New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
WIP: [cli] Interactive root rotation #2104
Conversation
…es all the nodes to have an IssuanceStateRotate to trigger all the nodes to get new certificates. When all the nodes have rotated their certificates to be signed by the desired issuer, complete root rotation. Signed-off-by: cyli <ying.li@docker.com>
Signed-off-by: cyli <ying.li@docker.com>
…ng the store for all nodes at intervals, rely on the cluster and node watches to update an in-memory mapping of the current nodes. At regular intervals, update the store to tell a throttled number of the unconverged nodes to rotate their certificates. Also, remove the leader rotation part of the root rotation integration test, as that takes a very long time. There are server tests to ensure that multiple CA servers running reconciliation loops, and starting a CA server from a stopped state, does not break root reconciliation. Signed-off-by: cyli <ying.li@docker.com>
Signed-off-by: cyli <ying.li@docker.com>
Signed-off-by: cyli <ying.li@docker.com>
This is neat but I'm not sure about putting fancy features into swarmctl. Shouldn't we be focusing our energy on the docker CLI? I'm a bit confused about the long-term future of swarmctl. I know there are efforts to make it work for "stand alone swarmd", but it seems strange to fragment our efforts across two CLIs. What do we gain by having two CLIs? cc @aluzzardi |
@aaronlehmann Makes sense - I interpreted |
From a UX perspective looking at the example recordings ;
|
I think it is worth having a IMHO the priority should be getting this working end-to-end in the Docker CLI. Hopefully the progress indicator can be ported over there without too much trouble. |
@thaJeztah No, it detaches from waiting, and the root rotation goes on (or not) as it was. |
If the priority is just the docker CLI, I'll abandon this one and just open the docker one, if that's ok. We can come back and add stuff to |
SGTM |
This is based on moby/moby#31144.
Todo:
cluster inspect
or add a new command to resume checking root CA progress?Basic root rotation: https://asciinema.org/a/ddsnrnzob16v3ampmbqjf3j55
Root rotation when there's another root rotation: https://asciinema.org/a/19ah16sg29it0fyeellflpe68
This is stacked on top of #2100
cc @diogomonica @aaronlehmann