Ryan Richard and Ashish Amarnath
dfef9f470f
fix bug in webhookcachefiller caused when status update returns error
...
Also refactor test assertions regarding log statements in
jwtcachefiller_test.go and webhookcachefiller_test.go
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Ryan Richard and Ashish Amarnath
f5da417450
fix bug in jwtcachefiller caused when status update returns error
...
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
a888083c50
Introduce type alias CABundleHash for the hash of a CA bundle ([32]byte)
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
99cfc4fbce
Remove tlsconfigutil.CABundle.IsEqual and ensure that tlsconfigutil.NewCABundle handles nil/empty input
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
fcceeed9fa
Refactor tlsconfigutil.CABundle 'getters' to not have 'get' in the name
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
4cf0e46c38
tlsconfigutil.CABundle should generate its own certPool
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
34eff2a2f9
Refactor tlsconfigutil.buildCABundle to make it more clear where the bundle is coming from
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
e82cb2c7ba
Refactor tlsconfigutil.getCertPool to return a CABundle and change its name to buildCABundle
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
0711093ccd
Add tests for tlsconfigutil.CABundle and all callers should use the constructor
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
15d0006841
Pull tlsconfigutil.CABundle into a separate file
2024-08-05 11:32:20 -07:00
Ashish Amarnath and Ryan Richard
282b949c24
update jwtcachefiller to use new tlsconfigutil.CABundle type
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Ashish Amarnath and Ryan Richard
005dbf3aa8
refactor tlsconfigutil to return a caBundle type
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Ashish Amarnath and Ryan Richard
a1dcba4731
add unit tests for validatedsettings cache storing ca bundle hash
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Ashish Amarnath and Ryan Richard
2a62beeb5f
store ca bundle hash in validated settings cache
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
242fa8afb2
When reading CA bundle from a secret/configmap, return more specific err
...
When the bundle does not contain any certs, make the error more
specific.
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
e3ed722252
Minor refactor
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
9420bfde5b
webhookcachefiller controller loops over all webhookauthenticators
2024-08-05 11:32:20 -07:00
Ryan Richard and Joshua Casey
06b47a5792
jwtcachefiller controller loops over all jwtauthenticators
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-08-05 11:32:20 -07:00
Ryan Richard
414ff503ef
extract some common condition reason string constants
2024-08-05 11:32:20 -07:00
Ryan Richard
09724cfa71
Add unit test: when discovery is already cached for OIDCIdentityProvider
2024-08-05 11:32:20 -07:00
Ryan Richard
0f103ed2a4
Add unit tests for external CA bundle in oidc_upstream_watcher_test.go
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
d62d6a1f27
Refactor github_controller_watcher to simplify the tls Dial
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
288e092d2e
GitHub IDP watcher should not dial an address that has already been validated
2024-08-05 11:32:19 -07:00
Ryan Richard
8060e82745
include external CA bundles in the cache key in oidc_upstream_watcher.go
2024-08-05 11:32:19 -07:00
Ryan Richard
373713f7e0
webhook controller redoes validations when external CA bundle changes
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
66401b42d8
Add GitHubIDP tests for a CA bundle in a Secret or a ConfigMap
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
2d5943b21a
Move conditions reason Success to conditions_util
2024-08-05 11:32:19 -07:00
Ryan Richard and Joshua Casey
920b519ebf
error when CA bundle from Secret or ConfigMap is empty
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
bf1c02d328
jwtauthenticator controller redoes validations when external CA bundle changes
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
6e9023e090
add code review todos and light refactoring
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
1b7a26d932
test secret and configmap filtering in concierge authenticator controllers
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
cb4b63f8b3
integration tests for concierge authenticators
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
8eb15a924f
integration tests for supervisor oidc, ldap, activedirectory IDP
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
6a610a9d51
add namespace to jwt authenticator controller
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
9ab7c39d56
jwt cache filler
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
207bac9452
webhook cache filler
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
199562fd05
get all supervisor unit tests to pass
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
3a969a83b7
update supervisor controllers
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
aab1ee9edc
unify TLS Spec between supervisor and concierge
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
080c75efe6
refactor tls spec validation into its own package
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ryan Richard
a2be4b7b5e
clarify some comments based on PR feedback
2024-07-17 09:58:26 -07:00
Ryan Richard
b5a509f27f
fix authenticators bug: stop allowing usage when validation fails
2024-07-16 09:59:19 -07:00
Ryan Richard
0380a9ce33
upgrade github.com/go-jose/go-jose and github.com/coreos/go-oidc
...
Also standardize some related imports and fix some whitespace in a test
2024-06-21 11:16:40 -07:00
Joshua Casey
c6463831ac
Use plog.Logger instead of logr.Logger wherever possible
2024-06-11 12:47:19 -05:00
Joshua Casey
678be9902a
Lint new files from the GitHub branch
2024-06-11 10:16:18 -05:00
Joshua Casey
bafd578866
Merge branch 'main' into jtc/add-importas-linter
2024-06-11 09:39:48 -05:00
Joshua Casey and Ryan Richard
58b4ecc0aa
user sees error msg when GitHub login is denied due to allowed orgs
...
Also renamed an interface function from GetName to GetResourceName.
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-06-03 10:56:28 -07:00
Ryan Richard
6364ac9ac7
change status condition type name to be "ClientCredentialsSecretValid"
...
For both GitHubIdentityProvider and OIDCIdentityProvider to make them
consistent with each other.
2024-05-31 09:59:30 -07:00
Joshua Casey
eee737186f
Clean up how lastTransitionTime and observedGeneration are checked in github_upstream_watcher_test
2024-05-30 21:34:29 -05:00
Ryan Richard
f323690049
refactor upstream refresh test helpers to be more specific to IDP type
2024-05-23 13:35:31 -07:00
Ryan RichardandAshish Amarnath
