-
Notifications
You must be signed in to change notification settings - Fork 134
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Upgrade fulcios to use of the google privateca api at v1 #218
Conversation
Signed-off-by: Scott Nichols <[email protected]>
This needs a hold until we move off of the beta1 cert right? |
hm, let me look into that. As far as the docs talked about it, it is the api to talk with the cert issuer and I did not see anything about v1 vs v1beta1 certs but.... let me look |
The "collection path" to actually address the cert changed (they added a "certpool" concept), so that's why very few things work with both... |
I tried this a couple weeks ago and it did not work for me with the beta objects |
Okay, how about this strat @bobcallaway and @dlorenc? We can select which version and use that API. We are free to upgrade to v1 and not need to change the code. When we do that we can drop the code path. |
Signed-off-by: Scott Nichols <[email protected]>
+1 to the concept. we should probably write a proper |
Awesome, this is great. |
updated the title and description to include the fact that there is a flag now. |
I'm working on updating this PR. |
Signed-off-by: Scott Nichols <[email protected]>
sorry @haydentherapper I just updated it! |
Signed-off-by: Scott Nichols <[email protected]>
Thanks @n3wscott! Is there anything else that needs to be updated with the PR now? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This LGTM. @bobcallaway anything else?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
@haydentherapper we need to use the new V1 cert and change the flags we use to start the server. I am a little unclear how that works |
@asraa and I caught up yesterday. There's one more missing PR in cosign to add the new root cert, then we can test this! |
This got dropped unintentionally during the interface refactor in #218 and #220. Signed-off-by: Dan Lorenc <[email protected]>
This got dropped unintentionally during the interface refactor in #218 and #220. Signed-off-by: Dan Lorenc <[email protected]>
Signed-off-by: Scott Nichols [email protected]
Summary
We were still on a v1beta1 api for the googleca private ca. This adds a flag to use the v1 of the api. We are still needing to update the cert to
v1
.The new flag
--gcp_private_ca_version
selectsv1
by default to allow us to drop the flag when we move to v1 certs and then delete the flag and the v1beta1 codepaths.Ticket Link
Relates to a checkbox in #191
Release Note