metropolis: reduce usage of identity.NodeID
Eventually, we want to be able to rotate node keypairs. To allow this,
the node ID needs to become independent of the public key. This change
is a refactoring which starts this work by reducing the usage of
identity.NodeID, the function which derives a node ID from a public key.
Change-Id: I5231ed0a7be37c23327fec93481b00c74374af07
Reviewed-on: https://review.monogon.dev/c/monogon/+/3445
Tested-by: Jenkins CI
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
diff --git a/metropolis/node/core/rpc/client.go b/metropolis/node/core/rpc/client.go
index 5fc76e3..72122b7 100644
--- a/metropolis/node/core/rpc/client.go
+++ b/metropolis/node/core/rpc/client.go
@@ -39,15 +39,12 @@
if err != nil {
return fmt.Errorf("server presented unparseable certificate: %w", err)
}
- pkey, err := identity.VerifyNodeInCluster(serverCert, ca)
+ id, err := identity.VerifyNodeInCluster(serverCert, ca)
if err != nil {
return fmt.Errorf("node certificate verification failed: %w", err)
}
- if nodeID != "" {
- id := identity.NodeID(pkey)
- if id != nodeID {
- return fmt.Errorf("wanted to reach node %q, got %q", nodeID, id)
- }
+ if nodeID != "" && id != nodeID {
+ return fmt.Errorf("wanted to reach node %q, got %q", nodeID, id)
}
return nil