Setup intermediate_pki_path on secondary

[hanshasselberg]

Make sure to mount vault backend for intermediate_pki_path on secondary
dc.

[hanshasselberg]

Not sure it is the best way to make sure everything is setup in here, but I didn't find a better place. Using setupIntermediatePKIPathDone as a guard to make sure the setup is only done once.

[mkeeler]

LGTM

[rboyer]

Does this need a mutex or is it only accessed by a single goroutine?

[hanshasselberg]

There are two different flows.

The leader in the primary dc calls this the first time in initializeRootCA while holding caProviderReconfigurationLock:

consul/agent/consul/leader_connect.go

Lines 262 to 266 in ad7fb3a

	// Also create the intermediate CA, which is the one that actually signs leaf certs
	interPEM, err := provider.GenerateIntermediate()
	if err != nil {
	return fmt.Errorf("error generating intermediate cert: %v", err)
	}

The leader in a secondary dc calls this the first time in initializeSecondaryCA while holding caProviderReconfigurationLock:

consul/agent/consul/leader_connect.go

Lines 346 to 349 in ad7fb3a

	activeIntermediate, err := provider.ActiveIntermediate()
	if err != nil {
	return err
	}

An error will prevent the initialization to move on and and it will be retried later. I think this is safe to do. However I considered using atomic just to make sure we don't shoot our foot in case the other code changes.

[rboyer]

Sounds good.

[david-yu]

Hi @i0rek Would it be possible to bring this in for beta3? cc @mikemorris

[mikemorris]

@david-yu Yep, this was merged into the release/1.8.x branch in c675166 and will be included in 1.8.0-beta3 when that happens.