TLS certs and cEOS

[networkop]

hey 👋 , I need a couple of self-signed certs for EOS's restconf interface.
Is there an example of how to orchestrate this with containerlab?

[hellt]

Hi, mate
Today we generate a CA per lab deployment and keys for SR Linux as the latter needs TLS for gnmi to work.
If you deploy a lab you will see it under clab-<labname>/ca dir.

We can create client certs for ceos as well, it was just not needed by default as ceos supports insecure gnmi mode.

If you are okay with a semi-manual approach, then you can leverage https://containerlab.dev/cmd/tools/cert/sign/ command to create client cert/key for arista?

[hellt]

if you want to call this command after the lab is deployed, you can use clab exec for that or leverage exec node property - https://containerlab.dev/manual/nodes/#exec and make Cli -p 15 "tls blah" to make ceos generate self-signed cert on boot

I also think that maybe it makes sense to add this cert generation part of the ceos.Postdeploy stage, and, say, create clab key and cert for all ceos nodes.
If one happens to need a tls cert, it will be available by default

[networkop]

Yep, I noticed that. Is there anything special in ceos node kind to make it mount those files in the right directory?
I believe it doesn't use /mnt/flash but uses /persist/secure instead.

[hellt]

to make those files available (without asking user to configure binds in clab file) at certain paths one would need to add the right bind mounts here

containerlab/nodes/ceos/ceos.go

Lines 70 to 94 in f918bdc

	func (s *ceos) Init(cfg *types.NodeConfig, opts ...nodes.NodeOption) error {
	s.cfg = cfg
	for _, o := range opts {
	o(s)
	}
	s.cfg.Env = utils.MergeStringMaps(ceosEnv, s.cfg.Env)
	// the node.Cmd should be aligned with the environment.
	// prepending original Cmd with if-wait.sh script to make sure that interfaces are available
	// before init process starts
	var envSb strings.Builder
	envSb.WriteString("bash -c '" + ifWaitScriptContainerPath + " ; exec /sbin/init ")
	for k, v := range s.cfg.Env {
	envSb.WriteString("systemd.setenv=" + k + "=" + v + " ")
	}
	envSb.WriteString("'")
	s.cfg.Cmd = envSb.String()
	s.cfg.MacAddress = utils.GenMac("00:1c:73")
	// mount config dir
	cfgPath := filepath.Join(s.cfg.LabDir, "flash")
	s.cfg.Binds = append(s.cfg.Binds, fmt.Sprintf("%s:/mnt/flash/", cfgPath))
	return nil
	}

[networkop]

ACK.