metroctl: use persisted CA certificate for node connections
After the TOFU change (review/2744 and friends), we can now use the
persisted CA certificate (or a CA certificate from TOFU) when connecting
to node services.
Change-Id: I103b558f4f7a3087f1f27fdc4ee7f7e2ec03a981
Reviewed-on: https://review.monogon.dev/c/monogon/+/2769
Tested-by: Jenkins CI
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
diff --git a/metropolis/cli/metroctl/cmd_node.go b/metropolis/cli/metroctl/cmd_node.go
index a2946bf..a582f02 100644
--- a/metropolis/cli/metroctl/cmd_node.go
+++ b/metropolis/cli/metroctl/cmd_node.go
@@ -2,7 +2,6 @@
import (
"context"
- "crypto/x509"
"fmt"
"io"
"log"
@@ -94,17 +93,13 @@
}
ctx := clicontext.WithInterrupt(context.Background())
- mgmt := apb.NewManagementClient(dialAuthenticated(ctx))
- // TODO(q3k): save CA certificate on takeover
- info, err := mgmt.GetClusterInfo(ctx, &apb.GetClusterInfoRequest{})
+ cacert, err := core.GetClusterCAWithTOFU(ctx, connectOptions())
if err != nil {
- return fmt.Errorf("couldn't get cluster info: %w", err)
+ return fmt.Errorf("could not get CA certificate: %w", err)
}
- cacert, err := x509.ParseCertificate(info.CaCertificate)
- if err != nil {
- return fmt.Errorf("remote CA certificate invalid: %w", err)
- }
+
+ mgmt := apb.NewManagementClient(dialAuthenticated(ctx))
nodes, err := core.GetNodes(ctx, mgmt, "")
if err != nil {