	}
+}
+
+func (s *localScannerSuite) TestServiceIssueLocalScannerCertsFeatureFlagDisabled() {
+	s.envIsolator.Setenv(features.LocalImageScanning.EnvVar(), "false")
+	if features.LocalImageScanning.Enabled() {
+		s.T().Skip()
+	}
+
+	_, err := IssueLocalScannerCerts(namespace, clusterID)
+
+	s.Error(err)
+}
+
+func (s *localScannerSuite) TestServiceIssueLocalScannerCerts() {
+	s.envIsolator.Setenv(features.LocalImageScanning.EnvVar(), "true")
+	if !features.LocalImageScanning.Enabled() {
+		s.T().Skip()
+	}
+	testCases := map[string]struct {
+		namespace  string
+		clusterID  string
+		shouldFail bool
+	}{
+		"no parameter missing": {namespace: namespace, clusterID: clusterID, shouldFail: false},
+		"namespace missing":    {namespace: "", clusterID: clusterID, shouldFail: true},
+		"clusterID missing":    {namespace: namespace, clusterID: "", shouldFail: true},
+	}
+	for tcName, tc := range testCases {
+		s.Run(tcName, func() {
+			certs, err := IssueLocalScannerCerts(tc.namespace, tc.clusterID)
+			if tc.shouldFail {
+				s.Require().Error(err)
+				return
+			}
+			s.Require().NoError(err)
+			s.Require().NotNil(certs.GetCaPem())
+			s.Require().NotEmpty(certs.GetServiceCerts())
+			for _, cert := range certs.ServiceCerts {
+				s.Contains([]storage.ServiceType{storage.ServiceType_SCANNER_SERVICE,
+					storage.ServiceType_SCANNER_DB_SERVICE}, cert.GetServiceType())
+				s.NotEmpty(cert.GetCert().GetCertPem())
+				s.NotEmpty(cert.GetCert().GetKeyPem())
+			}
+		})
 	}
 }
diff --git a/central/sensor/service/connection/connection_impl.go b/central/sensor/service/connection/connection_impl.go
@@ -2,8 +2,10 @@ package connection
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/pkg/errors"
+	"github.com/stackrox/rox/central/localscanner"
 	"github.com/stackrox/rox/central/networkpolicies/graph"
 	"github.com/stackrox/rox/central/scrape"
 	"github.com/stackrox/rox/central/sensor/networkentities"
@@ -215,6 +217,8 @@ func (c *sensorConnection) handleMessage(ctx context.Context, msg *central.MsgFr
 		return c.networkPoliciesCtrl.ProcessNetworkPoliciesResponse(m.NetworkPoliciesResponse)
 	case *central.MsgFromSensor_TelemetryDataResponse:
 		return c.telemetryCtrl.ProcessTelemetryDataResponse(m.TelemetryDataResponse)
+	case *central.MsgFromSensor_IssueLocalScannerCertsRequest:
+		return c.processIssueLocalScannerCertsRequest(ctx, m.IssueLocalScannerCertsRequest)
 	case *central.MsgFromSensor_Event:
 		// Special case the reprocess deployment because its fields are already set
 		if msg.GetEvent().GetReprocessDeployment() != nil {
@@ -234,6 +238,47 @@ func (c *sensorConnection) handleMessage(ctx context.Context, msg *central.MsgFr
 	return c.eventPipeline.Run(ctx, msg, c)
 }
 
+func (c *sensorConnection) processIssueLocalScannerCertsRequest(ctx context.Context, request *central.IssueLocalScannerCertsRequest) error {
+	requestID := request.GetRequestId()
+	clusterID := c.clusterID
+	namespace := c.sensorHello.GetDeploymentIdentification().GetAppNamespace()
+	errMsg := fmt.Sprintf("issuing local Scanner certificates for request ID %q, cluster ID %q and namespace %q",
+		requestID, clusterID, namespace)
+	var (
+		err      error
+		response *central.IssueLocalScannerCertsResponse
+	)
+	if requestID == "" {
+		err = errors.New("requestID is required to issue the certificates for the local scanner")
+	} else {
+		var certificates *storage.TypedServiceCertificateSet
+		certificates, err = localscanner.IssueLocalScannerCerts(namespace, clusterID)
+		response = &central.IssueLocalScannerCertsResponse{
+			RequestId: requestID,
+			Response: &central.IssueLocalScannerCertsResponse_Certificates{
+				Certificates: certificates,
+			},
+		}
+	}
+	if err != nil {
+		response = &central.IssueLocalScannerCertsResponse{
+			RequestId: requestID,
+			Response: &central.IssueLocalScannerCertsResponse_Error{
+				Error: &central.LocalScannerCertsIssueError{
+					Message: fmt.Sprintf("%s: %s", errMsg, err.Error()),
+				},
+			},
+		}
+	}
+	err = c.InjectMessage(ctx, &central.MsgToSensor{
+		Msg: &central.MsgToSensor_IssueLocalScannerCertsResponse{IssueLocalScannerCertsResponse: response},
+	})
+	if err != nil {
+		return errors.Wrap(err, errMsg)
+	}
+	return nil
+}
+
 // getPolicySyncMsg fetches stored policies and prepares them for delivery to sensor.
 func (c *sensorConnection) getPolicySyncMsg(ctx context.Context) (*central.MsgToSensor, error) {
 	policies, err := c.policyMgr.GetAllPolicies(ctx)