mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-08-28 11:56:25 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Refactor tlsconfigutil.CABundle 'getters' to not have 'get' in the name

Browse Source 
Co-authored-by: Ryan Richard <richardry@vmware.com>
This commit is contained in:
Joshua Casey
2024-08-05 11:32:20 -07:00
committed by Ryan Richard
co-authored by Ryan Richard
parent 4cf0e46c38
commit fcceeed9fa
8 changed files with 43 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controller/authenticator/jwtcachefiller/jwtcachefiller.go
+3 -3
View File
@@ -237,7 +237,7 @@ func (c *jwtCacheFillerController) syncIndividualJWTAuthenticator(ctx context.Co
if jwtAuthenticatorFromCache != nil &&
reflect.DeepEqual(jwtAuthenticatorFromCache.spec, &jwtAuthenticator.Spec) &&
tlsBundleOk && // if there was any error while validating the CA bundle, then run remaining validations and update status
jwtAuthenticatorFromCache.caBundlePEMSHA256 == caBundle.GetCABundleHash() {
jwtAuthenticatorFromCache.caBundlePEMSHA256 == caBundle.Hash() {
c.log.WithValues("jwtAuthenticator", klog.KObj(jwtAuthenticator), "issuer", jwtAuthenticator.Spec.Issuer).
Info("actual jwt authenticator and desired jwt authenticator are the same")
// Stop, no more work to be done. This authenticator is already validated and cached.
@@ -249,7 +249,7 @@ func (c *jwtCacheFillerController) syncIndividualJWTAuthenticator(ctx context.Co
_, conditions, issuerOk := c.validateIssuer(jwtAuthenticator.Spec.Issuer, conditions)
okSoFar := tlsBundleOk && issuerOk
client := phttp.Default(caBundle.GetCertPool())
client := phttp.Default(caBundle.CertPool())
client.Timeout = 30 * time.Second // copied from Kube OIDC code
coreOSCtx := coreosoidc.ClientContext(context.Background(), client)
@@ -269,7 +269,7 @@ func (c *jwtCacheFillerController) syncIndividualJWTAuthenticator(ctx context.Co
client,
jwtAuthenticator.Spec.DeepCopy(), // deep copy to avoid caching original object
keySet,
caBundle.GetCABundleHash(),
caBundle.Hash(),
conditions,
okSoFar)
errs = append(errs, err)
internal/controller/authenticator/webhookcachefiller/webhookcachefiller.go
+3 -3
View File
@@ -162,7 +162,7 @@ func (c *webhookCacheFillerController) syncIndividualWebhookAuthenticator(ctx co
conditions := make([]*metav1.Condition, 0)
caBundle, conditions, tlsBundleOk := c.validateTLSBundle(webhookAuthenticator.Spec.TLS, conditions)
caBundlePEMSHA256 := caBundle.GetCABundleHash()
caBundlePEMSHA256 := caBundle.Hash()
// Only revalidate and update the cache if the cached authenticator is different from the desired authenticator.
// There is no need to repeat validations for a spec that was already successfully validated. We are making a
@@ -189,7 +189,7 @@ func (c *webhookCacheFillerController) syncIndividualWebhookAuthenticator(ctx co
endpointHostPort, conditions, endpointOk := c.validateEndpoint(webhookAuthenticator.Spec.Endpoint, conditions)
okSoFar := tlsBundleOk && endpointOk
conditions, tlsNegotiateErr := c.validateConnection(caBundle.GetCertPool(), endpointHostPort, conditions, okSoFar)
conditions, tlsNegotiateErr := c.validateConnection(caBundle.CertPool(), endpointHostPort, conditions, okSoFar)
errs = append(errs, tlsNegotiateErr)
okSoFar = okSoFar && tlsNegotiateErr == nil
@@ -197,7 +197,7 @@ func (c *webhookCacheFillerController) syncIndividualWebhookAuthenticator(ctx co
// Note that we use the whole URL when constructing the webhook client,
// not just the host and port that we validated above. We need the path, etc.
webhookAuthenticator.Spec.Endpoint,
caBundle.GetCABundle(),
caBundle.PEMBytes(),
conditions,
okSoFar,
)