search

oxidecomputer / omicron

Omicron: Oxide control plane
Mozilla Public License 2.0
251 stars 39 forks source link

Need endpoints for fleet admin to manage TLS certificates for other silos #6118

Open askfongjojo opened 3 months ago

askfongjojo commented 3 months ago

Customer reports that the fleet admin is unable to update the TLS certificates of silos in which he isn't an admin. It is an awkward experience because he owns the wildcard cert and can use it for new silos. It's a reasonable expectation for the fleet admin to have CRUD endpoint like /system/silos/{silo}/certificate.

david-crespo commented 3 months ago

Note that the raw permissions for this already appear to be in place.

https://github.com/oxidecomputer/omicron/blob/c5ed4de5cd2b667cc4b46520e19bc036da8d63ab/nexus/auth/src/authz/omicron.polar#L438-L454

askfongjojo commented 3 months ago

It'll also be great if we can have the API update all silo certs as an option. It's probably an anti-pattern but will be a much more ergonomic way of handling cert rotation.