[pipeline-manager] Support additional private CA for pipeline connections #5495
Conversation
There was a problem hiding this comment.
Pull request overview
This PR extends the pipeline manager’s TLS configuration to support an additional private certificate authority (CA) for pipeline connections in multihost environments.
Changes:
- Add a new
--private-ca-cert-pathconfiguration option and canonicalization to support a second CA chain. - Introduce
ca_cert_paths()helper to aggregate all configured CA bundles. - Update
awc_clientandreqwest_clientconstruction to load and trust both the existing HTTPS CA and the new private CA when HTTPS is enabled.
| pub https_tls_key_path: Option<String>, | ||
|
|
||
| /// Path to an additional TLS x509 certificate PEM file (e.g., | ||
| /// `/path/to/tls.crt`). The pipeline will connect to servers whose keys |
There was a problem hiding this comment.
This comment refers to 'The pipeline will connect...', but this option is part of CommonConfig used by the pipeline manager and its HTTP clients; consider rephrasing to 'The pipeline manager will connect...' (or similar) for consistency with the neighboring docs and actual usage.
| /// `/path/to/tls.crt`). The pipeline will connect to servers whose keys | |
| /// `/path/to/tls.crt`). The pipeline manager will connect to servers whose keys |
| if self.https_config().is_some() { | ||
| let mut builder = reqwest::ClientBuilder::new() | ||
| .https_only(true) // Only connect to HTTPS | ||
| .add_root_certificate(root_cert) // Add our own TLS certificate which is used | ||
| .tls_built_in_root_certs(false) // Other TLS certificates are not used | ||
| .build() | ||
| .expect("HTTPS client should be built") | ||
| .tls_built_in_root_certs(false); // Other TLS certificates are not used | ||
| for path in self.ca_cert_paths() { |
There was a problem hiding this comment.
The new private_ca_cert_path is only used when https_config() returns Some(_), but the field’s doc comment above does not mention that it is only honored when HTTPS is enabled; it would be clearer to explicitly state this dependency in the documentation (or adjust the condition if it is meant to be usable independently of --https-tls-cert-path).
…ions. Signed-off-by: Ben Pfaff <[email protected]>
This will enable the coordinator to generate certificates for connections to pipelines in multihost environments.