mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-29 03:22:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Use ptls package to determine TLS config when probing webhook for status

Browse Source
This commit is contained in:
Ryan Richard
2024-04-18 12:55:49 -07:00
parent 59fef0c1b2
commit 8c081c50d4
2 changed files with 23 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controller/authenticator/webhookcachefiller/webhookcachefiller.go
+2 -5
View File
@@ -34,6 +34,7 @@ import (
"go.pinniped.dev/internal/controller/authenticator/authncache"
"go.pinniped.dev/internal/controller/conditionsutil"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/crypto/ptls"
"go.pinniped.dev/internal/endpointaddr"
"go.pinniped.dev/internal/plog"
)
@@ -282,11 +283,7 @@ func (c *webhookCacheFillerController) validateConnection(certPool *x509.CertPoo
return conditions, nil
}
conn, err := c.tlsDialerFunc("tcp", endpointHostPort.Endpoint(), &tls.Config{
MinVersion: tls.VersionTLS12,
// If certPool is nil then RootCAs will be set to nil and TLS will use the host's root CA set automatically.
RootCAs: certPool,
})
conn, err := c.tlsDialerFunc("tcp", endpointHostPort.Endpoint(), ptls.Default(certPool))
if err != nil {
errText := "cannot dial server"
internal/controller/authenticator/webhookcachefiller/webhookcachefiller_test.go
+21 -15
View File
@@ -897,10 +897,12 @@ func TestController(t *testing.T) {
tlsDialerFunc: func(network string, addr string, config *tls.Config) (*tls.Conn, error) {
assert.Equal(t, "tcp", network)
assert.Equal(t, "[0:0:0:0:0:0:0:1]:4242", addr)
defaultTLSConfig := ptls.Default(nil)
assert.True(t, caForLocalhostAs127001.Pool().Equal(config.RootCAs))
assert.Equal(t, uint16(tls.VersionTLS12), config.MinVersion)
return nil, errors.New("IPv6 test fake error to skip real dial in prod code, this is actually success")
assert.Equal(t, defaultTLSConfig.MinVersion, config.MinVersion)
assert.Equal(t, defaultTLSConfig.CipherSuites, config.CipherSuites)
assert.Equal(t, defaultTLSConfig.NextProtos, config.NextProtos)
return nil, errors.New("IPv6 fake dial error")
},
webhooks: []runtime.Object{
&auth1alpha1.WebhookAuthenticator{
@@ -930,7 +932,7 @@ func TestController(t *testing.T) {
Conditions: conditionstestutil.Replace(
allHappyConditionsSuccess("https://[0:0:0:0:0:0:0:1]:4242/some/fake/path", frozenMetav1Now, 0),
[]metav1.Condition{
sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success"),
sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 fake dial error"),
sadReadyCondition(frozenMetav1Now, 0),
unknownAuthenticatorValid(frozenMetav1Now, 0),
},
@@ -945,7 +947,7 @@ func TestController(t *testing.T) {
updateStatusAction,
}
},
wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success`),
wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 fake dial error`),
wantCacheEntries: 0,
},
{
@@ -954,10 +956,12 @@ func TestController(t *testing.T) {
tlsDialerFunc: func(network string, addr string, config *tls.Config) (*tls.Conn, error) {
assert.Equal(t, "tcp", network)
assert.Equal(t, "[0:0:0:0:0:0:0:1]:443", addr, "should add default port when port not provided")
defaultTLSConfig := ptls.Default(nil)
assert.True(t, caForLocalhostAs127001.Pool().Equal(config.RootCAs))
assert.Equal(t, uint16(tls.VersionTLS12), config.MinVersion)
return nil, errors.New("IPv6 test fake error to skip real dial in prod code, this is actually success")
assert.Equal(t, defaultTLSConfig.MinVersion, config.MinVersion)
assert.Equal(t, defaultTLSConfig.CipherSuites, config.CipherSuites)
assert.Equal(t, defaultTLSConfig.NextProtos, config.NextProtos)
return nil, errors.New("IPv6 fake dial error")
},
webhooks: []runtime.Object{
&auth1alpha1.WebhookAuthenticator{
@@ -987,7 +991,7 @@ func TestController(t *testing.T) {
Conditions: conditionstestutil.Replace(
allHappyConditionsSuccess("https://[0:0:0:0:0:0:0:1]/some/fake/path", frozenMetav1Now, 0),
[]metav1.Condition{
sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success"),
sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 fake dial error"),
sadReadyCondition(frozenMetav1Now, 0),
unknownAuthenticatorValid(frozenMetav1Now, 0),
},
@@ -1002,7 +1006,7 @@ func TestController(t *testing.T) {
updateStatusAction,
}
},
wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success`),
wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 fake dial error`),
wantCacheEntries: 0,
},
{
@@ -1094,10 +1098,12 @@ func TestController(t *testing.T) {
tlsDialerFunc: func(network string, addr string, config *tls.Config) (*tls.Conn, error) {
assert.Equal(t, "tcp", network)
assert.Equal(t, "[0:0:0:0:0:0:0:1]:443", addr)
defaultTLSConfig := ptls.Default(nil)
assert.True(t, caForLocalhostAs127001.Pool().Equal(config.RootCAs))
assert.Equal(t, uint16(tls.VersionTLS12), config.MinVersion)
return nil, errors.New("IPv6 test fake error to skip real dial in prod code, this is actually success")
assert.Equal(t, defaultTLSConfig.MinVersion, config.MinVersion)
assert.Equal(t, defaultTLSConfig.CipherSuites, config.CipherSuites)
assert.Equal(t, defaultTLSConfig.NextProtos, config.NextProtos)
return nil, errors.New("IPv6 fake dial error")
},
webhooks: []runtime.Object{
&auth1alpha1.WebhookAuthenticator{
@@ -1127,7 +1133,7 @@ func TestController(t *testing.T) {
Conditions: conditionstestutil.Replace(
allHappyConditionsSuccess("https://0:0:0:0:0:0:0:1/some/fake/path", frozenMetav1Now, 0),
[]metav1.Condition{
sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success"),
sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 fake dial error"),
sadReadyCondition(frozenMetav1Now, 0),
unknownAuthenticatorValid(frozenMetav1Now, 0),
},
@@ -1142,7 +1148,7 @@ func TestController(t *testing.T) {
updateStatusAction,
}
},
wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success`),
wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 fake dial error`),
wantCacheEntries: 0,
},
{