linkerd
/
linkerd2
mirror of https://github.com/linkerd/linkerd2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Improve comments in proxy-identity (#5420) 

The proxy-identity tool has some incomplete and otherwise
awkward/ambiguous comments. This change attempts to clarify them.
This commit is contained in:
Oliver Gould 2020-12-23 08:28:41 -08:00 committed by GitHub
parent b830efdad7
commit 6c7defeede
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
proxy-identity/main.go
View File

@ -67,11 +67,10 @@ func loadVerifier(pem string) (verify x509.VerifyOptions, err error) {
// checkEndEntityDir checks that the provided directory path exists and is // checkEndEntityDir checks that the provided directory path exists and is
// suitable to write key material to, returning the key and CSR paths. // suitable to write key material to, returning the key and CSR paths.
// //
// If the directory does not exist, we assume that the wrong directory was // If the directory does not exist, we assume that the directory was specified
// specified incorrectly instead of trying to create or repair the directory. // incorrectly and return an error. In practice this directory should be tmpfs
// In practice this directory should be tmpfs so that credentials are not // so that credentials are not written to disk, so we do not want to create new
// written to disk, so we want to be extra sensitive to an incorrectly // directories here.
// specified path.
// //
// If the key and/or CSR paths refer to existing files, it will be logged and // If the key and/or CSR paths refer to existing files, it will be logged and
// the credentials will be recreated. // the credentials will be recreated.
@ -112,7 +111,10 @@ func checkNotExists(p string) (err error) {
} }
func generateAndStoreKey(p string) (key *ecdsa.PrivateKey, err error) { func generateAndStoreKey(p string) (key *ecdsa.PrivateKey, err error) {
// Generate a private key and store it read-only (i.e. mostly for debugging). Because the file is read-only // Generate a private key and store it read-only. This is written to the
// file-system so that the proxy may read this key at startup. The
// destination path should generally be tmpfs so that the key material is
// not written to disk.
key, err = tls.GenerateKey() key, err = tls.GenerateKey()
if err != nil { if err != nil {
return return