environs/cloudinit: add cert/private key

environs/cloudinit: add cert/private key

First stage in enabling TLS.

https://code.launchpad.net/~rogpeppe/juju-core/138-cloudinit-cert/+merge/133516

(do not edit description out of merge proposal)

[rog, 2012-11-08 16:42:44]

Please take a look.

[dave_cheney.net, 2012-11-09 00:16:39]

LGTM.

https://codereview.appspot.com/6811095/diff/1005/environs/cloudinit/cloudinit.go
File environs/cloudinit/cloudinit.go (right):

https://codereview.appspot.com/6811095/diff/1005/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit.go:120: shquote(string(cfg.ServerCertAndKey)),
serverCertFile))
the cert file should be chmod'd 0600

https://codereview.appspot.com/6811095/diff/1005/environs/cloudinit/cloudinit...
File environs/cloudinit/cloudinit_test.go (right):

https://codereview.appspot.com/6811095/diff/1005/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit_test.go:261: cfg.ServerCertAndKey = []byte{}
nil ?

[rog, 2012-11-09 12:32:23]

Please take a look.

https://codereview.appspot.com/6811095/diff/1005/environs/cloudinit/cloudinit.go
File environs/cloudinit/cloudinit.go (right):

https://codereview.appspot.com/6811095/diff/1005/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit.go:120: shquote(string(cfg.ServerCertAndKey)),
serverCertFile))
On 2012/11/09 00:16:39, dfc wrote:
> the cert file should be chmod'd 0600

Done.

https://codereview.appspot.com/6811095/diff/1005/environs/cloudinit/cloudinit...
File environs/cloudinit/cloudinit_test.go (right):

https://codereview.appspot.com/6811095/diff/1005/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit_test.go:261: cfg.ServerCertAndKey = []byte{}
On 2012/11/09 00:16:39, dfc wrote:
> nil ?

i deliberately made it []byte{} because the test is len(cert) == 0 rather than
cert == nil.
it's probably not that important though.

[rog, 2012-11-12 12:41:55]

Please take a look.

[TheMue, 2012-11-14 13:39:04]

Mostly LGTM, only two cosmetical comments.

https://codereview.appspot.com/6811095/diff/7001/environs/cloudinit/cloudinit.go
File environs/cloudinit/cloudinit.go (right):

https://codereview.appspot.com/6811095/diff/7001/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit.go:35: ServerCertAndKey []byte
Even if it may get long I would like a State... prefix, like in StateServer
above.

https://codereview.appspot.com/6811095/diff/7001/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit.go:294: return fmt.Errorf("missing certificate")
"missing state server certificate", just to make it more clear.

[niemeyer, 2012-11-14 13:46:36]

LGTM

https://codereview.appspot.com/6811095/diff/7001/environs/cloudinit/cloudinit.go
File environs/cloudinit/cloudinit.go (right):

https://codereview.appspot.com/6811095/diff/7001/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit.go:35: ServerCertAndKey []byte
On 2012/11/14 13:39:05, TheMue wrote:
> Even if it may get long I would like a State... prefix, like in StateServer
> above.

Agreed.. maybe StateServerPEM

https://codereview.appspot.com/6811095/diff/7001/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit.go:88: const serverCertFile =
"/var/lib/juju/server-cert.pem"
s/serverCertFile/pemPath/
s/server-cert/server/

This is not just a cert, and that makes a big difference (private vs. not
private).

https://codereview.appspot.com/6811095/diff/7001/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit.go:294: return fmt.Errorf("missing certificate")
"missing state server PEM"

[rog, 2012-11-14 14:14:08]

*** Submitted:

environs/cloudinit: add cert/private key

First stage in enabling TLS.

R=dfc, TheMue, niemeyer
CC=
https://codereview.appspot.com/6811095

https://codereview.appspot.com/6811095/diff/7001/environs/cloudinit/cloudinit.go
File environs/cloudinit/cloudinit.go (right):

https://codereview.appspot.com/6811095/diff/7001/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit.go:35: ServerCertAndKey []byte
On 2012/11/14 13:46:36, niemeyer wrote:
> On 2012/11/14 13:39:05, TheMue wrote:
> > Even if it may get long I would like a State... prefix, like in StateServer
> > above.
> 
> Agreed.. maybe StateServerPEM

Done.

https://codereview.appspot.com/6811095/diff/7001/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit.go:88: const serverCertFile =
"/var/lib/juju/server-cert.pem"
On 2012/11/14 13:46:36, niemeyer wrote:
> s/serverCertFile/pemPath/
> s/server-cert/server/
> 
> This is not just a cert, and that makes a big difference (private vs. not
> private).

Done.

https://codereview.appspot.com/6811095/diff/7001/environs/cloudinit/cloudinit...
environs/cloudinit/cloudinit.go:294: return fmt.Errorf("missing certificate")
On 2012/11/14 13:46:36, niemeyer wrote:
> "missing state server PEM"

Done.