Skip to content

Commit f310e89

Browse files
prbinu-nvidiaprbinu-nvidia
authored
[#2060] fix: rename forge.local to nico.local (#2548)
## Description This fix aligns SPIFFE trust domain defaults with Helm’s existing `nico.local` convention. Helm already sets `global.spiffe.trustDomain: nico.local` and renders it into `[auth.trust]` via ConfigMap. Rust code still defaulted to `forge.local` when no config/env override was present, which could produce Vault machine PKI URI SANs under the wrong trust domain on non-Helm or misconfigured paths. This PR changes only the trust domain default ## Type of Change <!-- Check one that best describes this PR --> - [ ] **Add** - New feature or capability - [ ] **Change** - Changes in existing functionality - [x] **Fix** - Bug fixes - [ ] **Remove** - Removed features or deprecated functionality - [ ] **Internal** - Internal changes (refactoring, tests, docs, etc.) ## Related Issues (Optional) #2060 ## Breaking Changes ### Migration / rollout Legacy sites with existing `forge.local` machine/service certs must keep an explicit override before upgrading: ``` global: spiffe: trustDomain: forge.local ``` Or layer `helm/examples/carbide-legacy.yaml`. ## Testing <!-- How was this tested? Check all that apply --> - [x] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing performed - [ ] No testing required (docs, internal refactor, etc.)
1 parent 3674c18 commit f310e89

5 files changed

Lines changed: 24 additions & 12 deletions

File tree

‎crates/bmc-proxy/src/config.rs‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ impl Defaults {
7070

7171
fn trust_config() -> TrustConfig {
7272
TrustConfig {
73-
spiffe_trust_domain: "forge.local".to_string(),
73+
spiffe_trust_domain: "nico.local".to_string(),
7474
spiffe_service_base_paths: vec![
7575
"/forge-system/sa/".to_string(),
7676
"/default/sa/".to_string(),
@@ -259,7 +259,7 @@ mod tests {
259259
allowed_principals: vec![],
260260
identity_pemfile_path: "/tls/cert.pem".to_string(),
261261
root_cafile_path: "/tls/ca.pem".to_string(),
262-
trust_domain: "forge.local".to_string(),
262+
trust_domain: "nico.local".to_string(),
263263
service_base_paths: vec![
264264
"/forge-system/sa/".to_string(),
265265
"/default/sa/".to_string(),
@@ -277,7 +277,7 @@ mod tests {
277277
allowed_principals: vec![],
278278
identity_pemfile_path: "/tls/cert.pem".to_string(),
279279
root_cafile_path: "/tls/ca.pem".to_string(),
280-
trust_domain: "forge.local".to_string(),
280+
trust_domain: "nico.local".to_string(),
281281
service_base_paths: vec![
282282
"/forge-system/sa/".to_string(),
283283
"/default/sa/".to_string(),
@@ -298,7 +298,7 @@ mod tests {
298298
],
299299
identity_pemfile_path: "/tls/cert.pem".to_string(),
300300
root_cafile_path: "/tls/ca.pem".to_string(),
301-
trust_domain: "forge.local".to_string(),
301+
trust_domain: "nico.local".to_string(),
302302
service_base_paths: vec![
303303
"/forge-system/sa/".to_string(),
304304
"/default/sa/".to_string(),
@@ -316,7 +316,7 @@ mod tests {
316316
allowed_principals: vec![],
317317
identity_pemfile_path: "/tls/cert.pem".to_string(),
318318
root_cafile_path: "/tls/ca.pem".to_string(),
319-
trust_domain: "forge.local".to_string(),
319+
trust_domain: "nico.local".to_string(),
320320
service_base_paths: vec![
321321
"/forge-system/sa/".to_string(),
322322
"/default/sa/".to_string(),
@@ -334,7 +334,7 @@ mod tests {
334334
allowed_principals: vec![],
335335
identity_pemfile_path: "/tls/cert.pem".to_string(),
336336
root_cafile_path: "/tls/ca.pem".to_string(),
337-
trust_domain: "forge.local".to_string(),
337+
trust_domain: "nico.local".to_string(),
338338
service_base_paths: vec![
339339
"/forge-system/sa/".to_string(),
340340
"/default/sa/".to_string(),
@@ -352,7 +352,7 @@ mod tests {
352352
allowed_principals: vec![],
353353
identity_pemfile_path: "/tls/cert.pem".to_string(),
354354
root_cafile_path: "/tls/ca.pem".to_string(),
355-
trust_domain: "forge.local".to_string(),
355+
trust_domain: "nico.local".to_string(),
356356
service_base_paths: vec![
357357
"/forge-system/sa/".to_string(),
358358
"/default/sa/".to_string(),
@@ -370,7 +370,7 @@ mod tests {
370370
allowed_principals: vec![],
371371
identity_pemfile_path: "/tls/cert.pem".to_string(),
372372
root_cafile_path: "/tls/ca.pem".to_string(),
373-
trust_domain: "forge.local".to_string(),
373+
trust_domain: "nico.local".to_string(),
374374
service_base_paths: vec![
375375
"/forge-system/sa/".to_string(),
376376
"/default/sa/".to_string(),

