mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-05 23:57:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

JWTAuthenticator must reload when spec.audience or spec.claims changes

Browse Source
This commit is contained in:
Ryan Richard
2024-11-04 12:49:18 -08:00
parent 587e6fbd8a
commit 106a480dad
3 changed files with 168 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controller/authenticator/webhookcachefiller/webhookcachefiller.go
+4
View File
@@ -298,6 +298,10 @@ func (c *webhookCacheFillerController) havePreviouslyValidated(
if authenticatorFromCache == nil {
return false, false
}
// Compare all spec fields to check if they have changed since we cached the authenticator.
// Instead of directly comparing spec.TLS, compare the effective result of spec.TLS,
// which is the CA bundle that was dynamically loaded.
// If any spec field has changed, then we need a new in-memory authenticator.
if authenticatorFromCache.endpoint == endpoint &&
tlsBundleOk && // if there was any error while validating the latest CA bundle, then do not consider it previously validated
authenticatorFromCache.caBundleHash.Equal(caBundleHash) {