31b45525ce
Remove deprecated CredentialIssuer.status.kubeConfigInfo
2025-01-27 10:46:55 -06:00
ae5aad178d
TokenCredentialRequest uses actual cert expiry time instead of estimate
...
and also audit logs both the NotBefore and NotAfter of the issued cert.
Implemented by changing the return type of the cert issuer helpers
to make them also return the NotBefore and NotAfter values of the new
cert, along with the key PEM and cert PEM.
2024-11-27 13:53:03 -06:00
c5f4cce3ae
make Audit() take struct as param for all optional params and redact PII
2024-11-27 13:53:01 -06:00
ced8686d11
add config for audit logging, remove Audit() from Logger interface
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:01 -06:00
f9e1dd4bec
Backfill unit tests for garbage_collector audit logging
2024-11-27 13:53:01 -06:00
8cf9c59957
refactor to move audit event message types to their own pkg
2024-11-27 13:53:01 -06:00
1006dd9379
resolve some todos
2024-11-27 13:53:01 -06:00
dd42f35db0
plog.TestLogger returns a buffer that holds the logs
...
# Conflicts:
# internal/controller/apicerts/certs_expirer_test.go
# internal/plog/plog_test.go
# internal/plog/testing.go
# pkg/oidcclient/login_test.go
2024-11-27 13:53:00 -06:00
b20e890f15
Add testutil.RequireLogLines to verify multiple log lines at once
2024-11-27 13:53:00 -06:00
4f9530eec7
audit logging WIP
2024-11-27 13:53:00 -06:00
e44d70b41d
kube cert agent controller avoids unschedulable nodes when possible
2024-11-25 14:20:12 -08:00
0c131f11f8
plog.TestLogger returns a buffer instead of taking one in
2024-11-07 17:46:01 -06:00
106a480dad
JWTAuthenticator must reload when spec.audience or spec.claims changes
2024-11-04 12:49:18 -08:00
f36298c542
use required headers for GitHub API connection probe request
2024-10-14 11:12:34 -07:00
dc195536d0
also use port number when checking https proxy for WebhookAuthenticator
2024-10-11 14:49:46 -07:00
4d2bbac674
use .cluster.local address for LUA (squid cannot resolve .svc addresses)
2024-10-10 14:44:14 -07:00
4f661aaa69
pay attention to web proxy settings during connection probes
...
- WebhookAuthenticator will now detect the proxy setting and skip
dialing the connection probe if it should go through a proxy
- GitHubIdentityProvider will avoid using tls.Dial altogether
by instead making a real request to the GitHub API as its
connection probe, because this will respect the proxy settings
2024-10-10 10:41:31 -07:00
f7fd209f29
Address PR feedback
2024-09-24 14:14:48 -05:00
76a116641f
Add ptls.Dialer to provide some common configuration for tls.Dial operations
2024-09-24 14:14:48 -05:00
08abff1cae
Bump golanglint-ci to 1.60.3
2024-09-04 20:52:01 -05:00
b78e2c7ded
Update comments for testing
2024-08-27 13:26:40 -05:00
0ee8ee80e1
Use sha256.Size
2024-08-27 13:26:39 -05:00
8bd9b94d0a
Impersonator server should take in a cancellable context instead of a stop channel
2024-08-27 13:26:39 -05:00
504f0dc26f
Fix some unit tests
2024-08-27 13:26:38 -05:00
d0f5c2c7ab
Merge branch 'main' into jtc/refactor-conditions-util
2024-08-09 11:22:59 -05:00
5e6f6a1c50
support alternate controller-manager flags in kubecertagent controller
2024-08-08 15:52:50 -07:00
bab8b54ed8
Update godoc
2024-08-08 10:38:12 -05:00
4bd5db14b4
Refactor branching logic when using an early return
2024-08-08 08:12:41 -05:00
4a9136040c
Refactor to make it obvious that newCondition is a copy
2024-08-08 08:12:41 -05:00
8b97414f3d
Refactor to simplify logic
2024-08-08 08:12:41 -05:00
1e8e9ecc98
Refactor to use slices helpers instead of harder-to-read loops
2024-08-08 08:12:41 -05:00
2d8ab9ff5d
Refactor variable name for clarity
2024-08-08 08:12:41 -05:00
17f66331ea
Refactor parameter names for clarity
2024-08-08 08:12:41 -05:00
6bf30bc6b5
Backfill test for existing exported function HadErrorCondition
2024-08-08 08:12:41 -05:00
f798777a3b
Refactor: reorder parameters to MergeConditions
2024-08-08 08:12:41 -05:00
6b49cd7d28
add Unknown SearchBaseFound status condition for AD only
2024-08-06 16:08:25 -07:00
afa3aa2232
LDAP and AD IDPs now always report condition with type LDAPConnectionValid, even if the status is unknown
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-06 16:08:25 -07:00
1c59a41cc5
Remove some dead code from LDAP/AD controllers
2024-08-06 16:08:25 -07:00
0626b22c70
OIDC Upstream Watcher now reports condition OIDCDiscoverySucceeded with status Unknown if TLS validation fails
2024-08-06 16:08:25 -07:00
229b6a262e
when dialing github to test connection, dial api.github.com
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-08-06 08:58:30 -07:00
b70db9dc03
refactor to use new certificateAuthorityDataSourceKind enum
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:21 -07:00
e0235ed190
update docs and change struct name in types_tls.go.tmpl files
...
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:21 -07:00
02e41baa47
small refactors
2024-08-05 11:32:21 -07:00
ed502949dd
webhookcachefiller and jwtcachefiller always update status when needed
...
Even when the authenticator is found in the cache, try to update its
status. Failing to do so would mean that the actual status will not
be overwritten by the controller's newly computed desired status.
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
d6d66faae3
jwtcachefiller now tests for exact log lines and prints when it chooses to not update the status
2024-08-05 11:32:20 -07:00
15c84fcc94
extract helper func in jwtcachefiller and webhookcachefiller
2024-08-05 11:32:20 -07:00
1438f06c12
webhookcachefiller adds more detail when it chooses to update or not update status conditions
2024-08-05 11:32:20 -07:00
ca5bb2170c
webhookcontroller should use a logger that is built for each webhook authenticator
2024-08-05 11:32:20 -07:00
05a2fd97f8
webhookcontroller now only logs the webhook authenticator name instead of an object
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
dedd51df91
Test Refactor: webhookauthenticator_test checks exact log line equality
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Joshua Casey
Ryan Richard
Joshua Casey
Ashish Amarnath