gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-10 07:06:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(runtime): wrap outbound tls globals (#4039)

Browse Source
This commit is contained in:
Zhengchao An
2026-06-29 12:56:34 +08:00
committed by GitHub
parent de41303f3e
commit 9c62a24efc
4 changed files with 34 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/common/src/globals.rs
+15
View File
@@ -96,6 +96,16 @@ pub async fn set_global_root_cert(cert: Vec<u8>) {
*GLOBAL_ROOT_CERT.write().await = Some(cert);
}
/// Clear the global root CA certificate for outbound gRPC clients.
pub async fn clear_global_root_cert() {
*GLOBAL_ROOT_CERT.write().await = None;
}
/// Get the global root CA certificate for outbound gRPC clients.
pub async fn get_global_root_cert() -> Option<Vec<u8>> {
GLOBAL_ROOT_CERT.read().await.clone()
}
/// Set the global mTLS identity (cert+key PEM) for outbound gRPC clients.
/// When set, clients will present this identity to servers requesting/requiring mTLS.
/// When None, clients proceed with standard server-authenticated TLS.
@@ -106,6 +116,11 @@ pub async fn set_global_mtls_identity(identity: Option<MtlsIdentityPem>) {
*GLOBAL_MTLS_IDENTITY.write().await = identity;
}
/// Get the global mTLS identity for outbound gRPC clients.
pub async fn get_global_mtls_identity() -> Option<MtlsIdentityPem> {
GLOBAL_MTLS_IDENTITY.read().await.clone()
}
/// Set the global outbound TLS generation.
pub fn set_global_outbound_tls_generation(generation: u64) {
GLOBAL_OUTBOUND_TLS_GENERATION.store(generation, Ordering::Relaxed);
crates/tls-runtime/src/outbound.rs
+5 -5
View File
@@ -16,8 +16,8 @@ use crate::material::OutboundTlsMaterial;
use crate::metrics::record_outbound_tls_publication;
use crate::state::TlsGeneration;
use rustfs_common::{
GLOBAL_MTLS_IDENTITY, GLOBAL_ROOT_CERT, MtlsIdentityPem, get_global_outbound_tls_generation, set_global_mtls_identity,
set_global_outbound_tls_generation, set_global_root_cert,
MtlsIdentityPem, clear_global_root_cert, get_global_mtls_identity, get_global_outbound_tls_generation, get_global_root_cert,
set_global_mtls_identity, set_global_outbound_tls_generation, set_global_root_cert,
};
#[derive(Debug, Clone)]
@@ -38,7 +38,7 @@ pub async fn publish_global_outbound_tls_state(generation: TlsGeneration, materi
if !material.root_ca_pem.is_empty() {
set_global_root_cert(material.root_ca_pem.clone()).await;
} else {
*GLOBAL_ROOT_CERT.write().await = None;
clear_global_root_cert().await;
}
set_global_mtls_identity(material.mtls_identity.clone()).await;
set_global_outbound_tls_generation(generation.0);
@@ -48,8 +48,8 @@ pub async fn publish_global_outbound_tls_state(generation: TlsGeneration, materi
pub async fn load_global_outbound_tls_state() -> GlobalPublishedOutboundTlsState {
GlobalPublishedOutboundTlsState {
generation: TlsGeneration(get_global_outbound_tls_generation()),
root_ca_pem: GLOBAL_ROOT_CERT.read().await.clone(),
mtls_identity: GLOBAL_MTLS_IDENTITY.read().await.clone(),
root_ca_pem: get_global_root_cert().await,
mtls_identity: get_global_mtls_identity().await,
}
}