‎crates/secrets/src/forge_vault.rs‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ use crate::credentials::{
4646

4747
const DEFAULT_VAULT_CA_PATH: &str = "/var/run/secrets/forge-roots/ca.crt";
4848
const VAULT_CACERT_ENV_VAR: &str = "VAULT_CACERT";
49-
const DEFAULT_SPIFFE_TRUST_DOMAIN: &str = "forge.local";
49+
const DEFAULT_SPIFFE_TRUST_DOMAIN: &str = "nico.local";
5050
const DEFAULT_SPIFFE_MACHINE_BASE_PATH: &str = "/forge-system/machine/";
5151
const VAULT_SPIFFE_TRUST_DOMAIN_ENV_VAR: &str = "VAULT_SPIFFE_TRUST_DOMAIN";
5252
const VAULT_SPIFFE_MACHINE_BASE_PATH_ENV_VAR: &str = "VAULT_SPIFFE_MACHINE_BASE_PATH";
@@ -907,7 +907,7 @@ pub struct VaultConfig {
907907
pub pki_role_name: Option<String>,
908908
pub token: Option<String>,
909909
pub vault_cacert: Option<String>,
910-
/// SPIFFE trust domain for machine PKI URI SANs. Defaults to `forge.local`.
910+
/// SPIFFE trust domain for machine PKI URI SANs. Defaults to `nico.local`.
911911
pub spiffe_trust_domain: Option<String>,
912912
/// Path prefix after the trust domain, e.g. `/forge-system/machine/`.
913913
pub spiffe_machine_base_path: Option<String>,
@@ -1060,6 +1060,14 @@ mod tests {
10601060
);
10611061
}
10621062

1063+
#[test]
1064+
fn vault_config_spiffe_trust_domain_defaults_to_nico_local() {
1065+
use super::VaultConfig;
1066+
1067+
let config = VaultConfig::default();
1068+
assert_eq!(config.spiffe_trust_domain(), "nico.local");
1069+
}
1070+
10631071
fn jwt_from_payload(payload_value: serde_json::Value) -> String {
10641072
let header = base64::engine::general_purpose::URL_SAFE_NO_PAD
10651073
.encode(r#"{"alg":"none","typ":"JWT"}"#);

‎dev/mac-local-dev/carbide-api-config.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ admin_root_cafile_path = "dev/certs/localhost/ca.crt"
7878
permissive_mode = true
7979

8080
[auth.trust]
81-
spiffe_trust_domain = "forge.local"
81+
spiffe_trust_domain = "nico.local"
8282
spiffe_service_base_paths = ["/forge-system/sa/", "/default/sa/"]
8383
spiffe_machine_base_path = "/forge-system/machine/"
8484
additional_issuer_cns = []

‎dev/mac-local-dev/run-carbide-api.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ else
9494
vault secrets enable -path=certs pki
9595
vault write certs/root/generate/internal common_name=myvault.com ttl=87600h
9696
vault write certs/config/urls issuing_certificates=\"http://vault.example.com:8200/v1/pki/ca\" crl_distribution_points=\"http://vault.example.com:8200/v1/pki/crl\"
97-
vault write certs/roles/role allowed_domains=example.com allow_subdomains=true max_ttl=72h require_cn=false allowed_uri_sans=\"spiffe://forge.local/*\"
97+
vault write certs/roles/role allowed_domains=example.com allow_subdomains=true max_ttl=72h require_cn=false allowed_uri_sans=\"spiffe://nico.local/*\"
9898
" >/dev/null 2>&1
9999

100100
ok "Vault initialized at $VAULT_ADDR"

‎helm/examples/carbide-legacy.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@
1414
## trust domain).
1515
global:
1616
spiffe:
17+
# Legacy SPIFFE trust domain (see GH-2060). Rust/Helm default is nico.local;
18+
# keep forge.local here until every client cert and Vault URI SAN is issued
19+
# under nico.local. Path prefixes (/forge-system/machine/, /forge-system/sa/)
20+
# come from auth.namespace below, not from this trustDomain field.
1721
trustDomain: forge.local
1822

1923
nico-api:

0 commit comments

Comments
 (0)