Irena Rindos
18dff62b7b
* feat(workers): Add ability to read and reinitialize cert authority (#2312) * feat(workers): Return Release Version on worker list and read (#2377) * feat(cli): Read and reinitialize worker certificate authority (#2387)
37 lines
1.3 KiB
Go
37 lines
1.3 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/hashicorp/boundary/internal/errors"
|
|
"github.com/hashicorp/nodeenrollment"
|
|
"github.com/hashicorp/nodeenrollment/rotation"
|
|
"github.com/hashicorp/nodeenrollment/types"
|
|
)
|
|
|
|
// RotateRoots is a domain service function that initiates a rotation of root certificates
|
|
// via a call to the nodenenrollment RotateRootCertificates function
|
|
// Accepts the nodeenrollment option, WithCertificateLifetime(time.Duration) to specify the lifetime
|
|
// of the generated cert(s)
|
|
func RotateRoots(ctx context.Context, workerAuthRepo *WorkerAuthRepositoryStorage, opt ...nodeenrollment.Option) (*types.RootCertificates, error) {
|
|
const op = "server.RotateRoots"
|
|
if workerAuthRepo == nil {
|
|
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing workerAuthRepo")
|
|
}
|
|
|
|
// Get current root certs so we can pass along the version
|
|
rootCerts := &types.RootCertificates{Id: CaId}
|
|
err := workerAuthRepo.Load(ctx, rootCerts)
|
|
if err != nil && err != nodeenrollment.ErrNotFound {
|
|
return nil, errors.Wrap(ctx, err, op)
|
|
}
|
|
opt = append(opt, nodeenrollment.WithState(rootCerts.GetState()))
|
|
|
|
roots, err := rotation.RotateRootCertificates(ctx, workerAuthRepo, opt...)
|
|
if err != nil {
|
|
return nil, errors.Wrap(ctx, err, op)
|
|
}
|
|
|
|
return roots, nil
|
|
}
|