ClusterTrustBundle: Enforce max size during validation

pkg/apis/certificates/types.go

@@ -277,3 +277,6 @@ type ClusterTrustBundleList struct {
 	// Items is a collection of ClusterTrustBundle objects
 	Items []ClusterTrustBundle
 }
+
+// MaxTrustBundleSize is the maximimum size of a single trust bundle field.
+const MaxTrustBundleSize = 1 * 1024 * 1024

pkg/apis/certificates/validation/validation.go

@@ -508,6 +508,11 @@ func ValidateClusterTrustBundleUpdate(newBundle, oldBundle *certificates.Cluster
 func validateTrustBundle(path *field.Path, in string) field.ErrorList {
 	var allErrors field.ErrorList
 
+	if len(in) > certificates.MaxTrustBundleSize {
+		allErrors = append(allErrors, field.TooLong(path, fmt.Sprintf("<value omitted, len %d>", len(in)), certificates.MaxTrustBundleSize))
+		return allErrors
+	}
+
 	blockDedupe := map[string][]int{}
 
 	rest := []byte(in)

pkg/apis/certificates/validation/validation_test.go

@@ -1104,12 +1104,18 @@ func TestValidateClusterTrustBundle(t *testing.T) {
 	badBlockTypeBlock := string(mustMakePEMBlock("NOTACERTIFICATE", nil, goodCert1))
 	badNonParseableBlock := string(mustMakePEMBlock("CERTIFICATE", nil, []byte("this is not a certificate")))
 
+	badTooBigBundle := ""
+	for i := 0; i < (core.MaxSecretSize/len(goodCert1Block))+1; i++ {
+		badTooBigBundle += goodCert1Block + "\n"
+	}
+
 	testCases := []struct {
 		description string
 		bundle      *capi.ClusterTrustBundle
 		opts        ValidateClusterTrustBundleOptions
 		wantErrors  field.ErrorList
-	}{{
+	}{
+		{
 			description: "valid, no signer name",
 			bundle: &capi.ClusterTrustBundle{
 				ObjectMeta: metav1.ObjectMeta{
@@ -1119,7 +1125,22 @@ func TestValidateClusterTrustBundle(t *testing.T) {
 					TrustBundle: goodCert1Block,
 				},
 			},
-	}, {
+		},
+		{
+			description: "invalid, too big",
+			bundle: &capi.ClusterTrustBundle{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "foo",
+				},
+				Spec: capi.ClusterTrustBundleSpec{
+					TrustBundle: badTooBigBundle,
+				},
+			},
+			wantErrors: field.ErrorList{
+				field.TooLong(field.NewPath("spec", "trustBundle"), fmt.Sprintf("<value omitted, len %d>", len(badTooBigBundle)), core.MaxSecretSize),
+			},
+		},
+		{
 			description: "invalid, no signer name, invalid name",
 			bundle: &capi.ClusterTrustBundle{
 				ObjectMeta: metav1.ObjectMeta{