mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
b0f83085eb
## What changed? Adding support for a fallback/default TLS section in the client config for remote clusters ## Why? When adding a new server, a user would have to add the new hostname to the config. This change allows for new servers to have a default cert, while still preserving the existing behavior. Closes #9881 ## How did you test it? - [x] built - [x] run locally and tested manually - [x] covered by existing tests - [x] added new unit test(s) - [ ] added new functional test(s) --------- Co-authored-by: stuart-wells <[email protected]>
59 lines
2.0 KiB
Go
59 lines
2.0 KiB
Go
package encryption
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"time"
|
|
)
|
|
|
|
// FixedTLSConfigProvider is a [TLSConfigProvider] that is for fixed sets of TLS
|
|
// configs. This is usually only used for testing.
|
|
|
|
type FixedTLSConfigProvider struct {
|
|
InternodeServerConfig *tls.Config
|
|
InternodeClientConfig *tls.Config
|
|
FrontendServerConfig *tls.Config
|
|
FrontendClientConfig *tls.Config
|
|
RemoteClusterClientConfigs map[string]*tls.Config
|
|
CertExpirationChecker CertExpirationChecker
|
|
}
|
|
|
|
var _ TLSConfigProvider = (*FixedTLSConfigProvider)(nil)
|
|
|
|
// GetInternodeServerConfig implements [TLSConfigProvider.GetInternodeServerConfig].
|
|
func (f *FixedTLSConfigProvider) GetInternodeServerConfig() (*tls.Config, error) {
|
|
return f.InternodeServerConfig, nil
|
|
}
|
|
|
|
// GetInternodeClientConfig implements [TLSConfigProvider.GetInternodeClientConfig].
|
|
func (f *FixedTLSConfigProvider) GetInternodeClientConfig() (*tls.Config, error) {
|
|
return f.InternodeClientConfig, nil
|
|
}
|
|
|
|
// GetFrontendServerConfig implements [TLSConfigProvider.GetFrontendServerConfig].
|
|
func (f *FixedTLSConfigProvider) GetFrontendServerConfig() (*tls.Config, error) {
|
|
return f.FrontendServerConfig, nil
|
|
}
|
|
|
|
// GetFrontendClientConfig implements [TLSConfigProvider.GetFrontendClientConfig].
|
|
func (f *FixedTLSConfigProvider) GetFrontendClientConfig() (*tls.Config, error) {
|
|
return f.FrontendClientConfig, nil
|
|
}
|
|
|
|
// GetRemoteClusterClientConfig implements [TLSConfigProvider.GetRemoteClusterClientConfig].
|
|
func (f *FixedTLSConfigProvider) GetRemoteClusterClientConfig(hostname string) (*tls.Config, error) {
|
|
if key, ok := matchRemoteClusterKey(hostname, f.RemoteClusterClientConfigs); ok {
|
|
return f.RemoteClusterClientConfigs[key], nil
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
// GetExpiringCerts implements [TLSConfigProvider.GetExpiringCerts].
|
|
func (f *FixedTLSConfigProvider) GetExpiringCerts(
|
|
timeWindow time.Duration,
|
|
) (expiring CertExpirationMap, expired CertExpirationMap, err error) {
|
|
if f.CertExpirationChecker != nil {
|
|
return f.CertExpirationChecker.GetExpiringCerts(timeWindow)
|
|
}
|
|
return nil, nil, nil
|
|
}
|