github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-20 18:31:15 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #113581 from aimuz/verify-tls-secret

Browse Source 
Verify that the key matches the cert
This commit is contained in:
Kubernetes Prow Robot 2023-01-04 14:29:58 -08:00 committed by GitHub
commit ac889a0251
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/apis/core/validation/validation.go
View File

@ -5814,7 +5814,6 @@ func ValidateSecret(secret *core.Secret) field.ErrorList {
if _, exists := secret.Data[core.TLSPrivateKeyKey]; !exists { if _, exists := secret.Data[core.TLSPrivateKeyKey]; !exists {
allErrs = append(allErrs, field.Required(dataPath.Key(core.TLSPrivateKeyKey), "")) allErrs = append(allErrs, field.Required(dataPath.Key(core.TLSPrivateKeyKey), ""))
} }
// TODO: Verify that the key matches the cert.
default: default:
// no-op // no-op
} }

19
pkg/registry/core/secret/strategy.go
View File

@ -18,6 +18,7 @@ package secret
import ( import (
"context" "context"
"crypto/tls"
"fmt" "fmt"
"k8s.io/apimachinery/pkg/fields" "k8s.io/apimachinery/pkg/fields"
@ -61,7 +62,9 @@ func (strategy) Validate(ctx context.Context, obj runtime.Object) field.ErrorLis
} }
// WarningsOnCreate returns warnings for the creation of the given object. // WarningsOnCreate returns warnings for the creation of the given object.
func (strategy) WarningsOnCreate(ctx context.Context, obj runtime.Object) []string { return nil } func (strategy) WarningsOnCreate(ctx context.Context, obj runtime.Object) []string {
return warningsForSecret(obj.(*api.Secret))
}
func (strategy) Canonicalize(obj runtime.Object) { func (strategy) Canonicalize(obj runtime.Object) {
} }
@ -88,7 +91,7 @@ func (strategy) ValidateUpdate(ctx context.Context, obj, old runtime.Object) fie
// WarningsOnUpdate returns warnings for the given update. // WarningsOnUpdate returns warnings for the given update.
func (strategy) WarningsOnUpdate(ctx context.Context, obj, old runtime.Object) []string { func (strategy) WarningsOnUpdate(ctx context.Context, obj, old runtime.Object) []string {
return nil return warningsForSecret(obj.(*api.Secret))
} }
func dropDisabledFields(secret *api.Secret, oldSecret *api.Secret) { func dropDisabledFields(secret *api.Secret, oldSecret *api.Secret) {
@ -130,3 +133,15 @@ func SelectableFields(obj *api.Secret) fields.Set {
} }
return generic.MergeFieldsSets(objectMetaFieldsSet, secretSpecificFieldsSet) return generic.MergeFieldsSets(objectMetaFieldsSet, secretSpecificFieldsSet)
} }
func warningsForSecret(secret *api.Secret) []string {
var warnings []string
if secret.Type == api.SecretTypeTLS {
// Verify that the key matches the cert.
_, err := tls.X509KeyPair(secret.Data[api.TLSCertKey], secret.Data[api.TLSPrivateKeyKey])
if err != nil {
warnings = append(warnings, err.Error())
}
}
return warnings
}