gsadmin/spinifex
1
0
Fork 0
mirror of https://github.com/mulgadc/spinifex.git synced 2026-10-15 09:01:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: move tenant CA paths to ACM domain

Browse Source
This commit is contained in:
joshsiv-mulga
2026-10-06 15:22:16 +10:00
parent 8a42943ac7
commit 001aa2d42a
4 changed files with 32 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/spinifex/cmd/admin_acm.go
+2 -2
View File
@@ -107,8 +107,8 @@ func runCertCreateTenantCA(cmd *cobra.Command, _ []string) {
yes, _ := cmd.Flags().GetBool("yes")
configDir, _ := cmd.Root().Flags().GetString("config-dir")
certPath := admin.TenantCACertPath(configDir)
keyPath := admin.TenantCAKeyPath(configDir)
certPath := acmdomain.TenantCACertPath(configDir)
keyPath := acmdomain.TenantCAKeyPath(configDir)
existed := admin.FileExists(certPath) && admin.FileExists(keyPath)
spinifex/admin/admin.go
-26
View File
@@ -262,32 +262,6 @@ func GenerateCertificatesIfNeeded(configDir string, force bool, bindIP string, a
return caCertPath
}
// tenantCACertFilename and tenantCAKeyFilename name the ACM tenant private
// CA's files on disk. Colocated with the platform CA (ca.pem/ca.key) and
// master.key under the same config directory, but a distinct "tenant-ca"
// basename keeps the two roots from ever being confused: they are
// independent, and the platform CA (trusted by every node, ipsec, EKS/ECS
// guests, ALB microvms and baked catalog images) must never be read, written
// or reused as the tenant CA, or vice versa.
const (
tenantCACertFilename = "tenant-ca.pem"
tenantCAKeyFilename = "tenant-ca.key"
)
// TenantCACertPath and TenantCAKeyPath return the on-disk paths for the ACM
// tenant private CA under configDir, mirroring how GenerateCertificatesIfNeeded
// derives the platform CA's paths (filepath.Join(configDir, "ca.pem"/"ca.key"))
// rather than threading them through ConfigSettings: like the platform CA,
// these paths are computed on demand by whoever needs them (the tenant-CA admin
// command, the daemon at startup), not rendered into a config file.
func TenantCACertPath(configDir string) string {
return filepath.Join(configDir, tenantCACertFilename)
}
func TenantCAKeyPath(configDir string) string {
return filepath.Join(configDir, tenantCAKeyFilename)
}
// GenerateServerCertOnly generates a server certificate signed by an existing CA.
// Used by joining nodes that receive the CA from the leader. awsRegion and
// servicesDomain add the AWS-parity ECR SANs; empty values omit them.
spinifex/daemon/daemon.go
+1 -1
View File
@@ -2137,7 +2137,7 @@ func (d *Daemon) startCluster() error {
// operator can tell at a glance, from daemon startup logs alone, which one
// they are in.
configDir := filepath.Dir(d.configPath)
tenantCA, tenantCAErr := acmdomain.LoadTenantCA(admin.TenantCACertPath(configDir), admin.TenantCAKeyPath(configDir))
tenantCA, tenantCAErr := acmdomain.LoadTenantCA(acmdomain.TenantCACertPath(configDir), acmdomain.TenantCAKeyPath(configDir))
if tenantCAErr != nil {
slog.Warn("ACM: tenant private CA not found; PRIVATE_CA certificate requests will fail until one is created",
"err", tenantCAErr)
spinifex/domains/acm/tenant_ca_paths.go
+29
View File
@@ -0,0 +1,29 @@
package acm
import "path/filepath"
// tenantCACertFilename and tenantCAKeyFilename name the ACM tenant private
// CA's files on disk. Colocated with the platform CA (ca.pem/ca.key) and
// master.key under the same config directory, but a distinct "tenant-ca"
// basename keeps the two roots from ever being confused: they are
// independent, and the platform CA (trusted by every node, ipsec, EKS/ECS
// guests, ALB microvms and baked catalog images) must never be read, written
// or reused as the tenant CA, or vice versa.
const (
tenantCACertFilename = "tenant-ca.pem"
tenantCAKeyFilename = "tenant-ca.key"
)
// TenantCACertPath and TenantCAKeyPath return the on-disk paths for the ACM
// tenant private CA under configDir, mirroring how admin.GenerateCertificatesIfNeeded
// derives the platform CA's paths (filepath.Join(configDir, "ca.pem"/"ca.key"))
// rather than threading them through ConfigSettings: like the platform CA,
// these paths are computed on demand by whoever needs them (the tenant-CA admin
// command, the daemon at startup), not rendered into a config file.
func TenantCACertPath(configDir string) string {
return filepath.Join(configDir, tenantCACertFilename)
}
func TenantCAKeyPath(configDir string) string {
return filepath.Join(configDir, tenantCAKeyFilename)
}