Add flags to support CA generation for Connect #9585
Conversation
github-actions
bot
added
theme/certificates
| Constraints []string | ||
| Domain string | ||
| Name string | ||
| } |
There was a problem hiding this comment.
New struct to make it less confusing when passing options to GenerateCA.
| if opts.ClusterID != "" { | ||
| spiffeID := connect.SpiffeIDSigning{ClusterID: opts.ClusterID, Domain: opts.Domain} | ||
| uris = []*url.URL{spiffeID.URI()} | ||
| } |
There was a problem hiding this comment.
Bunch of defaults, that are being used instead of the null values of CAOpts
| } | ||
|
|
||
| return buf.String(), nil | ||
| return buf.String(), pk, nil |
There was a problem hiding this comment.
Also return the encoded private key, since it no longer mandatory to pass in.
tlsutil/generate.go
Outdated
| template.PermittedDNSDomainsCritical = true | ||
| template.PermittedDNSDomains = constraints | ||
| template.PermittedDNSDomains = opts.Constraints |
There was a problem hiding this comment.
Should constraints here be named something like DNSNames or similar? Seems like that would be more descriptive of how the opt is used.
There was a problem hiding this comment.
I opted for PermittedDNSDomains because why not...
|
🍒 If backport labels were added before merging, cherry-picking will start automatically. To retroactively trigger a backport after merging, add backport labels and re-run https://circleci.com/gh/hashicorp/consul/318212. |
|
🍒✅ Cherry pick of commit 444cdeb onto |
|
🍒✅ Cherry pick of commit 444cdeb onto |
There is one caveat: you have to know your clusterID in order to be able to generate a proper Connect CA. There is at least one way to get that: extract it from an existing Consul Connect CA from the very same cluster.