1berry/docker-cli
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

swarm/init: Fix --external-ca ignoring cacert option

Browse Source 
31d629245855d54294e04c6e7202f21901da5310 mistakenly changed the `ToSpec`
function to set all certs passed via `external-ca` to empty strings.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This commit is contained in:
Paweł Gronowski 2025-04-09 14:14:09 +02:00
parent a0385bf042
commit 6c2d023d87
No known key found for this signature in database
GPG Key ID: B85EFCFE26DEF92A
4 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cli/command/swarm/ca.go
View File

@ -96,7 +96,7 @@ func runCA(ctx context.Context, dockerCli command.Cli, flags *pflag.FlagSet, opt
func updateSwarmSpec(spec *swarm.Spec, flags *pflag.FlagSet, opts caOptions) { func updateSwarmSpec(spec *swarm.Spec, flags *pflag.FlagSet, opts caOptions) {
caCert := opts.rootCACert.Contents() caCert := opts.rootCACert.Contents()
caKey := opts.rootCAKey.Contents() caKey := opts.rootCAKey.Contents()
opts.mergeSwarmSpecCAFlags(spec, flags, caCert) opts.mergeSwarmSpecCAFlags(spec, flags, &caCert)
spec.CAConfig.SigningCACert = caCert spec.CAConfig.SigningCACert = caCert
spec.CAConfig.SigningCAKey = caKey spec.CAConfig.SigningCAKey = caKey

2
cli/command/swarm/init_test.go
View File

@ -150,7 +150,7 @@ func TestSwarmInitWithExternalCA(t *testing.T) {
tempDir := t.TempDir() tempDir := t.TempDir()
certFile := filepath.Join(tempDir, "cert.pem") certFile := filepath.Join(tempDir, "cert.pem")
err := os.WriteFile(certFile, []byte(cert), 0644) err := os.WriteFile(certFile, []byte(cert), 0o644)
assert.NilError(t, err) assert.NilError(t, err)
cmd := newInitCommand(cli) cmd := newInitCommand(cli)

14
cli/command/swarm/opts.go
View File

@ -231,7 +231,7 @@ func addSwarmFlags(flags *pflag.FlagSet, options *swarmOptions) {
addSwarmCAFlags(flags, &options.swarmCAOptions) addSwarmCAFlags(flags, &options.swarmCAOptions)
} }
func (o *swarmOptions) mergeSwarmSpec(spec *swarm.Spec, flags *pflag.FlagSet, caCert string) { func (o *swarmOptions) mergeSwarmSpec(spec *swarm.Spec, flags *pflag.FlagSet, caCert *string) {
if flags.Changed(flagTaskHistoryLimit) { if flags.Changed(flagTaskHistoryLimit) {
spec.Orchestration.TaskHistoryRetentionLimit = &o.taskHistoryLimit spec.Orchestration.TaskHistoryRetentionLimit = &o.taskHistoryLimit
} }
@ -255,20 +255,24 @@ type swarmCAOptions struct {
externalCA ExternalCAOption externalCA ExternalCAOption
} }
func (o *swarmCAOptions) mergeSwarmSpecCAFlags(spec *swarm.Spec, flags *pflag.FlagSet, caCert string) { func (o *swarmCAOptions) mergeSwarmSpecCAFlags(spec *swarm.Spec, flags *pflag.FlagSet, caCert *string) {
if flags.Changed(flagCertExpiry) { if flags.Changed(flagCertExpiry) {
spec.CAConfig.NodeCertExpiry = o.nodeCertExpiry spec.CAConfig.NodeCertExpiry = o.nodeCertExpiry
} }
if flags.Changed(flagExternalCA) { if flags.Changed(flagExternalCA) {
spec.CAConfig.ExternalCAs = o.externalCA.Value() spec.CAConfig.ExternalCAs = o.externalCA.Value()
for _, ca := range spec.CAConfig.ExternalCAs { if caCert != nil {
ca.CACert = caCert for _, ca := range spec.CAConfig.ExternalCAs {
if ca.CACert == "" {
ca.CACert = *caCert
}
}
} }
} }
} }
func (o *swarmOptions) ToSpec(flags *pflag.FlagSet) swarm.Spec { func (o *swarmOptions) ToSpec(flags *pflag.FlagSet) swarm.Spec {
var spec swarm.Spec var spec swarm.Spec
o.mergeSwarmSpec(&spec, flags, "") o.mergeSwarmSpec(&spec, flags, nil)
return spec return spec
} }

2
cli/command/swarm/update.go
View File

@ -53,7 +53,7 @@ func runUpdate(ctx context.Context, dockerCli command.Cli, flags *pflag.FlagSet,
prevAutoLock := swarmInspect.Spec.EncryptionConfig.AutoLockManagers prevAutoLock := swarmInspect.Spec.EncryptionConfig.AutoLockManagers
opts.mergeSwarmSpec(&swarmInspect.Spec, flags, swarmInspect.ClusterInfo.TLSInfo.TrustRoot) opts.mergeSwarmSpec(&swarmInspect.Spec, flags, &swarmInspect.ClusterInfo.TLSInfo.TrustRoot)
curAutoLock := swarmInspect.Spec.EncryptionConfig.AutoLockManagers curAutoLock := swarmInspect.Spec.EncryptionConfig.AutoLockManagers