wander
wander copied to clipboard
robinovitch61
TLS support for exec
Using TLS for our cluster & it seems like there is no config options to specify the certificates required.
Wander just exits with Error: Get "https://10.0.0.20:4646//v1/jobs?namespace=%2A": x509: certificate signed by unknown authority
Official documentation regarding TLS for the CLI https://learn.hashicorp.com/tutorials/nomad/security-enable-tls#running-with-tls
Thanks for opening this issue! Not having this yet is a miss on my part. I'll get it implemented soon for sure.
@hoppel , I've added TLS support to the next branch for everything except execing into a task. That's proving a lot harder to port to the nomad api client than everything else, and I didn't want that to be a blocker to releasing the rest.
I'll release these changes so on main in the next couple days, but if you'd like you can try them now with
go install github.com/robinovitch61/wander@next
Docs for new config options are here: https://github.com/robinovitch61/wander/tree/next#configuration
If you do end up trying it, let me know if you run into any issues. It also would be interesting to me to know what happens if you try to use the exec functionality. Thanks!
Thank you! Works perfect so far.
exec does not work, wander exits with Error: x509: certificate signed by unknown authority which personally for me is not a deal breaker, just happy that all the other things are working.
Awesome. Just released v0.6.0 including this. I'm going to change the name of this issue to reflect the lack of TLS exec support.
@hoppel can you get around this by using NOMAD_SKIP_VERIFY=true ? I believe if you run this locally the nomad API client should pick this up.
@hoppel can you get around this by using
NOMAD_SKIP_VERIFY=true? I believe if you run this locally the nomad API client should pick this up.
Unfortunately I don't think this would work even if skip_verify would otherwise work, as no TLS parameters are passed to exec sessions today at all :(
Will be working on this soon to get full TLS param set passed to exec sessions
@andryyy will do. Thanks for the input, good to know this would be useful for someone. The differences between my current implementation of exec and the nomad client API make this tricky, so might not be immediate, but it's in the queue
Thanks for you reply!
I don't want to sound demanding or something. It's totally fine if it's not worth the struggle, I would understand it. :)