mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-08-19 05:36:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

TokenCredentialRequest uses actual cert expiry time instead of estimate

Browse Source 
and also audit logs both the NotBefore and NotAfter of the issued cert.
Implemented by changing the return type of the cert issuer helpers
to make them also return the NotBefore and NotAfter values of the new
cert, along with the key PEM and cert PEM.
This commit is contained in:
Ryan Richard
2024-11-27 13:53:03 -06:00
committed by Joshua Casey
parent 032160a85e
commit ae5aad178d
19 changed files with 199 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controller/apicerts/certs_observer_test.go
+6 -6
View File
@@ -1,4 +1,4 @@
// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package apicerts
@@ -173,10 +173,10 @@ func TestObserverControllerSync(t *testing.T) {
ca, err := certauthority.Load(string(caCrt), string(caKey))
require.NoError(t, err)
crt, key, err := ca.IssueServerCertPEM(nil, nil, time.Hour)
pem, err := ca.IssueServerCertPEM(nil, nil, time.Hour)
require.NoError(t, err)
err = dynamicCertProvider.SetCertKeyContent(crt, key)
err = dynamicCertProvider.SetCertKeyContent(pem.CertPEM, pem.KeyPEM)
r.NoError(err)
})
@@ -202,7 +202,7 @@ func TestObserverControllerSync(t *testing.T) {
ca, err := certauthority.Load(string(caCrt), string(caKey))
require.NoError(t, err)
crt, key, err := ca.IssueServerCertPEM(nil, nil, time.Hour)
pem, err := ca.IssueServerCertPEM(nil, nil, time.Hour)
require.NoError(t, err)
apiServingCertSecret := &corev1.Secret{
@@ -212,8 +212,8 @@ func TestObserverControllerSync(t *testing.T) {
},
Data: map[string][]byte{
"caCertificate": []byte("fake cert"),
"tlsPrivateKey": key,
"tlsCertificateChain": crt,
"tlsPrivateKey": pem.KeyPEM,
"tlsCertificateChain": pem.CertPEM,
},
}
err = kubeInformerClient.Tracker().Add(apiServingCertSecret)
internal/controller/authenticator/webhookcachefiller/webhookcachefiller_test.go
+2 -2
View File
@@ -79,7 +79,7 @@ func TestController(t *testing.T) {
require.NoError(t, err)
someUnknownHostNames := []string{"some-dns-name", "some-other-dns-name"}
someLocalIPAddress := []net.IP{net.ParseIP("10.2.3.4")}
pemServerCertForUnknownServer, _, err := caForUnknownServer.IssueServerCertPEM(
pemServerCertForUnknownServer, err := caForUnknownServer.IssueServerCertPEM(
someUnknownHostNames,
someLocalIPAddress,
time.Hour,
@@ -216,7 +216,7 @@ func TestController(t *testing.T) {
badWebhookAuthenticatorSpecGoodEndpointButUnknownCA := authenticationv1alpha1.WebhookAuthenticatorSpec{
Endpoint: goodWebhookDefaultServingCertEndpoint,
TLS: &authenticationv1alpha1.TLSSpec{
CertificateAuthorityData: base64.StdEncoding.EncodeToString(pemServerCertForUnknownServer),
CertificateAuthorityData: base64.StdEncoding.EncodeToString(pemServerCertForUnknownServer.CertPEM),
},
}
internal/controller/supervisorconfig/githubupstreamwatcher/github_upstream_watcher_test.go
+3 -3
View File
@@ -127,7 +127,7 @@ func TestController(t *testing.T) {
caForUnknownServer, err := certauthority.New("Some Unknown CA", time.Hour)
require.NoError(t, err)
unknownServerCABytes, _, err := caForUnknownServer.IssueServerCertPEM(
unknownServerPEM, err := caForUnknownServer.IssueServerCertPEM(
[]string{"some-dns-name", "some-other-dns-name"},
[]net.IP{net.ParseIP("10.2.3.4")},
time.Hour,
@@ -1849,7 +1849,7 @@ func TestController(t *testing.T) {
func() runtime.Object {
badIDP := validFilledOutIDP.DeepCopy()
badIDP.Spec.GitHubAPI.TLS = &idpv1alpha1.TLSSpec{
CertificateAuthorityData: base64.StdEncoding.EncodeToString(unknownServerCABytes),
CertificateAuthorityData: base64.StdEncoding.EncodeToString(unknownServerPEM.CertPEM),
}
return badIDP
}(),
@@ -1861,7 +1861,7 @@ func TestController(t *testing.T) {
Spec: func() idpv1alpha1.GitHubIdentityProviderSpec {
badSpec := validFilledOutIDP.Spec.DeepCopy()
badSpec.GitHubAPI.TLS = &idpv1alpha1.TLSSpec{
CertificateAuthorityData: base64.StdEncoding.EncodeToString(unknownServerCABytes),
CertificateAuthorityData: base64.StdEncoding.EncodeToString(unknownServerPEM.CertPEM),
}
return *badSpec
}(),