-
Notifications
You must be signed in to change notification settings - Fork 316
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add get-consul-client-ca command #211
Conversation
49c4e4a
to
354e9d6
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks good!
A couple of themes to my comments:
-
Not importing anything from Consul besides the api or sdk. I understand that not all of these might be possible right now, but it might be good to figure out a plan for how to remove them in the future.
-
Adding additional comments for extra context so that the subtleties are clearer.
-
Removing temp files in the tests. I only commented on one specific one, but there seem to be a bunch.
Also, it would be great to have some unit tests for theconsulClient
function that addresses all of the different scenarios and checks that the config that is generated matches expectations.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was mostly through my review so going to leave it anyway in case it's helpful.
2037244
to
76e021f
Compare
When auto-encrypt is enabled, we need to retrieve Consul client CA from the Consul servers. This command calls the '/agent/connect/ca/roots' endpoint, finds the currently active root CA, and writes it to the provided output file location.
76e021f
to
c005a2a
Compare
c005a2a
to
9eed6f8
Compare
@adilyse @lkysow thanks so much for your reviews, they were super helpful 😄 I've made some changes and refactors that came out of your suggestions that are ready for re-review. Summary here:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Moving on to actually testing now.
Co-Authored-By: Luke Kysow <1034429+lkysow@users.noreply.github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎉
When auto-encrypt is enabled, we need to retrieve Consul client CA from the Consul servers.
This command calls the
/agent/connect/ca/roots
endpoint, finds the currently active root CA, and writes it to the provided output file location.This command allows you to provide a cloud-join string instead of the server address and this command will discover the servers. This allows us to re-use the
client.join
value in the Helm chart without requiring operators to provide the address of the server in addition to the join value.