feat: add set-testing subcommand #4
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unkin/encapic#4
Reference in New Issue
Block a user
Delete Branch "benvin/set-testing"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Operators need to move a host into
testing(so anypuppet agent --environment Xis honoured) without a terraform change; encapi accepts this via a scoped Vault OIDC token. Requires the encapi oidc-auth release.encapic set-testing <certname>: mint a JWT from Vault identity OIDC roleencapi-testing(VAULT_TOKEN or ~/.vault-token, VAULT_CACERT honoured){"environment":"testing"}to/api/v1/nodes/<certname>/environmentwith the bearer tokenENCAPI_URL/VAULT_ADDRand never follow redirects, so credentials never leave https or the target hostencapic <certname>ENC behaviour unchangedvaultClientVAULT_CACERT branch (bad path, no PEM, pool applied) has no test; the README advertises it → add a test with an httptest TLS server and its cert as VAULT_CACERT, plus the no-certs error case.defaultBaseURL(plain http) so the bearer JWT goes over cleartext unless ENCAPI_URL is https → consider refusing/warning on http for set-testing.VAULT_ADDRhas no scheme check (tests use plain-http Vault), soX-Vault-Tokencan go over http → apply the same https-only refusal toVAULT_ADDR, and test it.http.Clientfollows redirects; a 30x from encapi to http re-sends the bearer JWT on the same host → setCheckRedirecttohttp.ErrUseLastResponse(or refuse non-https targets).VAULT_CACERTis applied to the encapi call as well as Vault; an encapi cert from a different CA than Vault fails with no way to trust both → use separate trust for encapi (system pool) or document the constraint in README.No findings.