Irena Rindos
18dff62b7b
* feat(workers): Add ability to read and reinitialize cert authority (#2312) * feat(workers): Return Release Version on worker list and read (#2377) * feat(cli): Read and reinitialize worker certificate authority (#2387)
30 lines
1.0 KiB
Go
30 lines
1.0 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/hashicorp/boundary/internal/errors"
|
|
"github.com/hashicorp/nodeenrollment"
|
|
"github.com/hashicorp/nodeenrollment/types"
|
|
)
|
|
|
|
// ReinitializeRoots is a domain service function that removes both root certificates and then
|
|
// calls RotateRoots to generate new root certificates.
|
|
// Accepts the nodeenrollment option, WithCertificateLifetime(time.Duration) to specify the lifetime
|
|
// of the generated cert(s)
|
|
func ReinitializeRoots(ctx context.Context, workerAuthRepo *WorkerAuthRepositoryStorage, opt ...nodeenrollment.Option) (*types.RootCertificates, error) {
|
|
const op = "server.ReinitializeRoots"
|
|
if workerAuthRepo == nil {
|
|
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing workerAuthRepo")
|
|
}
|
|
|
|
// Use WithReinitializeRoots to ensure existing roots are removed before rotation
|
|
opt = append(opt, nodeenrollment.WithReinitializeRoots(true))
|
|
roots, err := RotateRoots(ctx, workerAuthRepo, opt...)
|
|
if err != nil {
|
|
return nil, errors.Wrap(ctx, err, op)
|
|
}
|
|
|
|
return roots, nil
|
|
}
|