github/client-go
1
0
Fork 0
mirror of https://github.com/kubernetes/client-go.git synced 2025-09-20 18:48:02 +00:00
Code Issues Projects Releases Wiki Activity

certificate_manager: Check that template differs from current cert before rotation

Browse Source 
With the current behavior, when kubelet starts, a `templateChanged`
event is always fired off because it only checks if `getLastRequest`
matches `getTemplate`. The last request only exists in memory and thus
is initially `nil` and can't ever match the current template during
startup.

This causes kubelet to request the signing of a new CSR every time it's
restarted. This commit changes the behavior so that `templateChanged` is
only fired off if the currently template doesn't match both the current
certificate and the last template.

Fixes #69471

Signed-off-by: Andrew Gunnerson <andrew.gunnerson@us.ibm.com>

Kubernetes-commit: b9ab65d689cc48353ca5dae9f210ff408726a0d2
This commit is contained in:
Andrew Gunnerson
2018-10-08 12:08:32 -04:00
committed by Kubernetes Publisher
parent e7898cb3b5
commit b9b3f6d2e7
2 changed files with 215 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

165
util/certificate/certificate_manager_test.go
View File

@@ -22,6 +22,7 @@ import (
"crypto/x509"
"crypto/x509/pkix"
"fmt"
"net"
"strings"
"testing"
"time"
@@ -212,6 +213,170 @@ func TestSetRotationDeadline(t *testing.T) {
}
}
func TestCertSatisfiesTemplate(t *testing.T) {
testCases := []struct {
name string
cert *x509.Certificate
template *x509.CertificateRequest
shouldSatisfy bool
}{
{
name: "No certificate, no template",
cert: nil,
template: nil,
shouldSatisfy: false,
},
{
name: "No certificate",
cert: nil,
template: &x509.CertificateRequest{},
shouldSatisfy: false,
},
{
name: "No template",
cert: &x509.Certificate{
Subject: pkix.Name{
CommonName: "system:node:fake-node-name",
},
},
template: nil,
shouldSatisfy: true,
},
{
name: "Mismatched common name",
cert: &x509.Certificate{
Subject: pkix.Name{
CommonName: "system:node:fake-node-name-2",
},
},
template: &x509.CertificateRequest{
Subject: pkix.Name{
CommonName: "system:node:fake-node-name",
},
},
shouldSatisfy: false,
},
{
name: "Missing orgs in certificate",
cert: &x509.Certificate{
Subject: pkix.Name{
Organization: []string{"system:nodes"},
},
},
template: &x509.CertificateRequest{
Subject: pkix.Name{
Organization: []string{"system:nodes", "foobar"},
},
},
shouldSatisfy: false,
},
{
name: "Extra orgs in certificate",
cert: &x509.Certificate{
Subject: pkix.Name{
Organization: []string{"system:nodes", "foobar"},
},
},
template: &x509.CertificateRequest{
Subject: pkix.Name{
Organization: []string{"system:nodes"},
},
},
shouldSatisfy: true,
},
{
name: "Missing DNS names in certificate",
cert: &x509.Certificate{
Subject: pkix.Name{},
DNSNames: []string{"foo.example.com"},
},
template: &x509.CertificateRequest{
Subject: pkix.Name{},
DNSNames: []string{"foo.example.com", "bar.example.com"},
},
shouldSatisfy: false,
},
{
name: "Extra DNS names in certificate",
cert: &x509.Certificate{
Subject: pkix.Name{},
DNSNames: []string{"foo.example.com", "bar.example.com"},
},
template: &x509.CertificateRequest{
Subject: pkix.Name{},
DNSNames: []string{"foo.example.com"},
},
shouldSatisfy: true,
},
{
name: "Missing IP addresses in certificate",
cert: &x509.Certificate{
Subject: pkix.Name{},
IPAddresses: []net.IP{net.ParseIP("192.168.1.1")},
},
template: &x509.CertificateRequest{
Subject: pkix.Name{},
IPAddresses: []net.IP{net.ParseIP("192.168.1.1"), net.ParseIP("192.168.1.2")},
},
shouldSatisfy: false,
},
{
name: "Extra IP addresses in certificate",
cert: &x509.Certificate{
Subject: pkix.Name{},
IPAddresses: []net.IP{net.ParseIP("192.168.1.1"), net.ParseIP("192.168.1.2")},
},
template: &x509.CertificateRequest{
Subject: pkix.Name{},
IPAddresses: []net.IP{net.ParseIP("192.168.1.1")},
},
shouldSatisfy: true,
},
{
name: "Matching certificate",
cert: &x509.Certificate{
Subject: pkix.Name{
CommonName: "system:node:fake-node-name",
Organization: []string{"system:nodes"},
},
DNSNames: []string{"foo.example.com"},
IPAddresses: []net.IP{net.ParseIP("192.168.1.1")},
},
template: &x509.CertificateRequest{
Subject: pkix.Name{
CommonName: "system:node:fake-node-name",
Organization: []string{"system:nodes"},
},
DNSNames: []string{"foo.example.com"},
IPAddresses: []net.IP{net.ParseIP("192.168.1.1")},
},
shouldSatisfy: true,
},
}
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
var tlsCert *tls.Certificate
if tc.cert != nil {
tlsCert = &tls.Certificate{
Leaf: tc.cert,
}
}
m := manager{
cert: tlsCert,
getTemplate: func() *x509.CertificateRequest { return tc.template },
}
result := m.certSatisfiesTemplate()
if result != tc.shouldSatisfy {
t.Errorf("cert: %+v, template: %+v, certSatisfiesTemplate returned %v, want %v", m.cert, tc.template, result, tc.shouldSatisfy)
}
})
}
}
func TestRotateCertCreateCSRError(t *testing.T) {
now := time.Now()
m := manager{