token-server: Make machine token minter config apply to subdomains.

tokenserver/api/admin/v1/config.pb.go

 // Code generated by protoc-gen-go. DO NOT EDIT.
 // source: github.com/luci/luci-go/tokenserver/api/admin/v1/config.proto
 
 package admin
 
 import proto "github.com/golang/protobuf/proto"
 import fmt "fmt"
 import math "math"
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ skipping 22 matching lines @@
 // CertificateAuthorityConfig defines a single CA we trust.
 //
 // Such CA issues certificates for nodes that use The Token Service. Each node
 // has a private key and certificate with Common Name set to the FQDN of this
 // node, e.g. "CN=slave43-c1.c.chromecompute.google.com.internal".
 //
 // The Token Server uses this CN to derive an identity string for a machine. It
 // splits FQDN into a hostname ("slave43-c1") and a domain name
 // ("c.chromecompute.google.com.internal"), searches for a domain name in
 // "known_domains" set, and, if it is present, uses parameters described there
-// for generating a token with machine_id <hostname>@<token-server-url>.
+// for generating a token that contains machine's FQDN and certificate serial
+// number (among other things, see MachineTokenBody in machine_token.proto).
 type CertificateAuthorityConfig struct {
         UniqueId int64  `protobuf:"varint,6,opt,name=unique_id,json=uniqueId" json:"unique_id,omitempty"`
         Cn       string `protobuf:"bytes,1,opt,name=cn" json:"cn,omitempty"`
         CertPath string `protobuf:"bytes,2,opt,name=cert_path,json=certPath" json:"cert_path,omitempty"`
         CrlUrl   string `protobuf:"bytes,3,opt,name=crl_url,json=crlUrl" json:"crl_url,omitempty"`
         UseOauth bool   `protobuf:"varint,4,opt,name=use_oauth,json=useOauth" json:"use_oauth,omitempty"`
         // KnownDomains describes parameters to use for each particular domain.
         KnownDomains []*DomainConfig `protobuf:"bytes,5,rep,name=known_domains,json=knownDomains" json:"known_domains,omitempty"`
 }
 
@@ skipping 40 matching lines @@
 func (m *CertificateAuthorityConfig) GetKnownDomains() []*DomainConfig {
         if m != nil {
                 return m.KnownDomains
         }
         return nil
 }
 
 // DomainConfig is used inside CertificateAuthorityConfig.
 type DomainConfig struct {
         // Domain is domain names of hosts this config applies to.
+        //
+        // Machines that reside in a subdomain of given domain are also considered
+        // part of it, e.g. both FQDNs "host.example.com" and "host.abc.example.com"
+        // match domain "example.com".
         Domain []string `protobuf:"bytes,1,rep,name=domain" json:"domain,omitempty"`
         // MachineTokenLifetime is how long generated machine tokens live, in seconds.
         //
         // If 0, machine tokens are not allowed.
         MachineTokenLifetime int64 `protobuf:"varint,5,opt,name=machine_token_lifetime,json=machineTokenLifetime" json:"machine_token_lifetime,omitempty"`
 }
 
 func (m *DomainConfig) Reset()                    { *m = DomainConfig{} }
 func (m *DomainConfig) String() string            { return proto.CompactTextString(m) }
 func (*DomainConfig) ProtoMessage()               {}
@@ skipping 217 matching lines @@
         0xb6, 0x05, 0xff, 0x8e, 0xfb, 0xa8, 0xa3, 0x37, 0x0a, 0x0c, 0x09, 0x7d, 0xba, 0xe6, 0x80, 0x5f,
         0xa1, 0xae, 0x81, 0x3b, 0x07, 0x95, 0xd5, 0x86, 0x44, 0x9e, 0x6c, 0x85, 0x3a, 0x3a, 0x93, 0x52,
         0x6f, 0xa0, 0xa0, 0x56, 0x53, 0x51, 0xae, 0xc0, 0x54, 0x5a, 0x31, 0x0b, 0x24, 0xf6, 0xd6, 0x7e,
         0x4b, 0x6f, 0xf4, 0xe5, 0x96, 0xe1, 0x77, 0xa8, 0xf7, 0x38, 0xc5, 0x5c, 0x21, 0x40, 0x71, 0xf0,
         0x0d, 0x75, 0xf3, 0xff, 0x5b, 0xfd, 0xbc, 0x95, 0xf1, 0x5b, 0x74, 0x68, 0x99, 0x59, 0x80, 0xa5,
         0x75, 0x50, 0xc1, 0x81, 0x24, 0xde, 0x78, 0xd0, 0xa8, 0xd7, 0x8d, 0x88, 0xcf, 0xd0, 0x71, 0xc9,
         0xee, 0xe9, 0x9a, 0x49, 0x51, 0x08, 0xfb, 0x40, 0x0b, 0x67, 0x7c, 0x58, 0xb2, 0xe7, 0x1b, 0x78,
         0x56, 0xb2, 0xfb, 0xef, 0x2d, 0x9b, 0xb4, 0x68, 0x96, 0xf8, 0xdf, 0xea, 0xc3, 0xaf, 0x00, 0x00,
         0x00, 0xff, 0xff, 0x68, 0x96, 0x3b, 0x9b, 0x97, 0x03, 0x00, 0x00,
 }