mtca: add S3 connection (#8885)

Author: jsha

cmd/boulder-mtca/main.go

@@ -14,6 +14,7 @@ import (
 	"github.com/jmhodges/clock"
 
 	"github.com/letsencrypt/borp"
+	"github.com/letsencrypt/boulder/bs3"
 	"github.com/letsencrypt/boulder/cmd"
 	"github.com/letsencrypt/boulder/config"
 	bgrpc "github.com/letsencrypt/boulder/grpc"
@@ -28,7 +29,8 @@ type Config struct {
 
 		GRPCMTCA *cmd.GRPCServerConfig
 
-		DB cmd.DBConfig
+		DB cmd.DBConfig `validate:"required"`
+		S3 bs3.Config   `validate:"required"`
 
 		// Issuer holds the configuration for a single MTCA instance with a single mtcaID.
 		// We run a separate process for each issuer.
@@ -90,7 +92,15 @@ func main() {
 	cmd.FailOnError(err, "Opening DB")
 	dbMap := &borp.DbMap{Db: db, Dialect: borp.MySQLDialect{}}
 
-	mtcaImpl, err := mtca.New(issuer, c.MTCA.SequencingPeriod.Duration, dbMap, logger)
+	s3c, err := bs3.FromConfig(c.MTCA.S3, logger)
+	cmd.FailOnError(err, "Loading S3 config")
+
+	mtcaImpl, err := mtca.New(
+		issuer,
+		c.MTCA.SequencingPeriod.Duration,
+		dbMap,
+		s3c,
+		logger)
 	cmd.FailOnError(err, "Building MTCA")
 
 	if *initLog && *initLogForTest {

mtca/mtca.go

@@ -14,6 +14,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/letsencrypt/borp"
 
 	corepb "github.com/letsencrypt/boulder/core/proto"
@@ -30,7 +31,13 @@ var ErrCheckpointNotReady = errors.New("not ready - no mirror signature")
 var _ mtcapb.MTCAServer = &mtca{}
 
 // New creates a new MTCA service.
-func New(issuer *issuance.Issuer, sequencingPeriod time.Duration, dbMap *borp.DbMap, logger blog.Logger) (*mtca, error) {
+func New(
+	issuer *issuance.Issuer,
+	sequencingPeriod time.Duration,
+	dbMap *borp.DbMap,
+	s3c simpleS3,
+	logger blog.Logger,
+) (*mtca, error) {
 	mtcaID, err := getMTCAID(issuer.Cert.Certificate)
 	if err != nil {
 		return nil, err
@@ -50,6 +57,7 @@ func New(issuer *issuance.Issuer, sequencingPeriod time.Duration, dbMap *borp.Db
 		sequencingPeriod: sequencingPeriod,
 
 		db:  initDB(dbMap),
+		s3c: s3c,
 		log: logger,
 	}, nil
 }
@@ -67,11 +75,20 @@ type mtca struct {
 	// TODO: decide whether we want to route this through the SA or an SA-like object,
 	// or keep a direct DB connection from the MTCA.
 	db  *db.WrappedMap
+	s3c simpleS3
 	log blog.Logger
 
 	pool *pool
 }
 
+// simpleS3 matches the subset of the s3.Client interface which we use, to allow
+// simpler mocking in tests.
+type simpleS3 interface {
+	PutObject(ctx context.Context, params *s3.PutObjectInput, optFns ...func(*s3.Options)) (*s3.PutObjectOutput, error)
+	GetObject(ctx context.Context, params *s3.GetObjectInput, optFns ...func(*s3.Options)) (*s3.GetObjectOutput, error)
+	Bucket() string
+}
+
 func getMTCAID(issuerCert *x509.Certificate) (string, error) {
 	testingTrustAnchorIDOID := asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 44363, 47, 1}
 	for _, attribute := range issuerCert.Subject.Names {

mtca/mtca_test.go

@@ -17,6 +17,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/jmhodges/clock"
 	"github.com/letsencrypt/borp"
 
@@ -53,7 +54,7 @@ func setup() (*mtca, func(), error) {
 
 	logger := blog.NewMock()
 
-	mtca, err := New(issuer, 100*time.Millisecond, dbMap, logger)
+	mtca, err := New(issuer, 100*time.Millisecond, dbMap, &fakeS3{}, logger)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -317,3 +318,18 @@ DgQIBAaC3xMBAgEwCgYIKoZIzj0EAwIDQQAwPgIdAMebuq7759hyFC3hjrVUEaXk
 		t.Errorf("getMTCAID(): got %s, want %s", mtcaID, expected)
 	}
 }
+
+type fakeS3 struct {
+}
+
+func (f *fakeS3) PutObject(ctx context.Context, params *s3.PutObjectInput, optFns ...func(*s3.Options)) (*s3.PutObjectOutput, error) {
+	return nil, fmt.Errorf("unimplemented")
+}
+
+func (f *fakeS3) GetObject(ctx context.Context, params *s3.GetObjectInput, optFns ...func(*s3.Options)) (*s3.GetObjectOutput, error) {
+	return nil, fmt.Errorf("unimplemented")
+}
+
+func (f *fakeS3) Bucket() string {
+	return "fake bucket"
+}

test/config-next/mtca-s3-config.ini

@@ -0,0 +1,2 @@
+[default]
+region=us-west-1

test/config-next/mtca.json

@@ -4,6 +4,12 @@
 		"db": {
 			"dbConnectFile": "test/secrets/mtca1_dburl"
 		},
+		"s3": {
+			"s3endpoint": "http://boulder-minio:9000",
+			"s3bucket": "boulder-mtc-tiles",
+			"awsConfigFile": "test/config-next/mtca-s3-config.ini",
+			"awsCredsFile": "test/secrets/mtca-s3-creds.ini"
+		},
 		"tls": {
 			"caCertFile": "test/certs/ipki/minica.pem",
 			"certFile": "test/certs/ipki/mtca.boulder/cert.pem",

test/secrets/mtca-s3-creds.ini

@@ -0,0 +1,3 @@
+[default]
+aws_access_key_id=minioadmin
+aws_secret_access_key=minioadmin