lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(xcecli): restore dangling CA-cert cleanup misses, enable https support

Browse source 
bug-1463: commit 94f50ce6 (bug-1453 CA-cert-plumbing removal) missed
GetJobOutput's dead tls.Config/loadRootCAs block in request.go, plus
peek.go's SetRootCAs call and serverInfo.CACert field access (the
field no longer exists on APIServerInfo) -- broke the xcecli build.

Removed all three dangling references. Also enabled NewAPIClient's
previously-commented-out InsecureSkipVerify TLS config, since no
xcecli method set any TLS config at all -- any https:// apiserver URL
would have failed cert verification, not just GetJobOutput. Matches
bug-1453's documented design (server-side TLS only, no peer
verification, mTLS deferred as P3 hardening).

Documented both the api-server (http+https) and controller
(server-side-cert-only, no client certs) TLS postures in
.kiro/steering/security.md, replacing a stale line claiming TLS is
handled at the network layer, plus a follow-up note for the planned
HAProxy TLS-termination reverse proxy once its cert type and
apiserver's own listener fate are decided.
This commit is contained in:
Rongsong Shen 2026-07-23 07:28:01 +00:00
parent ff1be48001
commit 4ec401672b
3 changed files with 17 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/frontend/xcecli/cmd/jobs/peek.go
View file

@ -84,7 +84,6 @@ func (q *PeekQuerier) Run(jobID string) error {
}
apiClient := request.NewAPIClient(serverInfo.URL)
apiClient.SetRootCAs(serverInfo.CACert)
// Determine stream type
streamType := "stdout"
@ -119,7 +118,7 @@ func (q *PeekQuerier) Run(jobID string) error {
}
// Fetch output
resp, err := apiClient.GetJobOutput(serverInfo.Token, serverInfo.CACert, apiJobID, params)
resp, err := apiClient.GetJobOutput(serverInfo.Token, apiJobID, params)
if err != nil {
return err
}

14
src/frontend/xcecli/common/request/request.go
View file

@ -1,6 +1,7 @@
package request
import (
"crypto/tls"
"encoding/json"
"fmt"
@ -39,7 +40,11 @@ func NewAPIClient(baseURL string) *APIClient {
}
//c.Client.SetDebug(true)
c.Client.SetTimeout(10 * time.Second)
//c.client.SetTLSClientConfig(&tls.Config{InsecureSkipVerify: true})
// XCE uses server-side TLS only (encryption without peer certificate
// verification, see bug-1453) -- the API server's cert is typically
// self-signed/auto-generated, so skip verification rather than require
// a CA the client has no way to obtain.
c.Client.SetTLSClientConfig(&tls.Config{InsecureSkipVerify: true})
return c
}
@ -136,14 +141,9 @@ func (c *APIClient) SubmitJob(token string, req *models.JobSubmitRequest) (*mode
}
// GetJobOutput retrieves job output from the API server.
func (c *APIClient) GetJobOutput(token, certPath, jobID string, params map[string]string) (*models.JobOutputResponse, error) {
func (c *APIClient) GetJobOutput(token, jobID string, params map[string]string) (*models.JobOutputResponse, error) {
var resp models.JobOutputResponse
baseURL := c.BaseURL
if strings.HasPrefix(baseURL, "https://") {
c.Client.SetTLSClientConfig(&tls.Config{
RootCAs: loadRootCAs(certPath),
})
}
if idx := strings.Index(baseURL, "/xce/v1"); idx != -1 {
baseURL = baseURL[:idx]
}