github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-11 04:52:08 +00:00
Code Issues Projects Releases Wiki Activity

kmsv2: fixed issue with an invalid authority header being sent by the KMSv2 service

Browse Source
This commit is contained in:
Marcus Ruddick 2024-08-26 14:43:02 -10:00 committed by grant
parent 9682c62148
commit 618ca85bc9
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2/grpc_service.go
View File

@ -58,6 +58,7 @@ func NewGRPCService(ctx context.Context, endpoint, providerName string, callTime
s := &gRPCService{callTimeout: callTimeout} s := &gRPCService{callTimeout: callTimeout}
s.connection, err = grpc.Dial( s.connection, err = grpc.Dial(
addr, addr,
grpc.WithAuthority("localhost"),
grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithTransportCredentials(insecure.NewCredentials()),
grpc.WithDefaultCallOptions(grpc.WaitForReady(true)), grpc.WithDefaultCallOptions(grpc.WaitForReady(true)),
grpc.WithContextDialer( grpc.WithContextDialer(

12
staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/testing/v2/kms_plugin_mock.go
View File

@ -31,6 +31,7 @@ import (
"google.golang.org/grpc" "google.golang.org/grpc"
"google.golang.org/grpc/codes" "google.golang.org/grpc/codes"
"google.golang.org/grpc/metadata"
"google.golang.org/grpc/status" "google.golang.org/grpc/status"
"k8s.io/apimachinery/pkg/util/wait" "k8s.io/apimachinery/pkg/util/wait"
@ -61,7 +62,16 @@ type Base64Plugin struct {
// NewBase64Plugin is a constructor for Base64Plugin. // NewBase64Plugin is a constructor for Base64Plugin.
func NewBase64Plugin(t testing.TB, socketPath string) *Base64Plugin { func NewBase64Plugin(t testing.TB, socketPath string) *Base64Plugin {
server := grpc.NewServer() server := grpc.NewServer(
grpc.UnaryInterceptor(
func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
if val := metadata.ValueFromIncomingContext(ctx, ":authority"); len(val) != 1 || val[0] != "localhost" {
t.Errorf("wanted localhost authority, got: %v", val)
}
return handler(ctx, req)
},
),
)
result := &Base64Plugin{ result := &Base64Plugin{
grpcServer: server, grpcServer: server,
mu: &sync.Mutex{}, mu: &sync.Mutex{},