luxolus
/
open-consul
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

connect: add ExternalTrustDomain to CARoot fields

This commit is contained in:
Kyle Havlovitz 2018-09-17 02:00:28 -07:00
parent 475afd0300
commit 304595f7a6
3 changed files with 26 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
agent/consul/connect_ca_endpoint.go
View File

@ -107,7 +107,7 @@ func (s *ConnectCA) ConfigurationSet(
return err return err
} }
newActiveRoot, err := parseCARoot(newRootPEM, args.Config.Provider) newActiveRoot, err := parseCARoot(newRootPEM, args.Config.Provider, args.Config.ClusterID)
if err != nil { if err != nil {
return err return err
} }
@ -276,16 +276,17 @@ func (s *ConnectCA) Roots(
// directly to the structure in the memdb store. // directly to the structure in the memdb store.
reply.Roots[i] = &structs.CARoot{ reply.Roots[i] = &structs.CARoot{
ID: r.ID, ID: r.ID,
Name: r.Name, Name: r.Name,
SerialNumber: r.SerialNumber, SerialNumber: r.SerialNumber,
SigningKeyID: r.SigningKeyID, SigningKeyID: r.SigningKeyID,
NotBefore: r.NotBefore, ExternalTrustDomain: r.ExternalTrustDomain,
NotAfter: r.NotAfter, NotBefore: r.NotBefore,
RootCert: r.RootCert, NotAfter: r.NotAfter,
IntermediateCerts: r.IntermediateCerts, RootCert: r.RootCert,
RaftIndex: r.RaftIndex, IntermediateCerts: r.IntermediateCerts,
Active: r.Active, RaftIndex: r.RaftIndex,
Active: r.Active,
} }
if r.Active { if r.Active {

21
agent/consul/leader.go
View File

@ -445,7 +445,7 @@ func (s *Server) initializeCA() error {
return fmt.Errorf("error getting root cert: %v", err) return fmt.Errorf("error getting root cert: %v", err)
} }
rootCA, err := parseCARoot(rootPEM, conf.Provider) rootCA, err := parseCARoot(rootPEM, conf.Provider, conf.ClusterID)
if err != nil { if err != nil {
return err return err
} }
@ -501,7 +501,7 @@ func (s *Server) initializeCA() error {
} }
// parseCARoot returns a filled-in structs.CARoot from a raw PEM value. // parseCARoot returns a filled-in structs.CARoot from a raw PEM value.
func parseCARoot(pemValue, provider string) (*structs.CARoot, error) { func parseCARoot(pemValue, provider, clusterID string) (*structs.CARoot, error) {
id, err := connect.CalculateCertFingerprint(pemValue) id, err := connect.CalculateCertFingerprint(pemValue)
if err != nil { if err != nil {
return nil, fmt.Errorf("error parsing root fingerprint: %v", err) return nil, fmt.Errorf("error parsing root fingerprint: %v", err)
@ -511,14 +511,15 @@ func parseCARoot(pemValue, provider string) (*structs.CARoot, error) {
return nil, fmt.Errorf("error parsing root cert: %v", err) return nil, fmt.Errorf("error parsing root cert: %v", err)
} }
return &structs.CARoot{ return &structs.CARoot{
ID: id, ID: id,
Name: fmt.Sprintf("%s CA Root Cert", strings.Title(provider)), Name: fmt.Sprintf("%s CA Root Cert", strings.Title(provider)),
SerialNumber: rootCert.SerialNumber.Uint64(), SerialNumber: rootCert.SerialNumber.Uint64(),
SigningKeyID: connect.HexString(rootCert.AuthorityKeyId), SigningKeyID: connect.HexString(rootCert.AuthorityKeyId),
NotBefore: rootCert.NotBefore, ExternalTrustDomain: clusterID,
NotAfter: rootCert.NotAfter, NotBefore: rootCert.NotBefore,
RootCert: pemValue, NotAfter: rootCert.NotAfter,
Active: true, RootCert: pemValue,
Active: true,
}, nil }, nil
} }

3
agent/structs/connect_ca.go
View File

@ -54,6 +54,9 @@ type CARoot struct {
// private key used to sign the certificate. // private key used to sign the certificate.
SigningKeyID string SigningKeyID string
// ExternalTrustDomain is the trust domain this root was generated under.
ExternalTrustDomain string
// Time validity bounds. // Time validity bounds.
NotBefore time.Time NotBefore time.Time
NotAfter time.Time NotAfter time.Time