Adding Client Auth Configs to Infra Ansible #7781
Conversation
ericholguin
added
new feature
|
LGTM |
| "tls_config": { | ||
| "ClientAuth": "{{ to_go_client_auth_enabled }}" | ||
| }, |
There was a problem hiding this comment.
Is there no default in TO that I am leaving this up to?
What does the tls_config get set to without this block as it was before?
There was a problem hiding this comment.
Is there no default in TO that I am leaving this up to?
Not currently, no
What does the tls_config get set to without this block as it was before?
Whatever the TLS config is, empty or no, is used as the server's TLS config. The defaults are internal Go HTTP server logic
trafficcontrol/traffic_ops/traffic_ops_golang/traffic_ops_golang.go
Lines 191 to 193 in 708a95c
| "environment": "{{ to_le_environment }}" | ||
| }, | ||
| "client_certificate_authentication" : { | ||
| "root_certificates_directory" : "{{ to_client_cert_root_directory }}" |
There was a problem hiding this comment.
What creates to_client_cert_root_directory? How do we know it exists?
There was a problem hiding this comment.
It might not exist - for our purposes I handled it in ansible-pull. It already exists on all of our nightly boxes. I will handle this the same way when going to production.
There was a problem hiding this comment.
I added a conditional block to leave this out if the client-cert authentication is disabled.
Adding variables to configure client certificate authentication in the ansible infrastructure's cdn.conf file. Defaulted the values to disable client certificate authentication.
dsouza93
force-pushed
the
ansible_to_root_cert
branch
from
d3d010b to
708a95c
Compare
zrhoffman
left a comment
zrhoffman
left a comment
There was a problem hiding this comment.
This seems fine. It's untested, but it's also a relatively small change. I trust that you'll open a follow-up PR if this breaks anything.
| "tls_config": { | ||
| "ClientAuth": "{{ to_go_client_auth_enabled }}" | ||
| }, |
There was a problem hiding this comment.
Is there no default in TO that I am leaving this up to?
Not currently, no
What does the tls_config get set to without this block as it was before?
Whatever the TLS config is, empty or no, is used as the server's TLS config. The defaults are internal Go HTTP server logic
trafficcontrol/traffic_ops/traffic_ops_golang/traffic_ops_golang.go
Lines 191 to 193 in 708a95c
4 participants
Adding variables to configure client certificate authentication in the ansible infrastructure's cdn.conf file.
Defaulted the values to disable client certificate authentication.
Which Traffic Control components are affected by this PR?
What is the best way to verify this PR?
Build an environment setting the following two variables
You should see the config values set in cdn.conf.
If this is a bugfix, which Traffic Control versions contained the bug?
Not a bug fix
PR submission checklist