oxidecomputer / oxidecomputer/omicron
Add TLS support for Crucible: initialize regions with a X509 keypair
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 572
- Forks
- 97
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 96
Description
Crucible's downstairs <-> upstairs communication can occur over TLS if the downstairs and upstairs are each supplied X509 keypairs (a key and cert, plus the root used to sign the cert). Currently when Nexus instructs the Crucible agent to create a Downstairs region, it does not pass a X509 keypair.
For Crucible's communication to occur over TLS, Nexus must send the agent a keypair when the region is created, and send the corresponding Upstairs its keypair (during InstanceEnsureRequest) when the instance is created.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Trace the Nexus flow that creates a Crucible Downstairs region and the InstanceEnsureRequest path that creates the Upstairs instance. Determine how the X509 keypair and signing root are represented and passed in each request. Done means both sides receive their corresponding keypair when the region and instance are created, enabling TLS communication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend-api-design, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100