dfef9f470f
fix bug in webhookcachefiller caused when status update returns error
...
Also refactor test assertions regarding log statements in
jwtcachefiller_test.go and webhookcachefiller_test.go
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
f5da417450
fix bug in jwtcachefiller caused when status update returns error
...
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
a888083c50
Introduce type alias CABundleHash for the hash of a CA bundle ([32]byte)
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
fcceeed9fa
Refactor tlsconfigutil.CABundle 'getters' to not have 'get' in the name
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
282b949c24
update jwtcachefiller to use new tlsconfigutil.CABundle type
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
005dbf3aa8
refactor tlsconfigutil to return a caBundle type
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
9420bfde5b
webhookcachefiller controller loops over all webhookauthenticators
2024-08-05 11:32:20 -07:00
06b47a5792
jwtcachefiller controller loops over all jwtauthenticators
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-08-05 11:32:20 -07:00
414ff503ef
extract some common condition reason string constants
2024-08-05 11:32:20 -07:00
373713f7e0
webhook controller redoes validations when external CA bundle changes
2024-08-05 11:32:19 -07:00
2d5943b21a
Move conditions reason Success to conditions_util
2024-08-05 11:32:19 -07:00
920b519ebf
error when CA bundle from Secret or ConfigMap is empty
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-08-05 11:32:19 -07:00
bf1c02d328
jwtauthenticator controller redoes validations when external CA bundle changes
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:19 -07:00
6e9023e090
add code review todos and light refactoring
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:19 -07:00
1b7a26d932
test secret and configmap filtering in concierge authenticator controllers
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
cb4b63f8b3
integration tests for concierge authenticators
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
207bac9452
webhook cache filler
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
a2be4b7b5e
clarify some comments based on PR feedback
2024-07-17 09:58:26 -07:00
b5a509f27f
fix authenticators bug: stop allowing usage when validation fails
2024-07-16 09:59:19 -07:00
bafd578866
Merge branch 'main' into jtc/add-importas-linter
2024-06-11 09:39:48 -05:00
bdd79a9984
Enforce more imports
...
- go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/fake
- go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake
- go.pinniped.dev/generated/latest/client/concierge/informers/externalversions
- go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions
2024-05-21 09:31:15 -05:00
f5116cddb4
Enable 'makezero' and 'prealloc' linters, and require 'any' instead of 'interface{}'
...
Enforce importas:
- go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1
- go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
2024-05-21 09:31:15 -05:00
e9252a9ee3
Enforce more imports
...
- k8s.io/apimachinery/pkg/apis/meta/v1
- k8s.io/api/core/v1
- github.com/coreos/go-oidc/v3/oidc
- github.com/ory/fosite/handler/oauth2
- go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1
2024-05-21 09:31:15 -05:00
875b0739aa
Enforce aliases for 'k8s.io/apimachinery/pkg/util/errors' and 'k8s.io/apimachinery/pkg/api/errors'
2024-05-21 09:31:15 -05:00
791b785dea
Merge branch 'main' into jtc/merge-main-at-d7849c79-to-github
2024-05-10 14:22:09 -05:00
7b36c8ab54
Enable 'copyloopvar' linter
2024-05-10 12:51:02 -05:00
fe5d037600
Merge branch 'main' into jtc/merge-main-5fe94c4e-into-github
2024-04-23 12:42:07 -05:00
0ef98f0558
Use new helpers to assert that all webhook dials use ptls settings
2024-04-19 11:15:59 -07:00
94bee9e882
Remove testutil.TLSTestServerWithCert in favor of the testutil/tlsserver package
2024-04-19 10:30:23 -05:00
da135d9958
Webhookcachefiller now uses a real tls.Dial, which means we can test IPv6
2024-04-19 09:24:17 -05:00
e048859afd
Use ptls package when calling webhook during authentication
2024-04-18 16:00:57 -07:00
8c081c50d4
Use ptls package to determine TLS config when probing webhook for status
2024-04-18 12:55:49 -07:00
c9b61ef010
Populate internal GitHub IDP Config from CRD
2024-04-16 14:33:01 -05:00
c6b0820438
Fix some utils, spacing, func naming, test inputs, etc.
2024-03-26 16:22:51 -04:00
f86c46e160
Update WebhookAuthenticator Status WebhookConnectionValid
...
