From 7223f21d5403a29902c3d2a648511eb72a43a987 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julian=20Peliz=C3=A4us?= Date: Fri, 16 Oct 2026 11:32:09 +0200 Subject: [PATCH 1/3] microcluster/types/hooks: Add OnAuthenticate hook MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Julian Pelizäus (cherry picked from commit dfd721934e8f1b23460560b29cd293918b8e02c7) --- microcluster/types/hooks.go | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/microcluster/types/hooks.go b/microcluster/types/hooks.go index 001ac1be..c359729c 100644 --- a/microcluster/types/hooks.go +++ b/microcluster/types/hooks.go @@ -1,6 +1,10 @@ package types -import "context" +import ( + "context" + "crypto/x509" + "net/http" +) // HookType represents the various types of hooks available to microcluster. type HookType string @@ -89,4 +93,12 @@ type Hooks struct { // OnDaemonConfigUpdate is a post-action hook that is run on all cluster members when any cluster member receives a local configuration update. OnDaemonConfigUpdate func(ctx context.Context, s State, config DaemonConfig) error + + // OnAuthenticate is run when an incoming HTTP request needs to be authenticated. + // If defined it is used as a replacement for the regular mTLS check. + // trustedCerts contains the certs from the truststore. + // Returning true indicates that the request is trusted. + // Returning false indicates that the request is not trusted. + // Returning an error is optional but will always result in a forbidden request. + OnAuthenticate func(ctx context.Context, s State, r *http.Request, trustedCerts map[string]x509.Certificate) (bool, error) } From 9f2ff6d7f9f5229c87a05250cc9c2b6df9a876dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julian=20Peliz=C3=A4us?= Date: Fri, 16 Oct 2026 11:32:53 +0200 Subject: [PATCH 2/3] internal/rest/access/auth: Prioritize OnAuthenticate hook over regular mTLS check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Julian Pelizäus (cherry picked from commit a56e8faa13b1abf5a1dde67a56c78aa6b63c80c0) --- internal/rest/access/authentication.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/internal/rest/access/authentication.go b/internal/rest/access/authentication.go index d20fe636..f6f87f0b 100644 --- a/internal/rest/access/authentication.go +++ b/internal/rest/access/authentication.go @@ -132,6 +132,10 @@ func Authenticate(s types.State, r *http.Request, hostAddress string, trustedCer switch r.Host { case hostAddrPort.WithZone("").String(): + if intState.Hooks != nil && intState.Hooks.OnAuthenticate != nil { + return intState.Hooks.OnAuthenticate(r.Context(), s, r, trustedCerts) + } + if r.TLS != nil { for _, cert := range r.TLS.PeerCertificates { trusted, fingerprint := checkMutualTLS(r.Context(), *cert, trustedCerts) From 9b0625df778257e4705c8d2b7983d92b428b6c64 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julian=20Peliz=C3=A4us?= Date: Fri, 16 Oct 2026 14:39:40 +0200 Subject: [PATCH 3/3] microcluster/app: Ignore returned value (errcheck) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We only ever send nil into the chan. Therefore switch to struct{} as its done for ctx.Done(). Signed-off-by: Julian Pelizäus (cherry picked from commit 4de6ffd6b409401fd8225912da15612a13b4e127) --- microcluster/app.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/microcluster/app.go b/microcluster/app.go index 7fe05951..fd2fbb2c 100644 --- a/microcluster/app.go +++ b/microcluster/app.go @@ -141,7 +141,7 @@ func (m *MicroCluster) Status(ctx context.Context) (*types.Status, error) { func (m *MicroCluster) Ready(ctx context.Context) error { logger := slog.New(m.args.LogHandler) - finger := make(chan error, 1) + finger := make(chan struct{}, 1) var errLast error go func() { for i := 0; ; i++ { @@ -185,7 +185,7 @@ func (m *MicroCluster) Ready(ctx context.Context) error { continue } - finger <- nil + finger <- struct{}{} return } }()