From d3df971af5063a0f0aa3aa06ce0616f85932cdb6 Mon Sep 17 00:00:00 2001
From: Alex Kampmeier <alexander.kampmeier@gmail.com>
Date: Wed, 10 Nov 2021 09:57:21 +0100
Subject: [PATCH] fix(config): support tls config via env variables for single
 alertmanager server

---
 internal/config/config.go      |  9 +++++++++
 internal/config/config_test.go | 16 ++++++++++++++++
 internal/config/models.go      | 15 +++++++++------
 3 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/internal/config/config.go b/internal/config/config.go
index 5c85e43a2..611229dd6 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -52,6 +52,12 @@ func SetupFlags(f *pflag.FlagSet) {
 	f.Bool("alertmanager.readonly", false,
 		"Enable read-only mode that disable silence management (only used with simplified config)")
 	f.String("alertmanager.cors.credentials", "include", "CORS credentials policy for browser fetch requests")
+	f.String("alertmanager.tls.ca", "", "Path to CA certificate used to establish TLS connection to the "+
+		"Alertmanager server (only used with simplified config)")
+	f.String("alertmanager.tls.cert", "", "Path to a TLS client certificate file to use when establishing "+
+		"TLS connections to the Alertmanager server - requires alertmanager.tls.key to be set (only used with simplified config)")
+	f.String("alertmanager.tls.key", "", "Path to a TLS client key file to use when establishing "+
+		"TLS connections to the Alertmanager server - requires alertmanager.tls.key to be set (only used with simplified config)")
 
 	f.String("karma.name", "karma", "Name for the karma instance")
 
@@ -209,6 +215,8 @@ func readEnvVariables(k *koanf.Koanf) {
 		switch s {
 		case "ALERTMANAGER_EXTERNAL_URI":
 			return "alertmanager.external_uri"
+		case "ALERTMANAGER_TLS_INSECURE_SKIP_VERIFY":
+			return "alertmanager.tls.insecureSkipVerify"
 		case "ALERTACKNOWLEDGEMENT_ENABLED":
 			return "alertAcknowledgement.enabled"
 		case "ALERTACKNOWLEDGEMENT_DURATION":
@@ -450,6 +458,7 @@ func (config *configSchema) Read(flags *pflag.FlagSet) (string, error) {
 				ReadOnly:    config.Alertmanager.ReadOnly,
 				Headers:     make(map[string]string),
 				CORS:        config.Alertmanager.CORS,
+				TLS:         config.Alertmanager.TLS,
 			},
 		}
 	}
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 212e7e645..01a0ce6ad 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -229,6 +229,10 @@ func TestReadSimpleConfig(t *testing.T) {
 	t.Setenv("ALERTMANAGER_TIMEOUT", "15s")
 	t.Setenv("ALERTMANAGER_PROXY", "true")
 	t.Setenv("ALERTMANAGER_INTERVAL", "3m")
+	t.Setenv("ALERTMANAGER_TLS_CA", "/my-ca.cer")
+	t.Setenv("ALERTMANAGER_TLS_CERT", "/my-cert.cer")
+	t.Setenv("ALERTMANAGER_TLS_KEY", "/my-cert.key")
+	t.Setenv("ALERTMANAGER_TLS_INSECURE_SKIP_VERIFY", "true")
 	_, _ = mockConfigRead()
 	if len(Config.Alertmanager.Servers) != 1 {
 		t.Errorf("Expected 1 Alertmanager server, got %d", len(Config.Alertmanager.Servers))
@@ -252,6 +256,18 @@ func TestReadSimpleConfig(t *testing.T) {
 		if am.Proxy != true {
 			t.Errorf("Expect Alertmanager proxy 'true' got '%v'", am.Proxy)
 		}
+		if am.TLS.CA != "/my-ca.cer" {
+			t.Errorf("Expected Alertmanager TLS CA '/my-ca.cer' got '%s'", am.TLS.CA)
+		}
+		if am.TLS.Cert != "/my-cert.cer" {
+			t.Errorf("Expected Alertmanager TLS Cert '/my-cert.cer' got '%s'", am.TLS.Cert)
+		}
+		if am.TLS.Key != "/my-cert.key" {
+			t.Errorf("Expected Alertmanager TLS Key '/my-cert.key' got '%s'", am.TLS.Key)
+		}
+		if am.TLS.InsecureSkipVerify != true {
+			t.Errorf("Expected Alertmanager TLS insecureSkipVerify 'true' got '%v'", am.TLS.InsecureSkipVerify)
+		}
 	}
 }
 
diff --git a/internal/config/models.go b/internal/config/models.go
index 938388976..16fc41fcd 100644
--- a/internal/config/models.go
+++ b/internal/config/models.go
@@ -9,6 +9,13 @@ type AlertmanagerCORS struct {
 	Credentials string
 }
 
+type AlertmanagerTLS struct {
+	CA                 string
+	Cert               string
+	Key                string
+	InsecureSkipVerify bool `yaml:"insecureSkipVerify" koanf:"insecureSkipVerify"`
+}
+
 type AlertmanagerHealthcheck struct {
 	Visible bool                `yaml:"visible" koanf:"visible"`
 	Filters map[string][]string `yaml:"filters" koanf:"filters"`
@@ -23,12 +30,7 @@ type AlertmanagerConfig struct {
 	Timeout     time.Duration
 	Proxy       bool
 	ReadOnly    bool `yaml:"readonly"`
-	TLS         struct {
-		CA                 string
-		Cert               string
-		Key                string
-		InsecureSkipVerify bool `yaml:"insecureSkipVerify" koanf:"insecureSkipVerify"`
-	}
+	TLS         AlertmanagerTLS
 	Headers     map[string]string
 	CORS        AlertmanagerCORS        `yaml:"cors" koanf:"cors"`
 	Healthcheck AlertmanagerHealthcheck `yaml:"healthcheck" koanf:"healthcheck"`
@@ -96,6 +98,7 @@ type configSchema struct {
 		Proxy       bool             `yaml:"-" koanf:"proxy"`
 		ReadOnly    bool             `yaml:"-" koanf:"readonly"`
 		CORS        AlertmanagerCORS `yaml:"-" koanf:"cors"`
+		TLS         AlertmanagerTLS  `yaml:"-" koanf:"tls"`
 	}
 	AlertAcknowledgement struct {
 		Enabled  bool