swarm/init: Fix --external-ca ignoring cacert option

[vvoland]

• related to: integration-cli: Update default CLI version to v18.06.3-ce moby/moby#49677 (comment)

- What I did
31d6292 mistakenly changed the ToSpec function to set all certs passed via external-ca to empty strings.

- How I did it

- How to verify it

• TestSwarmUpdate on in moby integration-cli
• TestSwarmInitWithExternalCA

Before:

$ go test -run TestSwarmInitWithExternalCA
--- FAIL: TestSwarmInitWithExternalCA (0.00s)
    init_test.go:143: assertion failed: 
        --- req.Spec.CAConfig.ExternalCAs[0].CACert
        +++ cert
        @@ -1 +1,13 @@
        -
        +
        +-----BEGIN CERTIFICATE-----
        +MIIBuDCCAV4CCQDOqUYOWdqMdjAKBggqhkjOPQQDAzBjMQswCQYDVQQGEwJVUzEL
        +MAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDzANBgNVBAoMBkRv
        +Y2tlcjEPMA0GA1UECwwGRG9ja2VyMQ0wCwYDVQQDDARUZXN0MCAXDTE4MDcwMjIx
        +MjkxOFoYDzMwMTcxMTAyMjEyOTE4WjBjMQswCQYDVQQGEwJVUzELMAkGA1UECAwC
        +Q0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDzANBgNVBAoMBkRvY2tlcjEPMA0G
        +A1UECwwGRG9ja2VyMQ0wCwYDVQQDDARUZXN0MFkwEwYHKoZIzj0CAQYIKoZIzj0D
        +AQcDQgAEgvvZl5Vqpr1e+g5IhoU6TZHgRau+BZETVFTmqyWYajA/mooRQ1MZTozu
        +s9ZZZA8tzUhIqS36gsFuyIZ4YiAlyjAKBggqhkjOPQQDAwNIADBFAiBQ7pCPQrj8
        +8zaItMf0pk8j1NU5XrFqFEZICzvjzUJQBAIhAKq2gFwoTn8KH+cAAXZpAGJPmOsT
        +zsBT8gBAOHhNA6/2
        +-----END CERTIFICATE-----
        
FAIL
exit status 1
FAIL	github.com/docker/cli/cli/command/swarm	0.381s

After

$ go test -run TestSwarmInitWithExternalCA 
PASS
ok  	github.com/docker/cli/cli/command/swarm	1.009

- Human readable description for the release notes

- Fix `docker swarm init` ignoring `cacert` option of `--external-ca`.

- A picture of a cute animal (not mandatory but encouraged)

[vvoland]

Am I wrong here, or has this been broken for 7 years and nobody noticed? 🤣

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[thaJeztah]

Am I wrong here, or has this been broken for 7 years and nobody noticed? 🤣

Oh, someone noticed,

• [WIP] Fix swarm init and swarm update test moby/moby#37442
• [WIP] [18.06] Fix CLI external-ca tests in swarm suite docker-archive/engine#23

(and there's a couple of, now archived, internal issues tracking it); ISTR there was a security-related issue attached at some point, and there was some discussion whether the feature had to be restored or removed, and that's where things got stuck.

[vvoland]

Actually this isn't the same issue - the PRs you mention deal with the first cert being empty instead of defaulting to the "Trusted CA Root".

This PR is about the second cert which the CLI doesn't even pass to the swarm.

[vvoland]

I'll leave it up to the Mirantis folks to decide what to do with this one.

cc @dperny @corhere

[Copilot]

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

[thaJeztah]

LGTM

lets bring this one in