Certhandler secrets vault - Githubissues

canonical / observability-libs

A collection of charm libraries curated by the Observability team.

https://charmhub.io/observability-libs

Apache License 2.0

3 stars 8 forks source link

Certhandler secrets vault #87

Closed PietroPasotti closed 4 months ago

PietroPasotti commented 4 months ago

Issue

certhandler is overly complicated, storing public data in too many juju secrets

Solution

remove two of the three secrets, only store the privkey in a secret and retrieve csr and chain as needed from the relation data
instead of storing secret ids in relation databags, rely on hardcoded secret labels to always know what secret to pick
generate privkey on-demand and use the secret storage to persist and verify if we've generated it already
automatically detect if juju supports secrets, and if not fall back to a 'peers' peer-relation backed storage solution for the private key (as plaintext).
automatically migrate from peer to secrets- backend if on charm-upgrade we obtain access to secrets

Testing Instructions

A good test would be:

deploy cos-lite
jhack sync the lib to all charms who use it
deploy self-signed certs and imatrix fill

Tandem pr: https://github.com/canonical/traefik-k8s-operator/pull/346

sed-i commented 4 months ago

Great @PietroPasotti. Can you link to the tandem PR?

PietroPasotti commented 4 months ago

@sed-i tandem pr: https://github.com/canonical/traefik-k8s-operator/pull/346

PietroPasotti commented 4 months ago

Traefik's TLS itests passed AKA failed but for the wrong reasons. Merging away.

sed-i commented 4 months ago

Traefik's TLS itests passed AKA failed but for the wrong reasons. Merging away.

~~The linked itests are loki, not traefik. Traefik's itest failed for something that looks relevant:~~ ~~https://github.com/canonical/traefik-k8s-operator/actions/runs/8925027611/job/24512805931?pr=346#step:6:1131~~

Scratch that, it's forward_auth that failed.