Joshua Casey
b20e890f15
Add testutil.RequireLogLines to verify multiple log lines at once
2024-11-27 13:53:00 -06:00
Ryan Richard
4f9530eec7
audit logging WIP
2024-11-27 13:53:00 -06:00
Ryan Richard
e44d70b41d
kube cert agent controller avoids unschedulable nodes when possible
2024-11-25 14:20:12 -08:00
Joshua Casey
0c131f11f8
plog.TestLogger returns a buffer instead of taking one in
2024-11-07 17:46:01 -06:00
Ryan Richard
106a480dad
JWTAuthenticator must reload when spec.audience or spec.claims changes
2024-11-04 12:49:18 -08:00
Ryan Richard
f36298c542
use required headers for GitHub API connection probe request
2024-10-14 11:12:34 -07:00
Ryan Richard
dc195536d0
also use port number when checking https proxy for WebhookAuthenticator
2024-10-11 14:49:46 -07:00
Ryan Richard
4d2bbac674
use .cluster.local address for LUA (squid cannot resolve .svc addresses)
2024-10-10 14:44:14 -07:00
Ryan Richard
4f661aaa69
pay attention to web proxy settings during connection probes
...
- WebhookAuthenticator will now detect the proxy setting and skip
dialing the connection probe if it should go through a proxy
- GitHubIdentityProvider will avoid using tls.Dial altogether
by instead making a real request to the GitHub API as its
connection probe, because this will respect the proxy settings
2024-10-10 10:41:31 -07:00
Joshua Casey
f7fd209f29
Address PR feedback
2024-09-24 14:14:48 -05:00
Joshua Casey
76a116641f
Add ptls.Dialer to provide some common configuration for tls.Dial operations
2024-09-24 14:14:48 -05:00
Joshua Casey
08abff1cae
Bump golanglint-ci to 1.60.3
2024-09-04 20:52:01 -05:00
Joshua Casey
b78e2c7ded
Update comments for testing
2024-08-27 13:26:40 -05:00
Joshua Casey
0ee8ee80e1
Use sha256.Size
2024-08-27 13:26:39 -05:00
Joshua Casey
8bd9b94d0a
Impersonator server should take in a cancellable context instead of a stop channel
2024-08-27 13:26:39 -05:00
Joshua Casey
504f0dc26f
Fix some unit tests
2024-08-27 13:26:38 -05:00
Joshua Casey
d0f5c2c7ab
Merge branch 'main' into jtc/refactor-conditions-util
2024-08-09 11:22:59 -05:00
Ryan Richard
5e6f6a1c50
support alternate controller-manager flags in kubecertagent controller
2024-08-08 15:52:50 -07:00
Joshua Casey
bab8b54ed8
Update godoc
2024-08-08 10:38:12 -05:00
Joshua Casey
4bd5db14b4
Refactor branching logic when using an early return
2024-08-08 08:12:41 -05:00
Joshua Casey
4a9136040c
Refactor to make it obvious that newCondition is a copy
2024-08-08 08:12:41 -05:00
Joshua Casey
8b97414f3d
Refactor to simplify logic
2024-08-08 08:12:41 -05:00
Joshua Casey
1e8e9ecc98
Refactor to use slices helpers instead of harder-to-read loops
2024-08-08 08:12:41 -05:00
Joshua Casey
2d8ab9ff5d
Refactor variable name for clarity
2024-08-08 08:12:41 -05:00
Joshua Casey
17f66331ea
Refactor parameter names for clarity
2024-08-08 08:12:41 -05:00
Joshua Casey
6bf30bc6b5
Backfill test for existing exported function HadErrorCondition
2024-08-08 08:12:41 -05:00
Joshua Casey
f798777a3b
Refactor: reorder parameters to MergeConditions
2024-08-08 08:12:41 -05:00
Ryan Richard
6b49cd7d28
add Unknown SearchBaseFound status condition for AD only
2024-08-06 16:08:25 -07:00
Joshua Casey
afa3aa2232
LDAP and AD IDPs now always report condition with type LDAPConnectionValid, even if the status is unknown
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-06 16:08:25 -07:00
Joshua Casey
1c59a41cc5
Remove some dead code from LDAP/AD controllers
2024-08-06 16:08:25 -07:00
Joshua Casey
0626b22c70
OIDC Upstream Watcher now reports condition OIDCDiscoverySucceeded with status Unknown if TLS validation fails
2024-08-06 16:08:25 -07:00
Ryan Richard
229b6a262e
when dialing github to test connection, dial api.github.com
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-08-06 08:58:30 -07:00
Ashish Amarnath
b70db9dc03
refactor to use new certificateAuthorityDataSourceKind enum
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:21 -07:00
Ryan Richard
e0235ed190
update docs and change struct name in types_tls.go.tmpl files
...
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:21 -07:00
Ryan Richard
02e41baa47
small refactors
2024-08-05 11:32:21 -07:00
Ryan Richard
ed502949dd
webhookcachefiller and jwtcachefiller always update status when needed
...
Even when the authenticator is found in the cache, try to update its
status. Failing to do so would mean that the actual status will not
be overwritten by the controller's newly computed desired status.
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Joshua Casey
d6d66faae3
jwtcachefiller now tests for exact log lines and prints when it chooses to not update the status
2024-08-05 11:32:20 -07:00
Ryan Richard
15c84fcc94
extract helper func in jwtcachefiller and webhookcachefiller
2024-08-05 11:32:20 -07:00
Joshua Casey
1438f06c12
webhookcachefiller adds more detail when it chooses to update or not update status conditions
2024-08-05 11:32:20 -07:00
Joshua Casey
ca5bb2170c
webhookcontroller should use a logger that is built for each webhook authenticator
2024-08-05 11:32:20 -07:00
Joshua Casey
05a2fd97f8
webhookcontroller now only logs the webhook authenticator name instead of an object
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Joshua Casey
dedd51df91
Test Refactor: webhookauthenticator_test checks exact log line equality
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Ryan Richard
290676e4d1
improve info/debug log messages for jwtcachefiller & webhookcachefiller
...
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Ryan Richard
9f17ba5ae4
change wording of TLS config loaded success messages
2024-08-05 11:32:20 -07:00
Ashish Amarnath
81d42cb3b9
add unit tests for validatedsettings cache storing ca bundle hash
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Ryan Richard
dfef9f470f
fix bug in webhookcachefiller caused when status update returns error
...
Also refactor test assertions regarding log statements in
jwtcachefiller_test.go and webhookcachefiller_test.go
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Ryan Richard
f5da417450
fix bug in jwtcachefiller caused when status update returns error
...
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Joshua Casey
a888083c50
Introduce type alias CABundleHash for the hash of a CA bundle ([32]byte)
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Joshua Casey
99cfc4fbce
Remove tlsconfigutil.CABundle.IsEqual and ensure that tlsconfigutil.NewCABundle handles nil/empty input
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Joshua Casey
fcceeed9fa
Refactor tlsconfigutil.CABundle 'getters' to not have 'get' in the name
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
