133a6d99f2
The fallback method would still work but it would get into a state where it would let the certificate expire for 10s before getting a new one. And the new one used the less secure RPC endpoint. This is also a pretty large refactoring of the auto encrypt code. I was going to write some tests around the certificate monitoring but it was going to be impossible to get a TestAgent configured in such a way that I could write a test that ran in less than an hour or two to exercise the functionality. Moving the certificate monitoring into its own package will allow for dependency injection and in particular mocking the cache types to control how it hands back certificates and how long those certificates should live. This will allow for exercising the main loop more than would be possible with it coupled so tightly with the Agent.
34 lines
714 B
Go
34 lines
714 B
Go
package connect
|
|
|
|
import (
|
|
"fmt"
|
|
"net/url"
|
|
|
|
"github.com/hashicorp/consul/agent/structs"
|
|
)
|
|
|
|
// SpiffeIDService is the structure to represent the SPIFFE ID for an agent.
|
|
type SpiffeIDAgent struct {
|
|
Host string
|
|
Datacenter string
|
|
Agent string
|
|
}
|
|
|
|
// URI returns the *url.URL for this SPIFFE ID.
|
|
func (id *SpiffeIDAgent) URI() *url.URL {
|
|
var result url.URL
|
|
result.Scheme = "spiffe"
|
|
result.Host = id.Host
|
|
result.Path = fmt.Sprintf("/agent/client/dc/%s/id/%s", id.Datacenter, id.Agent)
|
|
return &result
|
|
}
|
|
|
|
// CertURI impl.
|
|
func (id *SpiffeIDAgent) Authorize(_ *structs.Intention) (bool, bool) {
|
|
return false, false
|
|
}
|
|
|
|
func (id *SpiffeIDAgent) CommonName() string {
|
|
return AgentCN(id.Agent, id.Host)
|
|
}
|