github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-06 18:54:06 +00:00
Code Issues Projects Releases Wiki Activity

dynamic certs: do not copy mutex via shallow copy of tls.Config

Browse Source 
go vet error:

call of dynamiccertificates.NewDynamicServingCertificateController
copies lock value: crypto/tls.Config contains sync.Once contains
sync.Mutex

Signed-off-by: Monis Khan <mok@vmware.com>
This commit is contained in:
Monis Khan 2020-03-03 14:58:43 -05:00
parent d682c83890
commit 86a5993007
No known key found for this signature in database
GPG Key ID: 52C90ADA01B269B8
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
staging/src/k8s.io/apiserver/pkg/server/dynamiccertificates/server_test.go
View File

@ -79,7 +79,7 @@ func TestServingCert(t *testing.T) {
} }
dynamicCertificateController := NewDynamicServingCertificateController( dynamicCertificateController := NewDynamicServingCertificateController(
*tlsConfig, tlsConfig,
&nullCAContent{name: "client-ca"}, &nullCAContent{name: "client-ca"},
defaultCertProvider, defaultCertProvider,
sniCerts, sniCerts,

4
staging/src/k8s.io/apiserver/pkg/server/dynamiccertificates/tlsconfig.go
View File

@ -41,7 +41,7 @@ const workItemKey = "key"
type DynamicServingCertificateController struct { type DynamicServingCertificateController struct {
// baseTLSConfig is the static portion of the tlsConfig for serving to clients. It is copied and the copy is mutated // baseTLSConfig is the static portion of the tlsConfig for serving to clients. It is copied and the copy is mutated
// based on the dynamic cert state. // based on the dynamic cert state.
baseTLSConfig tls.Config baseTLSConfig *tls.Config
// clientCA provides the very latest content of the ca bundle // clientCA provides the very latest content of the ca bundle
clientCA CAContentProvider clientCA CAContentProvider
@ -65,7 +65,7 @@ var _ Listener = &DynamicServingCertificateController{}
// NewDynamicServingCertificateController returns a controller that can be used to keep a TLSConfig up to date. // NewDynamicServingCertificateController returns a controller that can be used to keep a TLSConfig up to date.
func NewDynamicServingCertificateController( func NewDynamicServingCertificateController(
baseTLSConfig tls.Config, baseTLSConfig *tls.Config,
clientCA CAContentProvider, clientCA CAContentProvider,
servingCert CertKeyContentProvider, servingCert CertKeyContentProvider,
sniCerts []SNICertKeyContentProvider, sniCerts []SNICertKeyContentProvider,

2
staging/src/k8s.io/apiserver/pkg/server/secure_serving.go
View File

@ -66,7 +66,7 @@ func (s *SecureServingInfo) tlsConfig(stopCh <-chan struct{}) (*tls.Config, erro
if s.ClientCA != nil || s.Cert != nil || len(s.SNICerts) > 0 { if s.ClientCA != nil || s.Cert != nil || len(s.SNICerts) > 0 {
dynamicCertificateController := dynamiccertificates.NewDynamicServingCertificateController( dynamicCertificateController := dynamiccertificates.NewDynamicServingCertificateController(
*tlsConfig, tlsConfig,
s.ClientCA, s.ClientCA,
s.Cert, s.Cert,
s.SNICerts, s.SNICerts,