R.I.Pienaar ripienaar

Certificate free TLS when using Choria AAA

One mainly would use the AAA server when there isn't a managed CA like the one from Puppet easily available, typically clients in that scenario has a desire to have no certificates at all - just a choria client.

We therefor need to support anonymous TLS where the connection is still encrypted using TLS but it's not verified.

When supporting this mode it's very important that the core Choria network does not run in downgraded security mode, so we will use a NATS technology called leafnodes to create a dedicated Choria Broker these clients would

	package main

	import (
	"context"
	"fmt"
	"github.com/choria-io/fisk"
	"github.com/nats-io/jsm.go/natscontext"
	"github.com/nats-io/nats.go"
	"os"
	"os/signal"

	name: demo
	description: Demo application for Choria App Builder
	author: https://github.com/choria-io/appbuilder

	commands:
	- name: say
	description: Say something using the configured command
	type: exec
	command: \|
	{{ default .Config.Cowsay "cowsay" }} {{ .Arguments.message \| escape }}

	Server information for broker-broker-2.broker-broker-ss.choria.svc.cluster.local (ND5KNTKGIJIDQ6SXFIVHM7WOWALPSO5XHBTUANVLNPCUMZNSSHOZ4CAU)

	Process Details:

	Version: 2.2.1
	Git Commit:
	Go Version: go1.16.2
	Start Time: 2021-03-18 14:56:51.576983822 +0000 UTC
	Uptime: 27m6s

	[rip@dev1]% nats --context system.ams server list 3 <16:21:16
	+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
	\| Server Overview \|
	+-----------------------------------------------------------+------------+----------------------+---------+----+-------+------+--------+-----+---------+-----+------+--------+-------------+
	\| Name \| Cluster \| IP \| Version \| JS \| Conns \| Subs \| Routes \| GWs \| Mem \| CPU \| Slow \| Uptime \| RTT \|
	+-----------------------------------------------------------+---------

	{
	"type": "io.nats.server.advisory.v1.client_disconnect",
	"id": "DncyzipRGFfASo0FGtr3F8",
	"timestamp": "2021-03-18T15:20:58.553514622Z",
	"server": {
	"name": "broker-broker-2.broker-broker-ss.choria.svc.cluster.local",
	"host": "choria.example.net",
	"id": "ND5KNTKGIJIDQ6SXFIVHM7WOWALPSO5XHBTUANVLNPCUMZNSSHOZ4CAU",
	"cluster": "CHORIA",
	"ver": "2.2.1",

	/etc/puppetlabs/mcollective/client.cfg
	loglevel = debug


	> mco puppet status
	debug 2021/01/21 16:52:15: pluginmanager.rb:162:in `loadclass' Loading Mcollective::Facts::Yaml_facts from mcollective/facts/yaml_facts.rb
	debug 2021/01/21 16:52:15: pluginmanager.rb:43:in `<<' Registering plugin facts_plugin with class MCollective::Facts::Yaml_facts single_instance: true
	debug 2021/01/21 16:52:15: pluginmanager.rb:162:in `loadclass' Loading Mcollective::Connector::Nats from mcollective/connector/nats.rb
	debug 2021/01/21 16:52:15: cache.rb:117:in `block in ttl' Cache miss on 'ddl' key 'connector/nats'
	debug 2021/01/21 16:52:15: base.rb:100:in `block in findddlfile' Found nats ddl at /opt/puppetlabs/mcollective/plugins/mcollective/connector/nats.ddl

	$ cat list
	n1.example.net
	n2.example.net

	$ ./test --nodes list <21:21:44
	Discovering nodes .... 2

	2 / 2 0s [====================================================================] 100%

	n1.example.net

	&ApiError{Code: 503, Description: "jetstream not enabled for account"}
	&ApiError{Code: 400, Description: "bad request"}
	&ApiError{Code: 400, Description: "expected an empty request payload"}
	&ApiError{Code: 400, Description: "invalid JSON received in request"}
	&ApiError{Code: 400, Description: "template name in subject does not match request"}
	&ApiError{Code: 400, Description: "stream name in subject does not match request"}
	&ApiError{Code: 400, Description: "stream name in subject does not match request"}
	&ApiError{Code: 403, Description: "not allowed to delete internal stream"}
	&ApiError{Code: 400, Description: fmt.Sprintf("sequence [%d] not found", req.Seq)}
	&ApiError{Code: 400, Description: fmt.Sprintf("stream [%q] already exists", stream)}

	[rip@dev1]% nats server list --user system <15:24:12
	+----------------------------------------------------------------------------------------------------------------------------+
	\| Server Overview \|
	+--------+------------+-----------+---------------+-------+------+--------+-----+---------+-----+------+--------+------------+
	\| Name \| Cluster \| IP \| Version \| Conns \| Subs \| Routes \| GWs \| Mem \| CPU \| Slow \| Uptime \| RTT \|
	+--------+------------+-----------+---------------+-------+------+--------+-----+---------+-----+------+--------+------------+
	\| nc1-c1 \| c1 \| localhost \| 2.2.0-beta.23 \| 1 \| 71 \| 2 \| 2 \| 9.1 MiB \| 0.0 \| 0 \| 12m31s \| 3.573146ms \|
	\| nc2-c1 \| c1 \| localhost \| 2.2.0-beta.23 \| 0 \| 71