Add ForCA to cert request to request for CA certs. (istio#2949)

WillardHu · Jan 30, 2018 · 2d9d48e · 2d9d48e
1 parent 5cef00a
commit 2d9d48e
Showing 4 changed files with 69 additions and 30 deletions.
diff --git a/security/cmd/node_agent/na/nodeagent.go b/security/cmd/node_agent/na/nodeagent.go
@@ -136,5 +136,6 @@ func (na *nodeAgentInternal) createRequest() ([]byte, *pb.CsrRequest, error) {
 		NodeAgentCredential: cred,
 		CredentialType:      na.pc.GetCredentialType(),
 		RequestedTtlMinutes: int32(na.config.WorkloadCertTTL.Minutes()),
+		ForCA:               false,
 	}, nil
 }
diff --git a/security/pkg/server/grpc/server.go b/security/pkg/server/grpc/server.go
@@ -78,8 +78,7 @@ func (s *Server) HandleCSR(ctx context.Context, request *pb.CsrRequest) (*pb.Csr
 		return nil, status.Errorf(codes.PermissionDenied, "request is not authorized (%v)", err)
 	}
 
-	// TODO(myidpt): Support signing CSR for Istio CA.
-	cert, err := s.ca.Sign(request.CsrPem, time.Duration(request.RequestedTtlMinutes)*time.Minute, false)
+	cert, err := s.ca.Sign(request.CsrPem, time.Duration(request.RequestedTtlMinutes)*time.Minute, request.ForCA)
 	if err != nil {
 		log.Errorf("CSR signing error (%v)", err)
 		return nil, status.Errorf(codes.Internal, "CSR signing error (%v)", err)

diff --git a/security/proto/ca_service.pb.go b/security/proto/ca_service.pb.go
diff --git a/security/proto/ca_service.proto b/security/proto/ca_service.proto
@@ -46,6 +46,8 @@ message CsrRequest {
   string credential_type = 3;
   // the requested ttl of the certificate in minutes
   int32 requested_ttl_minutes = 4;
+  // whether the certificate is for a CA
+  bool forCA = 5;
 }
 
 message CsrResponse {