Connect: Refresh leaf cluster certs before fetching certs for database #12293
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -45,7 +45,7 @@ func (s *Storage) ReadAll() ([]*Cluster, error) { | |
|
|
||
| clusters := make([]*Cluster, 0, len(pfNames)) | ||
| for _, name := range pfNames { | ||
| cluster, err := s.fromProfile(name, "") | ||
| if err != nil { | ||
| return nil, trace.Wrap(err) | ||
| } | ||
|
|
@@ -58,7 +58,7 @@ func (s *Storage) ReadAll() ([]*Cluster, error) { | |
|
|
||
| // GetByName returns a cluster by name | ||
| func (s *Storage) GetByName(clusterName string) (*Cluster, error) { | ||
| cluster, err := s.fromProfile(clusterName, "") | ||
| if err != nil { | ||
| return nil, trace.Wrap(err) | ||
| } | ||
|
|
@@ -72,17 +72,11 @@ func (s *Storage) GetByURI(clusterURI string) (*Cluster, error) { | |
| rootClusterName := URI.GetRootClusterName() | ||
| leafClusterName := URI.GetLeafClusterName() | ||
|
|
||
| cluster, err := s.fromProfile(rootClusterName, leafClusterName) | ||
| if err != nil { | ||
| return nil, trace.Wrap(err) | ||
| } | ||
|
|
||
| return cluster, nil | ||
| } | ||
|
|
||
|
|
@@ -161,20 +155,28 @@ func (s *Storage) addCluster(ctx context.Context, dir, webProxyAddress string) ( | |
| } | ||
|
|
||
| // fromProfile creates a new cluster from its profile | ||
| func (s *Storage) fromProfile(profileName, leafClusterName string) (*Cluster, error) { | ||
| if profileName == "" { | ||
| return nil, trace.BadParameter("cluster name is missing") | ||
| } | ||
|
|
||
| clusterNameForKey := profileName | ||
| clusterURI := uri.NewClusterURI(profileName) | ||
|
|
||
| cfg := client.MakeDefaultConfig() | ||
| if err := cfg.LoadProfile(s.Dir, profileName); err != nil { | ||
| return nil, trace.Wrap(err) | ||
| } | ||
| cfg.KeysDir = s.Dir | ||
| cfg.HomePath = s.Dir | ||
| cfg.InsecureSkipVerify = s.InsecureSkipVerify | ||
|
|
||
| if leafClusterName != "" { | ||
| clusterNameForKey = leafClusterName | ||
| clusterURI = clusterURI.AppendLeafCluster(leafClusterName) | ||
| cfg.SiteName = leafClusterName | ||
| } | ||
|
|
||
| clusterClient, err := client.NewClient(cfg) | ||
| if err != nil { | ||
| return nil, trace.Wrap(err) | ||
|
|
@@ -183,13 +185,13 @@ func (s *Storage) fromProfile(clusterName string) (*Cluster, error) { | |
| status := &client.ProfileStatus{} | ||
|
|
||
| // load profile status if key exists | ||
| _, err = clusterClient.LocalAgent().GetKey(clusterNameForKey) | ||
| if err != nil { | ||
| s.Log.WithError(err).Infof("Unable to load the keys for cluster %v.", clusterNameForKey) | ||
| } | ||
|
|
||
| if err == nil && cfg.Username != "" { | ||
| status, err = client.ReadProfileStatus(s.Dir, profileName) | ||
| if err != nil { | ||
| return nil, trace.Wrap(err) | ||
| } | ||
|
|
@@ -202,10 +204,11 @@ func (s *Storage) fromProfile(clusterName string) (*Cluster, error) { | |
| return nil, trace.Wrap(err) | ||
| } | ||
|
|
||
| return &Cluster{ | ||
| URI: clusterURI, | ||
| // TODO(ravicious): This should probably use leafClusterName if available, but at this point I'm | ||
| // worried that changing it might break something else in the app. | ||
| Name: profileName, | ||
|
Comment on lines
+209
to
+211
Member
Author
There was a problem hiding this comment. At the moment it doesn't cause any issues because Teleport Connect uses another code path to get names of leaf clusters. Methods on |
||
| clusterClient: clusterClient, | ||
| dir: s.Dir, | ||
| clock: s.Clock, | ||
|
|
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There's an outstanding issue in Teleport Connect where all our URIs use the proxy hostname as the cluster name (which is equivalent to a profile name, I think). I'll create a separate ticket for it soon, but in general the problem is that the proxy hostname can be different than the root cluster name.
So when
Storage.GetByURIcallsfromProfile, this name is actually the profile name and not the real root cluster name from the key. I changed the argument name here fromclusterNametoprofileNameto signal that for the future.