Refactor the population of TLS files to wrapper cookbooks?

[Fitzsimmons]

Hi,

I'm noticing that consul_config.rb is currently expecting the TLS files to be set in a chef-vault. I fully support the use of chef-vault, and in fact I'm already using it; however, I'm adding the files to the filesystem in my wrapper cookbook, and I'd like to simply tell consul-cookbook where to look for the files once they're already there.

I much prefer this technique because it allows a lot of flexibility for myself and other consumers of this cookbook to handle secrets in their preferred way.

I'd be willing to write the pull request to make this happen, but I just wanted to make sure that this work would be appreciated before embarking on what I consider a fairly significant API change.

Let me know,

-Justin

[johnbellone]

@Fitzsimmons I am willing to accept a PR here.

[joerocklin]

I've implemented this over at https://github.com/joerocklin/consul-cookbook/tree/server_options - though I don't know that it's the most elegant of solutions. Basically I added another option called manual_tls (because I needed a quick fix for what I was working on). Would be happy to submit a PR if @johnbellone thinks that's a decent solution!

[johnbellone]

I am removing the management of TLS certificates with version 2.0. It has already landed in the install-resource branch and will be released in the next few days. I am just going through some integration tests. The plan is to have a separate example wrapper cookbook to draw from.

[spheromak]

👍 for those of us that manage certs outside of chef.

[joerocklin]

@johnbellone I was trying to test my wrapper cookbook with the install-resource branch to get ready for the upcoming change, and it looks like it's still trying to manage keys & certs from chef-vault: https://github.com/johnbellone/consul-cookbook/blob/5e5dc78/libraries/consul_config.rb#L125

Is this still the plan for 2.0, or are there more changes in store?

[johnbellone]

@joerocklin A local commit that didn't get pushed up :).

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.