github/client-go
1
0
Fork 0
mirror of https://github.com/kubernetes/client-go.git synced 2025-09-22 19:47:08 +00:00
Code Issues Projects Releases Wiki Activity

Extend client-go csr package to invalidate CSRs based on signerName

Browse Source 
Kubernetes-commit: c2367bd5da68112ad3031dd33933859dacf8db58
This commit is contained in:
James Munnelly
2020-03-03 13:14:04 +00:00
committed by Kubernetes Publisher
parent 133860aa50
commit 0c19a3c0da
2 changed files with 149 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
util/certificate/csr/csr.go
View File

@@ -150,6 +150,9 @@ func ensureCompatible(new, orig *certificates.CertificateSigningRequest, private
if !reflect.DeepEqual(newCSR.Subject, origCSR.Subject) {
return fmt.Errorf("csr subjects differ: new: %#v, orig: %#v", newCSR.Subject, origCSR.Subject)
}
if new.Spec.SignerName != nil && orig.Spec.SignerName != nil && *new.Spec.SignerName != *orig.Spec.SignerName {
return fmt.Errorf("csr signerNames differ: new %q, orig: %q", *new.Spec.SignerName, *orig.Spec.SignerName)
}
signer, ok := privateKey.(crypto.Signer)
if !ok {
return fmt.Errorf("privateKey is not a signer")