ca5bb2170c
webhookcontroller should use a logger that is built for each webhook authenticator
2024-08-05 11:32:20 -07:00
05a2fd97f8
webhookcontroller now only logs the webhook authenticator name instead of an object
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
dedd51df91
Test Refactor: webhookauthenticator_test checks exact log line equality
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
290676e4d1
improve info/debug log messages for jwtcachefiller & webhookcachefiller
...
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
9f17ba5ae4
change wording of TLS config loaded success messages
2024-08-05 11:32:20 -07:00
81d42cb3b9
add unit tests for validatedsettings cache storing ca bundle hash
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
dfef9f470f
fix bug in webhookcachefiller caused when status update returns error
...
Also refactor test assertions regarding log statements in
jwtcachefiller_test.go and webhookcachefiller_test.go
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
f5da417450
fix bug in jwtcachefiller caused when status update returns error
...
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
a888083c50
Introduce type alias CABundleHash for the hash of a CA bundle ([32]byte)
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
99cfc4fbce
Remove tlsconfigutil.CABundle.IsEqual and ensure that tlsconfigutil.NewCABundle handles nil/empty input
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
fcceeed9fa
Refactor tlsconfigutil.CABundle 'getters' to not have 'get' in the name
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
4cf0e46c38
tlsconfigutil.CABundle should generate its own certPool
2024-08-05 11:32:20 -07:00
34eff2a2f9
Refactor tlsconfigutil.buildCABundle to make it more clear where the bundle is coming from
2024-08-05 11:32:20 -07:00
e82cb2c7ba
Refactor tlsconfigutil.getCertPool to return a CABundle and change its name to buildCABundle
2024-08-05 11:32:20 -07:00
0711093ccd
Add tests for tlsconfigutil.CABundle and all callers should use the constructor
2024-08-05 11:32:20 -07:00
15d0006841
Pull tlsconfigutil.CABundle into a separate file
2024-08-05 11:32:20 -07:00
282b949c24
update jwtcachefiller to use new tlsconfigutil.CABundle type
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
005dbf3aa8
refactor tlsconfigutil to return a caBundle type
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
a1dcba4731
add unit tests for validatedsettings cache storing ca bundle hash
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
2a62beeb5f
store ca bundle hash in validated settings cache
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
242fa8afb2
When reading CA bundle from a secret/configmap, return more specific err
...
When the bundle does not contain any certs, make the error more
specific.
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
e3ed722252
Minor refactor
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
9420bfde5b
webhookcachefiller controller loops over all webhookauthenticators
2024-08-05 11:32:20 -07:00
06b47a5792
jwtcachefiller controller loops over all jwtauthenticators
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-08-05 11:32:20 -07:00
414ff503ef
extract some common condition reason string constants
2024-08-05 11:32:20 -07:00
09724cfa71
Add unit test: when discovery is already cached for OIDCIdentityProvider
2024-08-05 11:32:20 -07:00
0f103ed2a4
Add unit tests for external CA bundle in oidc_upstream_watcher_test.go
2024-08-05 11:32:19 -07:00
d62d6a1f27
Refactor github_controller_watcher to simplify the tls Dial
2024-08-05 11:32:19 -07:00
288e092d2e
GitHub IDP watcher should not dial an address that has already been validated
2024-08-05 11:32:19 -07:00
8060e82745
include external CA bundles in the cache key in oidc_upstream_watcher.go
2024-08-05 11:32:19 -07:00
373713f7e0
webhook controller redoes validations when external CA bundle changes
2024-08-05 11:32:19 -07:00
66401b42d8
Add GitHubIDP tests for a CA bundle in a Secret or a ConfigMap
2024-08-05 11:32:19 -07:00
2d5943b21a
Move conditions reason Success to conditions_util
2024-08-05 11:32:19 -07:00
920b519ebf
error when CA bundle from Secret or ConfigMap is empty
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-08-05 11:32:19 -07:00
bf1c02d328
jwtauthenticator controller redoes validations when external CA bundle changes
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:19 -07:00
6e9023e090
add code review todos and light refactoring
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:19 -07:00
1b7a26d932
test secret and configmap filtering in concierge authenticator controllers
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
cb4b63f8b3
integration tests for concierge authenticators
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
8eb15a924f
integration tests for supervisor oidc, ldap, activedirectory IDP
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
6a610a9d51
add namespace to jwt authenticator controller
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
9ab7c39d56
jwt cache filler
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
207bac9452
webhook cache filler
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
199562fd05
get all supervisor unit tests to pass
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
3a969a83b7
update supervisor controllers
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
aab1ee9edc
unify TLS Spec between supervisor and concierge
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
080c75efe6
refactor tls spec validation into its own package
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
a2be4b7b5e
clarify some comments based on PR feedback
2024-07-17 09:58:26 -07:00
b5a509f27f
fix authenticators bug: stop allowing usage when validation fails
2024-07-16 09:59:19 -07:00
0380a9ce33
upgrade github.com/go-jose/go-jose and github.com/coreos/go-oidc
...
Also standardize some related imports and fix some whitespace in a test
2024-06-21 11:16:40 -07:00
c6463831ac
Use plog.Logger instead of logr.Logger wherever possible
2024-06-11 12:47:19 -05:00
Joshua Casey
Ryan Richard
Ashish Amarnath