TLS certificates #143
TLS certificates #143
Conversation
…nfiguration if parameter is given
…nfiguration if parameter is given
codebien
requested review from
mstoykov and
olegbespalov
and removed request for
a team
| @@ -229,6 +255,14 @@ func parseEnvs(env map[string]string) (Config, error) { | |||
| c.Password = null.StringFrom(password) | |||
| } | |||
|
|
|||
| if clientCertificate, certDefined := env["K6_PROMETHEUS_RW_CLIENT_CERTIFICATE"]; certDefined { | |||
There was a problem hiding this comment.
| if clientCertificate, certDefined := env["K6_PROMETHEUS_RW_CLIENT_CERTIFICATE"]; certDefined { | |
| if clientCertificate, certDefined := env["K6_PROMETHEUS_RW_TLS_CLIENT_CERTIFICATE"]; certDefined { |
Do you think we should be more specific about the naming?
There was a problem hiding this comment.
Is there something else that we can have a client certificate for ?
If not I am also 🤷 - if yes , then I would prefer to have mtls even.
There was a problem hiding this comment.
Not really, or at least I didn't find it. At the moment, if we mention client certificates then they should set automatically the context for TLS, but I can't guarantee for the future.
There was a problem hiding this comment.
We are doing mostly the same with Username and Password where we aren't specifying that is for BasicAuth.
| @@ -229,6 +255,14 @@ func parseEnvs(env map[string]string) (Config, error) { | |||
| c.Password = null.StringFrom(password) | |||
| } | |||
|
|
|||
| if clientCertificate, certDefined := env["K6_PROMETHEUS_RW_CLIENT_CERTIFICATE"]; certDefined { | |||
| @@ -41,6 +41,16 @@ type Config struct { | |||
| // Password is the Password for the Basic Auth. | |||
| Password null.String `json:"password"` | |||
|
|
|||
| // ClientCertificate is the public key of the SSL certificate. | |||
| // It is expected the path of the certificate on the file system. | |||
| // If it is required a dedicated Certifacate Authority then it should be added | |||
There was a problem hiding this comment.
It theory we could also provide the way to add the CA like it's implemented in k6, but not sure if it's under the scope of this PR
There was a problem hiding this comment.
I would prefer if we get an explicit request from users for it. The demand for mTLS feature seems to be not so high in general.
It adds mTLS support. It continues #90 (rebase + polish).