Merge pull request 'set ring as rustls crypto provider when building http clients' (#1473) from mjm/garage:push-nkszolnkwuvt into main-v2

Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/1473

Cargo.toml

@@ -117,7 +117,12 @@ kube = { version = "3.0", default-features = false, features = [
     "rustls-tls",
 ] }
 schemars = "1.2"
-reqwest = { version = "0.13", default-features = false }
+reqwest = { version = "0.13", default-features = false, features = [
+    "rustls-no-provider",
+    "json",
+] }
+rustls = { version = "0.23", default-features = false, features = ["std", "ring"] }
+
 form_urlencoded = "1.2"
 http = "1.4"
 httpdate = "1.0"

script/dev-cluster.sh

@@ -47,6 +47,10 @@ bootstrap_peers = []
 $REPLICATION_MODE
 rpc_secret = "$NETWORK_SECRET"
 
+[consul_discovery]
+service_name = "panic-catcher"
+consul_http_addr = "http://localhost:9876"
+
 [s3_api]
 api_bind_addr = "0.0.0.0:$((3910+$count))"	# the S3 API port, HTTP without TLS. Add a reverse proxy for the TLS part.
 s3_region = "garage"				# set this to anything. S3 API calls will fail if they are not made against the region set here.

src/k2v-client/Cargo.toml

@@ -24,7 +24,7 @@ percent-encoding.workspace = true
 hyper = { workspace = true, default-features = false, features = ["http1", "http2"] }
 hyper-util.workspace = true
 hyper-rustls.workspace = true
-reqwest = { workspace = true, default-features = false, features = ["json", "rustls-no-provider"] }
+rustls.workspace = true
 serde = { workspace = true, default-features = false, features = ["derive", "std"] }
 serde_json.workspace = true
 thiserror.workspace = true

src/k2v-client/lib.rs

@@ -72,7 +72,7 @@ impl K2vClient {
 	/// Create a new K2V client.
 	pub fn new(config: K2vClientConfig) -> Result<Self, Error> {
 		let connector = hyper_rustls::HttpsConnectorBuilder::new()
-			.with_native_roots()?
+			.with_provider_and_native_roots(rustls::crypto::ring::default_provider())?
 			.https_or_http()
 			.enable_http1()
 			.enable_http2()

src/rpc/Cargo.toml

@@ -40,7 +40,11 @@ thiserror = { workspace = true, optional = true }
 kube = { workspace = true, optional = true }
 k8s-openapi = { workspace = true, optional = true }
 schemars = { workspace = true, optional = true }
-reqwest = { workspace = true, optional = true, features = ["json", "rustls"] }
+reqwest = { workspace = true, optional = true }
+hyper = { workspace = true, optional = true }
+hyper-rustls = { workspace = true, optional = true }
+hyper-util = { workspace = true, optional = true }
+rustls = { workspace = true, optional = true }
 
 pnet_datalink.workspace = true
 
@@ -50,7 +54,7 @@ opentelemetry.workspace = true
 
 [features]
 kubernetes-discovery = ["kube", "k8s-openapi", "schemars"]
-consul-discovery = ["reqwest", "thiserror"]
+consul-discovery = ["hyper", "hyper-rustls", "hyper-util", "reqwest", "rustls", "thiserror"]
 system-libs = ["sodiumoxide/use-pkg-config"]
 
 [lints]

src/rpc/consul.rs

@@ -80,6 +80,10 @@ pub struct ConsulDiscovery {
 
 impl ConsulDiscovery {
 	pub fn new(config: ConsulDiscoveryConfig) -> Result<Self, ConsulError> {
+		if rustls::crypto::CryptoProvider::get_default().is_none() {
+			_ = rustls::crypto::ring::default_provider().install_default();
+		}
+
 		let mut builder: reqwest::ClientBuilder = reqwest::Client::builder().use_rustls_tls();
 		if config.tls_skip_verify {
 			builder = builder.danger_accept_invalid_certs(true);

src/rpc/kubernetes.rs

@@ -29,8 +29,15 @@ pub struct Node {
 	port: u16,
 }
 
+pub async fn get_client() -> Result<Client, kube::Error> {
+	if rustls::crypto::CryptoProvider::get_default().is_none() {
+		_ = rustls::crypto::ring::default_provider().install_default();
+	}
+	Client::try_default().await
+}
+
 pub async fn create_kubernetes_crd() -> Result<(), kube::Error> {
-	let client = Client::try_default().await?;
+	let client = get_client().await?;
 	let crds: Api<CustomResourceDefinition> = Api::all(client.clone());
 
 	let params = PatchParams::apply(&format!("garage.{}", K8S_GROUP));
@@ -45,7 +52,7 @@ pub async fn create_kubernetes_crd() -> Result<(), kube::Error> {
 pub async fn get_kubernetes_nodes(
 	kubernetes_config: &KubernetesDiscoveryConfig,
 ) -> Result<Vec<(NodeID, SocketAddr)>, kube::Error> {
-	let client = Client::try_default().await?;
+	let client = get_client().await?;
 	let nodes: Api<GarageNode> = Api::namespaced(client.clone(), &kubernetes_config.namespace);
 
 	let lp = ListParams::default().labels(&format!(
@@ -98,7 +105,7 @@ pub async fn publish_kubernetes_node(
 
 	debug!("Node object to be applied: {:#?}", node);
 
-	let client = Client::try_default().await?;
+	let client = get_client().await?;
 	let nodes: Api<GarageNode> = Api::namespaced(client.clone(), &kubernetes_config.namespace);
 
 	if let Ok(old_node) = nodes.get(&node_pubkey).await {