refactor trust domain fetcher

agent/consul/server.go

@@ -19,7 +19,6 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/hashicorp/consul/agent/connect"
 	"github.com/hashicorp/consul/internal/mesh"
 	"github.com/hashicorp/consul/internal/resource"
 
@@ -878,23 +877,16 @@ func (s *Server) registerControllers(deps Deps) {
 	if stringslice.Contains(deps.Experiments, catalogResourceExperimentName) {
 		catalog.RegisterControllers(s.controllerManager, catalog.DefaultControllerDependencies())
 		mesh.RegisterControllers(s.controllerManager, mesh.ControllerDependencies{
+			// This function is adapted from server_connect.go:getCARoots.
 			TrustDomainFetcher: func() (string, error) {
-				if s.config.CAConfig == nil || s.config.CAConfig.ClusterID == "" {
-					return "", fmt.Errorf("CA has not finished initializing")
-				}
-
-				// Build TrustDomain based on the ClusterID stored.
-				signingID := connect.SpiffeIDSigningForCluster(s.config.CAConfig.ClusterID)
-				if signingID == nil {
-					// If CA is bootstrapped at all then this should never happen but be
-					// defensive.
-					return "", fmt.Errorf("no cluster trust domain setup")
+				_, caConfig, err := s.fsm.State().CAConfig(nil)
+				if err != nil {
+					return "", err
 				}
 
-				return signingID.Host(), nil
+				return s.getTrustDomain(caConfig)
 			},
 		})
-		connect.SpiffeIDSigningForCluster(s.config.CAConfig.ClusterID)
 	}
 
 	reaper.RegisterControllers(s.controllerManager)

agent/consul/server_connect.go

@@ -19,21 +19,15 @@ func (s *Server) getCARoots(ws memdb.WatchSet, state *state.Store) (*structs.Ind
 	if err != nil {
 		return nil, err
 	}
-	if config == nil || config.ClusterID == "" {
-		return nil, fmt.Errorf("CA has not finished initializing")
+
+	trustDomain, err := s.getTrustDomain(config)
+	if err != nil {
+		return nil, err
 	}
 
 	indexedRoots := &structs.IndexedCARoots{}
 
-	// Build TrustDomain based on the ClusterID stored.
-	signingID := connect.SpiffeIDSigningForCluster(config.ClusterID)
-	if signingID == nil {
-		// If CA is bootstrapped at all then this should never happen but be
-		// defensive.
-		return nil, fmt.Errorf("no cluster trust domain setup")
-	}
-
-	indexedRoots.TrustDomain = signingID.Host()
+	indexedRoots.TrustDomain = trustDomain
 
 	indexedRoots.Index, indexedRoots.Roots = index, roots
 	if indexedRoots.Roots == nil {
@@ -77,3 +71,19 @@ func (s *Server) getCARoots(ws memdb.WatchSet, state *state.Store) (*structs.Ind
 
 	return indexedRoots, nil
 }
+
+func (s *Server) getTrustDomain(config *structs.CAConfiguration) (string, error) {
+	if config == nil || config.ClusterID == "" {
+		return "", fmt.Errorf("CA has not finished initializing")
+	}
+
+	// Build TrustDomain based on the ClusterID stored.
+	signingID := connect.SpiffeIDSigningForCluster(config.ClusterID)
+	if signingID == nil {
+		// If CA is bootstrapped at all then this should never happen but be
+		// defensive.
+		return "", fmt.Errorf("no cluster trust domain setup")
+	}
+
+	return signingID.Host(), nil
+}