[terraform] Bump prod Identity to 0.51.1
ClosedPublic
Actions

Authored by bartek on Feb 20 2025, 6:44 AM.

Details

Reviewers

kamil
tomek

Commits

rCOMMe22a35c3a2b9: [terraform] Bump prod Identity to 0.51.1

Summary

This version has been on staging for 3 days now, it also has been tested on prod during live debugging session and looks stable now.
Changes described in D14392.

Depends on D14392

Test Plan

terraform plan

Diff Detail

Repository

rCOMM Comm

Lint

No Lint Coverage

Unit

No Test Coverage

Event Timeline

bartek created this revision.Feb 20 2025, 6:44 AM

bartek held this revision as a draft.

Herald added a subscriber: ashoat. · View Herald TranscriptFeb 20 2025, 6:44 AM

bartek published this revision for review.Feb 20 2025, 6:45 AM

tomek accepted this revision.Feb 20 2025, 6:51 AM

This revision is now accepted and ready to land.Feb 20 2025, 6:51 AM

This revision was landed with ongoing or failed builds.Feb 20 2025, 6:54 AM

Closed by commit rCOMMe22a35c3a2b9: [terraform] Bump prod Identity to 0.51.1 (authored by bartek). · Explain Why

This revision was automatically updated to reflect the committed changes.

bartek added a commit: rCOMMe22a35c3a2b9: [terraform] Bump prod Identity to 0.51.1.

Harbormaster completed remote builds in B33558: Diff 47172.Feb 20 2025, 7:23 AM

Revision Contents
Changeset List

Path

Size

services/

terraform/

remote/

service_identity.tf

2 lines

Diff 47172

View Options

services/terraform/remote/service_identity.tf

	pub mod error;			pub mod error;
	pub mod identity;			pub mod identity;
	pub mod tunnelbroker;			pub mod tunnelbroker;

	// Re-export some dependencies which may need to be used by downstream crates			// Re-export some dependencies which may need to be used by downstream crates
	pub use tonic;			pub use tonic;

	use error::Error;			use error::Error;
	use std::path::Path;
	use std::time::Duration;			use std::time::Duration;
	use tonic::transport::{Certificate, Channel, ClientTlsConfig};			use tonic::transport::Channel;
	use tracing::info;			use tracing::info;

	const CERT_PATHS: &[&str] = &[
	// MacOS and newer Ubuntu
	"/etc/ssl/cert.pem",
	// Common CA cert paths
	"/etc/ssl/certs/ca-bundle.crt",
	"/etc/ssl/certs/ca-certificates.crt",
	];
	const CONNECT_TIMEOUT_DURATION: Duration = Duration::from_secs(5);			const CONNECT_TIMEOUT_DURATION: Duration = Duration::from_secs(5);

	pub(crate) fn get_ca_cert_contents() -> Option<String> {
	CERT_PATHS
	.iter()
	.map(Path::new)
	.filter(\|p\| p.exists())
	.filter_map(\|f\| std::fs::read_to_string(f).ok())
	.next()
	}
	pub(crate) async fn get_grpc_service_channel(			pub(crate) async fn get_grpc_service_channel(
	url: &str,			url: &str,
	) -> Result<Channel, Error> {			) -> Result<Channel, Error> {
	let ca_cert = crate::get_ca_cert_contents().expect("Unable to get CA bundle");

	info!("Connecting to gRPC service at {}", url);			info!("Connecting to gRPC service at {}", url);
	let mut channel = Channel::from_shared(url.to_string())?			let channel = Channel::from_shared(url.to_string())?
	.connect_timeout(CONNECT_TIMEOUT_DURATION);			.connect_timeout(CONNECT_TIMEOUT_DURATION);

	// tls_config will fail if the underlying URI is only http://
	if url.starts_with("https:") {
	channel = channel.tls_config(
	ClientTlsConfig::new().ca_certificate(Certificate::from_pem(&ca_cert)),
	)?
	}

	Ok(channel.connect().await?)			Ok(channel.connect().await?)
	}			}

[terraform] Bump prod Identity to 0.51.1ClosedPublicActions