fix: properly set up tls for KMS endpoint

The condition was inverted 🤦 Signed-off-by: Artem Chernyshev <artem.chernyshev@talos-systems.com>
schaurian · Jul 10, 2023 · 936111c · 936111c
1 parent cb226ee
commit 936111c
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/cmd/talosctl/cmd/mgmt/cluster/create.go b/cmd/talosctl/cmd/mgmt/cluster/create.go
@@ -455,7 +455,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) (err error) {
 
 					keys = append(keys, &v1alpha1.EncryptionKey{
 						KeyKMS: &v1alpha1.EncryptionKeyKMS{
-							KMSEndpoint: "http://" + nethelpers.JoinHostPort(ip.String(), port),
+							KMSEndpoint: "grpc://" + nethelpers.JoinHostPort(ip.String(), port),
 						},
 						KeySlot: i,
 					})

diff --git a/internal/pkg/encryption/keys/kms.go b/internal/pkg/encryption/keys/kms.go
@@ -128,9 +128,9 @@ func (h *KMSKeyHandler) getConn(ctx context.Context) (*grpc.ClientConn, error) {
 	}
 
 	if endpoint.Insecure {
-		transportCredentials = credentials.NewTLS(&tls.Config{})
-	} else {
 		transportCredentials = insecure.NewCredentials()
+	} else {
+		transportCredentials = credentials.NewTLS(&tls.Config{})
 	}
 
 	return grpc.DialContext(ctx, endpoint.Host, grpc.WithTransportCredentials(transportCredentials))