mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-23 16:42:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
4,223 Commits 31 Branches 54 Tags
23129da3e239ea1a47ca55df1bb0c8f9d99639a8
Commit Graph
4223 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ashish AmarnathandRyan Richard 23129da3e2 add integration test for TLS config validation in GitHubIdentityProvider 
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:21 -07:00
Ashish AmarnathandRyan Richard 59402bca7b add integration test for TLS config validation in OIDCIdentityProvider 
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:21 -07:00
Ashish AmarnathandRyan Richard c3405095b2 Add integration tests for tls spec validation in JWTAuthenticator and WebhookAuthenticator 
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:21 -07:00
Ryan RichardandAshish Amarnath 2181418cc5 refactor test helpers in supervisor_login_test.go 
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:21 -07:00
Ryan RichardandAshish Amarnath e0235ed190 update docs and change struct name in types_tls.go.tmpl files 
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:21 -07:00
Ryan Richard 02e41baa47 small refactors 2024-08-05 11:32:21 -07:00
Ryan Richard 91ef68992c document new CA bundle source option in howto docs 2024-08-05 11:32:20 -07:00
Ashish AmarnathandRyan Richard 43964ff7a2 update generated api docs 
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Ashish AmarnathandRyan Richard 19c4acf391 secret/configmap with CA bundle to be created in namespace where pinniped is installed 
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Ryan RichardandAshish Amarnath ed502949dd webhookcachefiller and jwtcachefiller always update status when needed 
Even when the authenticator is found in the cache, try to update its
status. Failing to do so would mean that the actual status will not
be overwritten by the controller's newly computed desired status.

Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Ashish AmarnathandRyan Richard a0c259ffbc update expectation conditions message when CA bundle is not configured 
fix a typo where we intended to use a configmap instead of a secret

Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>

Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard d6d66faae3 jwtcachefiller now tests for exact log lines and prints when it chooses to not update the status 2024-08-05 11:32:20 -07:00
Ryan Richard 15c84fcc94 extract helper func in jwtcachefiller and webhookcachefiller 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 1438f06c12 webhookcachefiller adds more detail when it chooses to update or not update status conditions 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard ca5bb2170c webhookcontroller should use a logger that is built for each webhook authenticator 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 05a2fd97f8 webhookcontroller now only logs the webhook authenticator name instead of an object 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard dedd51df91 Test Refactor: webhookauthenticator_test checks exact log line equality 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-08-05 11:32:20 -07:00
Ryan RichardandAshish Amarnath 290676e4d1 improve info/debug log messages for jwtcachefiller & webhookcachefiller 
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Ryan RichardandAshish Amarnath 8725ab4caa do not make any assumption about OIDC issuer 404 page body in test 
Instead of using Dex or Okta, use a fake localhost issuer which
does not exist. This will give a consistent connection error
message. Needed because Dex and Okta return different 404 error
pages, so we can't easily make a test assertion that works for both.

Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Ryan RichardandAshish Amarnath 3891f90f43 skip external CA bundle tests when CA bundle is empty 
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Ryan Richard 9f17ba5ae4 change wording of TLS config loaded success messages 2024-08-05 11:32:20 -07:00
Ashish AmarnathandRyan Richard 81d42cb3b9 add unit tests for validatedsettings cache storing ca bundle hash 
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>

Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-08-05 11:32:20 -07:00
Ryan RichardandAshish Amarnath dfef9f470f fix bug in webhookcachefiller caused when status update returns error 
Also refactor test assertions regarding log statements in
jwtcachefiller_test.go and webhookcachefiller_test.go

Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Ryan RichardandAshish Amarnath f5da417450 fix bug in jwtcachefiller caused when status update returns error 
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Joshua CaseyRyan RichardAshish Amarnath
 		a888083c50 Introduce type alias CABundleHash for the hash of a CA bundle ([32]byte) 
Co-authored-by: Ryan Richard <richardry@vmware.com>
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 99cfc4fbce Remove tlsconfigutil.CABundle.IsEqual and ensure that tlsconfigutil.NewCABundle handles nil/empty input 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard fcceeed9fa Refactor tlsconfigutil.CABundle 'getters' to not have 'get' in the name 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 4cf0e46c38 tlsconfigutil.CABundle should generate its own certPool 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 34eff2a2f9 Refactor tlsconfigutil.buildCABundle to make it more clear where the bundle is coming from 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard e82cb2c7ba Refactor tlsconfigutil.getCertPool to return a CABundle and change its name to buildCABundle 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 0711093ccd Add tests for tlsconfigutil.CABundle and all callers should use the constructor 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 15d0006841 Pull tlsconfigutil.CABundle into a separate file 2024-08-05 11:32:20 -07:00
Ashish AmarnathandRyan Richard 282b949c24 update jwtcachefiller to use new tlsconfigutil.CABundle type 
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Ashish AmarnathandRyan Richard 005dbf3aa8 refactor tlsconfigutil to return a caBundle type 
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Ashish AmarnathandRyan Richard a1dcba4731 add unit tests for validatedsettings cache storing ca bundle hash 
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Ashish AmarnathandRyan Richard 2a62beeb5f store ca bundle hash in validated settings cache 
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 242fa8afb2 When reading CA bundle from a secret/configmap, return more specific err 
When the bundle does not contain any certs, make the error more
specific.

Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard e3ed722252 Minor refactor 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 9a16dc28b7 Fix another integration test 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard de86809b69 Fix some integration tests 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 9420bfde5b webhookcachefiller controller loops over all webhookauthenticators 2024-08-05 11:32:20 -07:00
Ryan Richard adb460b644 refactor integration test to use proper test table 2024-08-05 11:32:20 -07:00
Ryan RichardandJoshua Casey 06b47a5792 jwtcachefiller controller loops over all jwtauthenticators 
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>
 2024-08-05 11:32:20 -07:00
Ryan RichardJoshua CaseyAshish Amarnath
 		ca2dd2d476 refactor InferSupervisorIssuerURL() func; remove a TODO 
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 60f82d2a55 Fix integration test typo 2024-08-05 11:32:20 -07:00
Ryan Richard 414ff503ef extract some common condition reason string constants 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 4ec5766ea9 Modify Concierge/Superivsor TLS spec integration tests to allow for older K8s versions 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard b7c26c43ca Add LDAPIdentityProvider and ActiveDirectoryIdentityProvider to the Supervisor TLS config static validation integration tests 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-08-05 11:32:20 -07:00
Joshua CaseyandRyan Richard 4b2ed52f44 Add GitHubIdentityProvider to the Supervisor TLS config static validation integration tests 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-08-05 11:32:20 -07:00
Ryan RichardandJoshua Casey f381c92f0b Use templates to reduce duplication in concierge_tls_spec_test.go 
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>
 2024-08-05 11:32:20 -07:00