m/n/core/rpc: limit API footgun availability
This unifies the interface of the
New{Ephemeral,Authenticated}Credentials calls. They now use the same set
of CredentialsOpt options which allows both calls to request a
particular verification of the remote side of the connection.
NewEphemeralCredentials also now requires an explicit WantInsecure
option which surfaces attempts to dial the cluster without CA/node
verification.
Change-Id: Ibb65cb0952f6ff2092a3f55fe1c5a31bd2b72b36
Reviewed-on: https://review.monogon.dev/c/monogon/+/2741
Tested-by: Jenkins CI
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
diff --git a/cloud/bmaas/server/agent_callback_service_test.go b/cloud/bmaas/server/agent_callback_service_test.go
index 3bd3df9..4a3a9f4 100644
--- a/cloud/bmaas/server/agent_callback_service_test.go
+++ b/cloud/bmaas/server/agent_callback_service_test.go
@@ -58,7 +58,7 @@
}
heartbeat := func(mid uuid.UUID) error {
- creds, err := rpc.NewEphemeralCredentials(priv, nil)
+ creds, err := rpc.NewEphemeralCredentials(priv, rpc.WantInsecure())
if err != nil {
t.Fatalf("could not generate ephemeral credentials: %v", err)
}
@@ -136,7 +136,7 @@
}
heartbeat := func(mid uuid.UUID, report *apb.OSInstallationReport) (*apb.AgentHeartbeatResponse, error) {
- creds, err := rpc.NewEphemeralCredentials(priv, nil)
+ creds, err := rpc.NewEphemeralCredentials(priv, rpc.WantInsecure())
if err != nil {
t.Fatalf("could not generate ephemeral credentials: %v", err)
}