Kyle Havlovitz
|
883b2a518a
|
Store the time CARoot is rotated out instead of when to prune
|
2018-07-06 16:05:25 -07:00 |
|
Kyle Havlovitz
|
3c520019e9
|
connect/ca: add logic for pruning old stale RootCA entries
|
2018-07-02 10:35:05 -07:00 |
|
Kyle Havlovitz
|
859eaea5c4
|
connect/ca: pull the cluster ID from config during a rotation
|
2018-06-25 12:25:42 -07:00 |
|
Kyle Havlovitz
|
f3089a6647
|
connect/ca: undo the interface changes and use sign-self-issued in Vault
|
2018-06-25 12:25:42 -07:00 |
|
Kyle Havlovitz
|
cea94d0bcf
|
connect/ca: update Consul provider to use new cross-sign CSR method
|
2018-06-25 12:25:41 -07:00 |
|
Paul Banks
|
824a9b4943
|
Actually return Intermediate certificates bundled with a leaf!
|
2018-06-25 12:25:40 -07:00 |
|
Paul Banks
|
30d90b3be4
|
Generate CSR using real trust-domain
|
2018-06-14 09:42:16 -07:00 |
|
Paul Banks
|
5a1408f186
|
Add CSR signing verification of service ACL, trust domain and datacenter.
|
2018-06-14 09:42:16 -07:00 |
|
Paul Banks
|
c808833a78
|
Return TrustDomain from CARoots RPC
|
2018-06-14 09:42:15 -07:00 |
|
Kyle Havlovitz
|
1660f9ebab
|
Add more metadata to structs.CARoot
|
2018-06-14 09:42:15 -07:00 |
|
Mitchell Hashimoto
|
749f81373f
|
agent/consul: check nil on getCAProvider result
|
2018-06-14 09:42:14 -07:00 |
|
Paul Banks
|
dcd277de8a
|
Wire up agent leaf endpoint to cache framework to support blocking.
|
2018-06-14 09:42:07 -07:00 |
|
Kyle Havlovitz
|
b28e11fdd3
|
Fill out connect CA rpc endpoint tests
|
2018-06-14 09:42:06 -07:00 |
|
Kyle Havlovitz
|
a29f3c6b96
|
Fix some inconsistencies around the CA provider code
|
2018-06-14 09:42:06 -07:00 |
|
Kyle Havlovitz
|
2167713226
|
Add CA config to connect section of agent config
|
2018-06-14 09:42:05 -07:00 |
|
Kyle Havlovitz
|
887cc98d7e
|
Simplify the CAProvider.Sign method
|
2018-06-14 09:42:04 -07:00 |
|
Kyle Havlovitz
|
44b30476cb
|
Simplify the CA provider interface by moving some logic out
|
2018-06-14 09:42:04 -07:00 |
|
Kyle Havlovitz
|
aa10fb2f48
|
Clarify some comments and names around CA bootstrapping
|
2018-06-14 09:42:04 -07:00 |
|
Kyle Havlovitz
|
43f13d5a0b
|
Add cross-signing mechanism to root rotation
|
2018-06-14 09:42:00 -07:00 |
|
Kyle Havlovitz
|
bbfcb278e1
|
Add the root rotation mechanism to the CA config endpoint
|
2018-06-14 09:41:59 -07:00 |
|
Kyle Havlovitz
|
a585a0ba10
|
Have the built in CA store its state in raft
|
2018-06-14 09:41:59 -07:00 |
|
Kyle Havlovitz
|
fc9ef9741b
|
Hook the CA RPC endpoint into the provider interface
|
2018-06-14 09:41:59 -07:00 |
|
Mitchell Hashimoto
|
da1bc48372
|
agent/connect: rename SpiffeID to CertURI
|
2018-06-14 09:41:53 -07:00 |
|
Mitchell Hashimoto
|
b0315811b9
|
agent/connect: use proper keyusage fields for CA and leaf
|
2018-06-14 09:41:53 -07:00 |
|
Mitchell Hashimoto
|
2026cf3753
|
agent/consul: encode issued cert serial number as hex encoded
|
2018-06-14 09:41:53 -07:00 |
|
Mitchell Hashimoto
|
746f80639a
|
agent: /v1/connect/ca/configuration PUT for setting configuration
|
2018-06-14 09:41:52 -07:00 |
|
Mitchell Hashimoto
|
a8510f8224
|
agent/consul: set more fields on the issued cert
|
2018-06-14 09:41:52 -07:00 |
|
Mitchell Hashimoto
|
58b6f476e8
|
agent: /v1/connect/ca/leaf/:service_id
|
2018-06-14 09:41:52 -07:00 |
|
Mitchell Hashimoto
|
80a058a573
|
agent/consul: CAS operations for setting the CA root
|
2018-06-14 09:41:51 -07:00 |
|
Mitchell Hashimoto
|
712888258b
|
agent/consul: tests for CA endpoints
|
2018-06-14 09:41:51 -07:00 |
|
Mitchell Hashimoto
|
1928c07d0c
|
agent/consul: key the public key of the CSR, verify in test
|
2018-06-14 09:41:51 -07:00 |
|
Mitchell Hashimoto
|
9a8653f45e
|
agent/consul: test for ConnectCA.Sign
|
2018-06-14 09:41:51 -07:00 |
|
Mitchell Hashimoto
|
a360c5cca4
|
agent/consul: basic sign endpoint not tested yet
|
2018-06-14 09:41:51 -07:00 |
|
Mitchell Hashimoto
|
24830f4cfa
|
agent/consul: RPC endpoints to list roots
|
2018-06-14 09:41:50 -07:00 |