ebb0334905
To use the tls-certificates interface clients relate to the vault charm. If the charms CA is not ready yet the charm will not update the relation data. To prepare the CA an operator needs to run the get_csr action to retrieve the csr for the intermediate ca the charm has prepared. The operator should sign the csr with the root CA and then upload the root CA cert and signed csr to the vault charm via the upload-signed-csr action. Running this action will trigger the vault charm to process any outstanding certificate requests and to update the relation data accordingly. The update includes: * New action get_csr to retrieve a csr for the intermediate ca for the charm pki * New action upload-signed-csr to upload a signed intermediate csr * Charm now provides tls-certificates interface * Update vault access acl to allow charm full access to charm-pki-*. Currently the only pki mount point the charm uses is charm-pki-local * Various generic helpers to lib.charm.vault * New module lib.charm.vault_pki which handles interactions between the charm and the vault pki api * Add handler to reactive.vault_handlers for reacting to certificate requests Depends-On: I6222e5eb9c8a0a5f079ecc2e5e5c97abc1c39515 Change-Id: I1681b9f2defcfbf7c06ede83c88c507dcf92a7ce |
||
|---|---|---|
| .. | ||
| actions.py | ||
| authorize-charm | ||
| get-csr | ||
| refresh-secrets | ||
| reissue-certificates | ||
| upload-signed-csr | ||