Trusted Cluster Toggle

[russjones]

Problem

At the moment, when you disable a Trusted Cluster, you remove services.CertAuthority and services.ReverseTunnel from the backend. When you re-establish trust, you do the token exchange, and re-add services.CertAuthority and services.ReverseTunnel to the backend.

This is problematic because it requires you to store a long lived token on two clusters.

Proposed Solution

To disable a Trusted Cluster, introduce a new methods to the Trust and Presence interfaces called DeactivateCertAuthority and DeactivateReverseTunnel. These methods will first copy services.CertAuthority and services.ReverseTunnel like so.

Source Location	Destination
/authorities/*/{cluster name}	/authorities/deactivated/*/{cluster name}
/reverseTunnels/{cluster name}	/reverseTunnels/deactivated/{cluster name}

Then call DeleteCertAuthority and DeleteReverse tunnel.

To enable a Trusted Cluster, introduce a new method to the Trust and Presence interfaces called ActivateCertAuthority and ActivateReverseTunnel. These methods will first check if a services.TrustedCluster meta-resource exists. If it does, it will reverse the steps used to deactivate a cluster.