feat(kiali): Standardize Certificate Authority Configuration Method #511
+231
−9
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
manusa
changed the title
manusa
reviewed
Nov 26, 2025
pkg/kiali/config_test.go
Outdated
Comment on lines
79
to
93
| // Create a config file with absolute path | ||
| configFile := filepath.Join(s.tempDir, "config.toml") | ||
| // Convert backslashes to forward slashes for TOML compatibility on Windows | ||
| caFileForTOML := filepath.ToSlash(s.caFile) | ||
| configContent := ` | ||
| [toolset_configs.kiali] | ||
| url = "https://kiali.example/" | ||
| certificate_authority = "` + caFileForTOML + `" | ||
| ` | ||
| err := os.WriteFile(configFile, []byte(configContent), 0644) | ||
| s.Require().NoError(err, "Failed to write config file") | ||
|
|
||
| // Read config - Read() automatically sets the config directory path | ||
| cfg, err := config.Read(configFile) | ||
| s.Require().NoError(err, "Failed to read config") |
Member
There was a problem hiding this comment.
Can't this be replaced with the logic we have in place for other tests e.g.
kubernetes-mcp-server/pkg/kiali/kiali_test.go
Lines 31 to 35 in 8d76426
Contributor
Yes please, The idea is to replace the inline CA by path |
Member
Contributor
aljesusg
suggested changes
Nov 28, 2025
Contributor
aljesusg
left a comment
aljesusg
left a comment
There was a problem hiding this comment.
Look good only this 2 minor things, I am going to test it locally
docs/KIALI.md
Outdated
| - Invalid URL → ensure `[toolset_configs.kiali].url` is a valid `http(s)://host` URL. | ||
| - TLS certificate validation: | ||
| - If `[toolset_configs.kiali].url` uses HTTPS and `[toolset_configs.kiali].insecure` is false, you must set `[toolset_configs.kiali].certificate_authority` with the PEM-encoded certificate(s) used by the Kiali server. This field expects inline PEM content, not a file path. You may concatenate multiple PEM blocks to include an intermediate chain. | ||
| - If `[toolset_configs.kiali].url` uses HTTPS and `[toolset_configs.kiali].insecure` is false, you must set `[toolset_configs.kiali].certificate_authority` with the path to the CA certificate file. Relative paths are resolved relative to the directory containing the config file. Only file paths are supported; inline PEM content is not allowed. |
Contributor
There was a problem hiding this comment.
Suggested change
| - If `[toolset_configs.kiali].url` uses HTTPS and `[toolset_configs.kiali].insecure` is false, you must set `[toolset_configs.kiali].certificate_authority` with the path to the CA certificate file. Relative paths are resolved relative to the directory containing the config file. Only file paths are supported; inline PEM content is not allowed. | |
| - If `[toolset_configs.kiali].url` uses HTTPS and `[toolset_configs.kiali].insecure` is false, you must set `[toolset_configs.kiali].certificate_authority` with the path to the CA certificate file. Relative paths are resolved relative to the directory containing the config file. |
Signed-off-by: josunect <[email protected]>
Signed-off-by: josunect <[email protected]>
Signed-off-by: josunect <[email protected]>
Signed-off-by: josunect <[email protected]>
Signed-off-by: josunect <[email protected]>
Signed-off-by: josunect <[email protected]>
Signed-off-by: josunect <[email protected]>
Signed-off-by: josunect <[email protected]>
Signed-off-by: josunect <[email protected]>
Signed-off-by: josunect <[email protected]>
Signed-off-by: josunect <[email protected]>
Signed-off-by: josunect <[email protected]>
Co-authored-by: Alberto Gutierrez <[email protected]> Signed-off-by: josunect <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR keeps the inline option for back-comp, but I can remove it if it is not required.
How to manually test it:
echo | openssl s_client -showcerts -connect kiali-istio-system.apps-crc.testing:443 2>/dev/null | openssl x509 > /tmp/kiali.crtConfiguration (Using a kiali https route):
Run the MCP server: