mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-19 06:31:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

refactor tlsconfigutil to return a caBundle type

Browse Source 
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
This commit is contained in:
Ashish Amarnath
2024-08-05 11:32:20 -07:00
committed by Ryan Richard
parent a1dcba4731
commit 005dbf3aa8
7 changed files with 155 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controller/supervisorconfig/githubupstreamwatcher/github_upstream_watcher.go
+3 -3
View File
@@ -325,7 +325,7 @@ func (c *gitHubWatcherController) validateUpstreamAndUpdateConditions(ctx contro
hostCondition, hostPort := validateHost(upstream.Spec.GitHubAPI)
conditions = append(conditions, hostCondition)
tlsConfigCondition, caBundlePEM, certPool := tlsconfigutil.ValidateTLSConfig(
tlsConfigCondition, caBundle := tlsconfigutil.ValidateTLSConfig(
tlsconfigutil.TLSSpecForSupervisor(upstream.Spec.GitHubAPI.TLS),
"spec.githubAPI.tls",
c.namespace,
@@ -335,8 +335,8 @@ func (c *gitHubWatcherController) validateUpstreamAndUpdateConditions(ctx contro
githubConnectionCondition, hostURL, httpClient, githubConnectionErr := c.validateGitHubConnection(
hostPort,
caBundlePEM,
certPool,
caBundle.GetCABundle(),
caBundle.GetCertPool(),
hostCondition.Status == metav1.ConditionTrue,
tlsConfigCondition.Status == metav1.ConditionTrue,
)
internal/controller/supervisorconfig/oidcupstreamwatcher/oidc_upstream_watcher.go
+3 -4
View File
@@ -6,7 +6,6 @@ package oidcupstreamwatcher
import (
"context"
"crypto/sha256"
"crypto/x509"
"fmt"
"net/http"
@@ -334,7 +333,7 @@ func (c *oidcWatcherController) validateSecret(upstream *idpv1alpha1.OIDCIdentit
// validateIssuer validates the .spec.issuer field, performs OIDC discovery, and returns the appropriate OIDCDiscoverySucceeded condition.
func (c *oidcWatcherController) validateIssuer(ctx context.Context, upstream *idpv1alpha1.OIDCIdentityProvider, result *upstreamoidc.ProviderConfig) []*metav1.Condition {
tlsCondition, caBundlePEM, certPool := tlsconfigutil.ValidateTLSConfig(
tlsCondition, caBundle := tlsconfigutil.ValidateTLSConfig(
tlsconfigutil.TLSSpecForSupervisor(upstream.Spec.TLS),
"spec.tls",
upstream.Namespace,
@@ -360,7 +359,7 @@ func (c *oidcWatcherController) validateIssuer(ctx context.Context, upstream *id
// Get the discovered provider and HTTP client from cache, if they are found in the cache.
cacheKey := oidcDiscoveryCacheKey{
issuer: upstream.Spec.Issuer,
caBundleHash: sha256.Sum256(caBundlePEM), // note that this will always return the same hash for nil input
caBundleHash: caBundle.GetCABundleHash(), // note that this will always return the same hash for nil input
}
if cacheEntry := c.validatorCache.getProvider(cacheKey); cacheEntry != nil {
discoveredProvider = cacheEntry.provider
@@ -374,7 +373,7 @@ func (c *oidcWatcherController) validateIssuer(ctx context.Context, upstream *id
// If the provider does not exist in the cache, do a fresh discovery lookup and save to the cache.
if discoveredProvider == nil {
httpClient = defaultClientShortTimeout(certPool)
httpClient = defaultClientShortTimeout(caBundle.GetCertPool())
_, issuerURLCondition := validateHTTPSURL(upstream.Spec.Issuer, "issuer", reasonUnreachable)
if issuerURLCondition != nil {
internal/controller/supervisorconfig/upstreamwatchers/upstream_watchers.go
+2 -2
View File
@@ -256,9 +256,9 @@ func ValidateGenericLDAP(
conditions.Append(secretValidCondition, true)
tlsSpec := tlsconfigutil.TLSSpecForSupervisor(upstream.Spec().TLSSpec())
tlsValidCondition, caBundle, _ := tlsconfigutil.ValidateTLSConfig(tlsSpec, "spec.tls", upstream.Namespace(), secretInformer, configMapInformer)
tlsValidCondition, caBundle := tlsconfigutil.ValidateTLSConfig(tlsSpec, "spec.tls", upstream.Namespace(), secretInformer, configMapInformer)
conditions.Append(tlsValidCondition, true)
config.CABundle = caBundle
config.CABundle = caBundle.GetCABundle()
var ldapConnectionValidCondition, searchBaseFoundCondition *metav1.Condition
// No point in trying to connect to the server if the config was already determined to be invalid.