enable tls on lens proxy

Signed-off-by: Jari Kolehmainen <jari.kolehmainen@gmail.com>

src/main/cluster.ts

@@ -14,6 +14,7 @@ import { getFeatures, installFeature, uninstallFeature, upgradeFeature } from ".
 import request, { RequestPromiseOptions } from "request-promise-native"
 import { apiResources } from "../common/rbac";
 import logger from "./logger"
+import { getProxyCertificate } from "./lens-proxy-cert";
 
 export enum ClusterStatus {
   AccessGranted = 2,
@@ -93,7 +94,7 @@ export class Cluster implements ClusterModel {
     try {
       this.contextHandler = new ContextHandler(this);
       this.kubeconfigManager = new KubeconfigManager(this, this.contextHandler, port);
-      this.kubeProxyUrl = `http://localhost:${port}${apiKubePrefix}`;
+      this.kubeProxyUrl = `https://localhost:${port}${apiKubePrefix}`;
       this.initialized = true;
       logger.info(`[CLUSTER]: "${this.contextName}" init success`, {
         id: this.id,
@@ -234,6 +235,7 @@ export class Cluster implements ClusterModel {
     return request(apiUrl, {
       json: true,
       timeout: 5000,
+      strictSSL: false, // TODO: use proxy CA
       ...options,
       headers: {
         Host: `${this.id}.${new URL(this.kubeProxyUrl).host}`, // required in ClusterManager.getClusterForRequest()

src/main/index.ts

@@ -18,6 +18,7 @@ import { userStore } from "../common/user-store";
 import { workspaceStore } from "../common/workspace-store";
 import { tracker } from "../common/tracker";
 import logger from "./logger"
+import { getProxyCertificate } from "./lens-proxy-cert";
 
 const workingDir = path.join(app.getPath("appData"), appName);
 app.setName(appName);
@@ -73,6 +74,15 @@ async function main() {
     app.quit();
   }
 
+  const proxyCert = getProxyCertificate()
+  app.on("certificate-error", (event: Electron.Event, webContents: Electron.WebContents, url: string, error: string, certificate: Electron.Certificate, callback: (isTrusted: boolean) => void) => {
+    if (certificate.data.trim().replace(/(?:\r\n)/g, "\n") === proxyCert.cert.trim().replace(/(?:\r\n)/g, "\n")) {
+      callback(true)
+    } else {
+      callback(false)
+    }
+  })
+
   // create window manager and open app
   windowManager = new WindowManager(proxyPort);
 }

src/main/kube-auth-proxy.ts

@@ -31,6 +31,7 @@ export class KubeAuthProxy {
       return;
     }
     const proxyBin = await this.kubectl.getPath()
+    logger.info(proxyBin)
     const args = [
       "proxy",
       "-p", `${this.port}`,

src/main/kubeconfig-manager.ts

@@ -6,6 +6,7 @@ import path from "path"
 import fs from "fs-extra"
 import { dumpConfigYaml, loadConfig } from "../common/kube-helpers"
 import logger from "./logger"
+import { getProxyCertificate } from "./lens-proxy-cert";
 
 export class KubeconfigManager {
   protected configDir = app.getPath("temp")
@@ -29,7 +30,7 @@ export class KubeconfigManager {
   }
 
   protected resolveProxyUrl() {
-    return `http://127.0.0.1:${this.port}/${this.cluster.id}`
+    return `https://127.0.0.1:${this.port}/${this.cluster.id}`
   }
 
   /**
@@ -47,11 +48,11 @@ export class KubeconfigManager {
         {
           name: contextName,
           server: this.resolveProxyUrl(),
-          skipTLSVerify: undefined,
+          skipTLSVerify: true
         }
       ],
       users: [
-        { name: "proxy" },
+        { name: "proxy", username: "lens", password: "lens" },
       ],
       contexts: [
         {

src/main/lens-proxy-cert.ts

@@ -0,0 +1,27 @@
+import *  as path from "path"
+import * as fs from "fs"
+import * as selfsigned from "selfsigned"
+import logger from "./logger"
+
+export type SelfSignedCert = {
+  private: string;
+  public: string;
+  cert: string;
+}
+
+let selfSignedCertificate: SelfSignedCert = null
+
+export function getProxyCertificate(): SelfSignedCert {
+  if (selfSignedCertificate == null) {
+    const attrs = [{ name: "commonName", value: "localhost"}]
+    selfSignedCertificate = selfsigned.generate(attrs, {
+      keySize: 2048,
+      algorithm: "sha256",
+      days: 365,
+      extensions: [{ name: 'basicConstraints', cA: true }]
+    }) as SelfSignedCert
+    console.log(selfSignedCertificate)
+  }
+
+  return selfSignedCertificate
+}

src/main/lens-proxy.ts

@@ -10,6 +10,7 @@ import { Router } from "./router"
 import { ClusterManager } from "./cluster-manager"
 import { ContextHandler } from "./context-handler";
 import logger from "./logger"
+import { getProxyCertificate } from "./lens-proxy-cert";
 
 export class LensProxy {
   protected origin: string
@@ -23,7 +24,7 @@ export class LensProxy {
   }
 
   private constructor(protected port: number, protected clusterManager: ClusterManager) {
-    this.origin = `http://localhost:${port}`
+    this.origin = `https://localhost:${port}`
     this.router = new Router();
   }
 
@@ -41,9 +42,12 @@ export class LensProxy {
 
   protected buildCustomProxy(): http.Server {
     const proxy = this.createProxy();
+    const proxyCert = getProxyCertificate()
     const spdyProxy = spdy.createServer({
+      key: proxyCert.private,
+      cert: proxyCert.cert,
       spdy: {
-        plain: true,
+        plain: false,
         protocols: ["http/1.1", "spdy/3.1"]
       }
     }, (req: http.IncomingMessage, res: http.ServerResponse) => {

src/main/window-manager.ts

@@ -71,7 +71,7 @@ export class WindowManager {
   async showMain() {
     try {
       await this.showSplash();
-      await this.mainView.loadURL(`http://localhost:${this.proxyPort}`)
+      await this.mainView.loadURL(`https://localhost:${this.proxyPort}`)
       this.mainView.show();
       this.splashWindow.close();
     } catch (err) {