kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #33712 from cyli/redact-ca-signing-cert

Browse source 
Redact swarm spec CA signing cert for usability reasons
This commit is contained in:
Brian Goff 2017-06-16 09:21:59 -04:00 • committed by GitHub
commit 0919a1da14
2 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
daemon/cluster/convert/swarm.go
View file

@ -31,9 +31,10 @@ func SwarmFromGRPC(c swarmapi.Cluster) types.Swarm {
AutoLockManagers: c.Spec.EncryptionConfig.AutoLockManagers, AutoLockManagers: c.Spec.EncryptionConfig.AutoLockManagers,
}, },
CAConfig: types.CAConfig{ CAConfig: types.CAConfig{
// do not include the signing CA key (it should already be redacted via the swarm APIs) // do not include the signing CA cert or key (it should already be redacted via the swarm APIs) -
SigningCACert: string(c.Spec.CAConfig.SigningCACert), // the key because it's secret, and the cert because otherwise doing a get + update on the spec
ForceRotate: c.Spec.CAConfig.ForceRotate, // can cause issues because the key would be missing and the cert wouldn't
ForceRotate: c.Spec.CAConfig.ForceRotate,
}, },
}, },
TLSInfo: types.TLSInfo{ TLSInfo: types.TLSInfo{

9
integration-cli/docker_api_swarm_test.go
View file

@ -967,20 +967,21 @@ func (s *DockerSwarmSuite) TestSwarmRepeatedRootRotation(c *check.C) {
for j := 0; j < 18; j++ { for j := 0; j < 18; j++ {
info, err := m.SwarmInfo() info, err := m.SwarmInfo()
c.Assert(err, checker.IsNil) c.Assert(err, checker.IsNil)
c.Assert(info.Cluster.Spec.CAConfig.SigningCACert, checker.Equals, expectedCert)
// the desired CA key is always redacted // the desired CA cert and key is always redacted
c.Assert(info.Cluster.Spec.CAConfig.SigningCAKey, checker.Equals, "") c.Assert(info.Cluster.Spec.CAConfig.SigningCAKey, checker.Equals, "")
c.Assert(info.Cluster.Spec.CAConfig.SigningCACert, checker.Equals, "")
clusterTLSInfo = info.Cluster.TLSInfo clusterTLSInfo = info.Cluster.TLSInfo
if !info.Cluster.RootRotationInProgress { // if root rotation is done and the trust root has changed, we don't have to poll anymore
if !info.Cluster.RootRotationInProgress && clusterTLSInfo.TrustRoot != currentTrustRoot {
break break
} }
// root rotation not done // root rotation not done
time.Sleep(250 * time.Millisecond) time.Sleep(250 * time.Millisecond)
} }
c.Assert(clusterTLSInfo.TrustRoot, checker.Not(checker.Equals), currentTrustRoot)
if cert != nil { if cert != nil {
c.Assert(clusterTLSInfo.TrustRoot, checker.Equals, expectedCert) c.Assert(clusterTLSInfo.TrustRoot, checker.Equals, expectedCert)
} }