lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(xcecli): restore dangling CA-cert cleanup misses, enable https support

Browse source 
bug-1463: commit 94f50ce6 (bug-1453 CA-cert-plumbing removal) missed
GetJobOutput's dead tls.Config/loadRootCAs block in request.go, plus
peek.go's SetRootCAs call and serverInfo.CACert field access (the
field no longer exists on APIServerInfo) -- broke the xcecli build.

Removed all three dangling references. Also enabled NewAPIClient's
previously-commented-out InsecureSkipVerify TLS config, since no
xcecli method set any TLS config at all -- any https:// apiserver URL
would have failed cert verification, not just GetJobOutput. Matches
bug-1453's documented design (server-side TLS only, no peer
verification, mTLS deferred as P3 hardening).

Documented both the api-server (http+https) and controller
(server-side-cert-only, no client certs) TLS postures in
.kiro/steering/security.md, replacing a stale line claiming TLS is
handled at the network layer, plus a follow-up note for the planned
HAProxy TLS-termination reverse proxy once its cert type and
apiserver's own listener fate are decided.
This commit is contained in:
Rongsong Shen 2026-07-23 07:28:01 +00:00
parent ff1be48001
commit 4ec401672b
3 changed files with 17 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/frontend/xcecli/cmd/jobs/peek.go
View file

@ -84,7 +84,6 @@ func (q *PeekQuerier) Run(jobID string) error {
}
apiClient := request.NewAPIClient(serverInfo.URL)
apiClient.SetRootCAs(serverInfo.CACert)
// Determine stream type
streamType := "stdout"
@ -119,7 +118,7 @@ func (q *PeekQuerier) Run(jobID string) error {
}
// Fetch output
resp, err := apiClient.GetJobOutput(serverInfo.Token, serverInfo.CACert, apiJobID, params)
resp, err := apiClient.GetJobOutput(serverInfo.Token, apiJobID, params)
if err != nil {
return err
}