Add --ca-cert & --ca-key flags to swarm init

[darkowlzz]

Add --ca-cert and --ca-key flags to docker swarm init and merge rootCACert and rootCAKey with the swarm spec, which is sent to the docker daemon.

Signed-off-by: Sunny Gogoi me@darkowlzz.space

Refer moby/moby#33385

[darkowlzz]

circleci continues to load forever at Lint stage. Won't show what the issue is 🤷‍♀️

[dnephin]

I see the issue in the output in 3 of 4:

cli/command/swarm/opts.go:257: opts.rootCACert undefined (type *swarmOptions has no field or method rootCACert)
cli/command/swarm/opts.go:260: opts.rootCAKey undefined (type *swarmOptions has no field or method rootCAKey)

[darkowlzz]

@dnephin thanks. I got this error earlier and fixed it but forgot to push the changed code 😅
Pushed now as part of the same commit.

[codecov-io]

Codecov Report

Merging #137 into master will increase coverage by 0.02%.
The diff coverage is 33.33%.

@@ Coverage Diff @@## master #137 +/- ##
==========================================
+ Coverage 44.82% 44.85% +0.02% 
==========================================
Files 169 169 Lines 11360 11366 +6 ==========================================
+ Hits 5092 5098 +6 + Misses 5978 5976 -2 - Partials 290 292 +2

[aaronlehmann]

ping @cyli

I don't think having CACert / CAKey in the spec avoids generating a new root cert/key on initial startup in the current swarmkit code, but maybe I'm missing something?

[cyli]

@aaronlehmann No, it doesn't - because in swarmkit, the Node configuration does not take a swarm spec. I believe moby/moby on init creates a new node and then immediately does an UpdateCluster on the swarm API, so it will basically rotate the root CA cert after the swarmkit code generates its own.

I don't particularly see anything wrong for that (but I could be missing an edge case) - it'd be the same as initializing and then immediately rotating.

If we wanted to avoid having the first node generate a cert/key at all, we're probably going to have to make more extensive changes in the swarmkit code.

[aaronlehmann]

Makes sense. Immediately rotating doesn't seem crazy if we test it and it works. On the other hand, it might expose us to race conditions where joining nodes might see the old CA first. Passing an optional CA cert and key into Node might make sense.

[cyli]

On the other hand, it might expose us to race conditions where joining nodes might see the old CA first.

That's true, or they get a join token that will be immediately invalidated. Another possible option is that in the moby/moby logic, on init it waits until the rotation is done before returning successfully.

While my preference is to get the daemon/swarmkit fixed up first before the CLI changes, they can technically happen in any order. If the CLI changes came first the daemon/swarmkit changes would be fixing any race condition that may crop up.

[thaJeztah]

what's the status on this one?