-
-
Notifications
You must be signed in to change notification settings - Fork 631
Description
I've contributed support to pkimetal to listen on a unix socket. This is included in release v1.32.0.
Now we need Boulder to support using pkimetal via Unix socket.
This enables running a pkimetal container as a sidecar to cert-checker & boulder-ca with networking disabled, which we want to do to reduce risk in our production environment.
In lint_cert_via_pkimetal.go, we'll need to add a new Socket option to PKIMetalConfig, and construct an HTTP Client with a Transport using a net.Dialer DialContext with network "unix" and the unix socket path.
The integration test docker-compose.yml will be need to be updated to use pkimetal v1.32.0. It will need to be configured to use a unix socket, and zlint.toml in config and config-next will need to be updated with the new socket configuration to use that.