feat: Support additional CA certs
- Extend the standard cert pool with new certs
- Extend default http transport with the enlargened pool
@@ -4,7 +4,10 @@ package auth
import (
"context"
+ "crypto/tls"
+ "crypto/x509"
"fmt"
+ "net/http"
"strings"
"github.com/pkg/errors"
@@ -19,6 +22,23 @@ import (
"github.com/epinio/epinio/internal/names"
)
+func ExtendLocalTrust(certs string) {
+ // Get the SystemCertPool, continue with an empty pool on error
+ rootCAs, _ := x509.SystemCertPool()
+ if rootCAs == nil {
+ rootCAs = x509.NewCertPool()
+ }
+
+ rootCAs.AppendCertsFromPEM([]byte(certs))
+
+ // Trust the augmented cert pool in our client
+ config := &tls.Config{
+ RootCAs: rootCAs,
+ }
+
+ http.DefaultTransport.(*http.Transport).TLSClientConfig = config
+}
+
func CreateCertificate(ctx context.Context, cfg *rest.Config, name, namespace, systemDomain string) error {
// Create production certificate if it is provided by user
// else create a local cluster self-signed tls secret.