- ConnectionProbeValid -> WebhookConnectionValid
- This is to conform with the pattern of other controllers, ex:
LDAPConnectionValid
2024-03-26 15:33:44 -04:00
e38a27d93d
Add endpointaddr.ParseFromURL helper, WebhookAuthenticator handle additional IPv6 cases
2024-03-22 15:57:57 -04:00
b0904c2e99
change TestNewWebhookAuthenticator to test table style
2024-03-20 11:39:55 -04:00
bec5fe85cc
change WebhookAuthenticator TLSConnectionNegotiationValid to ConnectionProbeValid
2024-03-19 18:00:40 -04:00
90e7343fb5
Add IPv6 test to WebhookAuthenticator ctrl tests
...
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2024-03-19 16:48:08 -04:00
5c0d67dc50
refactor WebhookAuthenticator newWebhookAuthenticator func
2024-03-19 16:48:08 -04:00
b6512bcbb6
add WebhookCacheFiller updateStatus tests
2024-03-19 16:48:07 -04:00
097e6d5340
Always pass spec to CreateTestWebhookAuthenticator
2024-03-19 16:48:07 -04:00
0467e5c1d5
Refactor logLines to SplitByNewline, deduplicate
2024-03-19 16:48:06 -04:00
337459feb0
Update webhook status integration tests
...
- total api fields test 260->261
2024-03-19 16:48:05 -04:00
590e2d18f7
Add WebhookAuthenticator integration tests, expand unit tests
...
- Add WebhookAuthenticator unit tests, update generated code
- Add validateTLSNegotiation(), update tests
- Update validateTLSNegotiation, add unit tests, factor out helpers
- Update generated code
2024-03-19 16:48:05 -04:00
ef36b454ba
Improve WebhookAuthenticator Status and Validations
...
- Validate TLS Configuration
- Validate Endpoint
- Validate TLS Negotiation
- Report status handshake negotiation with webhook
- Unit tests
- Integration tests
2024-03-19 16:48:03 -04:00
c6c2c525a6
Upgrade the linter and fix all new linter warnings
...
Also fix some tests that were broken by bumping golang and dependencies
in the previous commits.
Note that in addition to changes made to satisfy the linter which do not
impact the behavior of the code, this commit also adds ReadHeaderTimeout
to all usages of http.Server to satisfy the linter (and because it
seemed like a good suggestion).
2022-08-24 14:45:55 -07:00
7751c0bf59
Bump project deps, including kube 0.23.6->0.24.1 and Go 1.18.1->1.18.3
...
Several API changes in Kube required changes in Pinniped code.
Signed-off-by: Monis Khan <mok@vmware.com >
2022-06-07 15:26:30 -04:00
814399324f
Merge branch 'main' into upstream_access_revocation_during_gc
2022-01-14 10:49:22 -08:00
9599ffcfb9
Update all deps to latest where possible, bump Kube deps to v0.23.1
...
Highlights from this dep bump:
1. Made a copy of the v0.4.0 github.com/go-logr/stdr implementation
for use in tests. We must bump this dep as Kube code uses a
newer version now. We would have to rewrite hundreds of test log
assertions without this copy.
2. Use github.com/felixge/httpsnoop to undo the changes made by
ory/fosite#636 for CLI based login flows. This is required for
backwards compatibility with older versions of our CLI. A
separate change after this will update the CLI to be more
flexible (it is purposefully not part of this change to confirm
that we did not break anything). For all browser login flows, we
now redirect using http.StatusSeeOther instead of http.StatusFound.
3. Drop plog.RemoveKlogGlobalFlags as klog no longer mutates global
process flags
4. Only bump github.com/ory/x to v0.0.297 instead of the latest
v0.0.321 because v0.0.298+ pulls in a newer version of
go.opentelemetry.io/otel/semconv which breaks k8s.io/apiserver.
We should update k8s.io/apiserver to use the newer code.
5. Migrate all code from k8s.io/apimachinery/pkg/util/clock to
k8s.io/utils/clock and k8s.io/utils/clock/testing
6. Delete testutil.NewDeleteOptionsRecorder and migrate to the new
kubetesting.NewDeleteActionWithOptions
7. Updated ExpectedAuthorizeCodeSessionJSONFromFuzzing caused by
fosite's new rotated_secrets OAuth client field. This new field
is currently not relevant to us as we have no private clients.
Signed-off-by: Monis Khan <mok@vmware.com >
2021-12-16 21:15:27 -05:00
Ryan Richard
Joshua Casey
Ashish Amarnath
Benjamin A. Petersen
Monis Khan