stream: can use user certificates

JulienBalestra · JulienBalestra · commit b82b5242600c · 2018-08-27T19:26:14.000+02:00
Signed-off-by: JulienBalestra &lt;julien.balestra@datadoghq.com&gt;
diff --git a/pkg/config/config.go b/pkg/config/config.go
@@ -114,6 +114,10 @@ type PluginConfig struct {
 	SystemdCgroup bool `toml:"systemd_cgroup" json:"systemdCgroup"`
 	// EnableTLSStreaming indicates to enable the TLS streaming support.
 	EnableTLSStreaming bool `toml:"enable_tls_streaming" json:"enableTLSStreaming"`
+	// TLSCertFileStreaming is the path to a certificate file
+	TLSCertFileStreaming string `toml:"tls_cert_file_streaming" json:"tlsCertFileStreaming"`
+	// TLSKeyFileStreaming is the path to a private key file
+	TLSKeyFileStreaming string `toml:"tls_key_file_streaming" json:"tlsKeyFileStreaming"`
 	// MaxContainerLogLineSize is the maximum log line size in bytes for a container.
 	// Log line longer than the limit will be split into multiple lines. Non-positive
 	// value means no limit.
diff --git a/pkg/server/streaming.go b/pkg/server/streaming.go
@@ -44,18 +44,30 @@ func newStreamServer(c *criService, addr, port string) (streaming.Server, error)
 	}
 	config := streaming.DefaultConfig
 	config.Addr = net.JoinHostPort(addr, port)
-	runtime := newStreamRuntime(c)
-	if c.config.EnableTLSStreaming {
-		tlsCert, err := newTLSCert()
+	run := newStreamRuntime(c)
+	if !c.config.EnableTLSStreaming {
+		return streaming.NewServer(config, run)
+	}
+	if c.config.TLSCertFileStreaming != "" && c.config.TLSKeyFileStreaming != "" {
+		tlsCert, err := tls.LoadX509KeyPair(c.config.TLSCertFileStreaming, c.config.TLSKeyFileStreaming)
 		if err != nil {
-			return nil, errors.Wrap(err, "failed to generate tls certificate for stream server")
+			return nil, errors.Wrap(err, "failed to load x509 key pair for stream server")
 		}
 		config.TLSConfig = &tls.Config{
-			Certificates:       []tls.Certificate{tlsCert},
-			InsecureSkipVerify: true,
+			Certificates: []tls.Certificate{tlsCert},
 		}
+		return streaming.NewServer(config, run)
+	}
+	// generating self-sign certs
+	tlsCert, err := newTLSCert()
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to generate tls certificate for stream server")
+	}
+	config.TLSConfig = &tls.Config{
+		Certificates:       []tls.Certificate{tlsCert},
+		InsecureSkipVerify: true,
 	}
-	return streaming.NewServer(config, runtime)
+	return streaming.NewServer(config, run)
 }
 
 type streamRuntime struct {
