-
Notifications
You must be signed in to change notification settings - Fork 28
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
upgrade to latest dependencies (#442)
bumping knative.dev/networking 0b998c1...e5d04e8:%0A > e5d04e8 upgrade to latest dependencies (# 796)%0A > 62fd5d0 Update actions (# 793)%0A > b77b4a6 Bump Go version in github action (# 795)%0A > 750a9e4 Update community files (# 792)%0A > 62b7e26 Update actions (# 789)%0A > 366f276 upgrade to latest dependencies (# 788)%0A > fb58275 Update community files (# 790)%0Abumping knative.dev/eventing d35f808...034bec9:%0A > 034bec9 [main] Upgrade to latest dependencies (# 6888)%0A > 4c2a3aa Bump Go to 1.20 in GH workflows (# 6882)%0A > 825a2b5 Create Cert-Manager resources (# 6849)%0A > 193f2df Eventing TLS: support `K_CA_CERTS` in adapter/v2 (# 6848)%0A > cc3d254 [main] Upgrade to latest dependencies (# 6863)%0A > 81f8e67 Fix ChannelChain test lifecyle (# 6862)%0A > d7fe38f [main] Upgrade to latest dependencies (# 6860)%0A > a5b4810 [main] Update actions (# 6858)%0A > 43a2554 [main] Upgrade to latest dependencies (# 6855)%0A > cf7ee9c [main] Update actions (# 6853)%0A > d2eaff5 [main] Update community files (# 6856)%0A > c59bd1f Eventing TLS: Install Cert Manager as part of the test setup phase (# 6850)%0Abumping knative.dev/serving 96b84bd...2c1bb07:%0A > 2c1bb07 Update net-kourier nightly (# 13919)%0A > 0637cdf Update net-contour nightly (# 13918)%0A > 08bedbe Update net-gateway-api nightly (# 13917)%0A > e39c429 Update net-istio nightly (# 13916)%0A > 10ed0f8 Update net-certmanager nightly (# 13915)%0A > 84fa64c Update data-plane Secrets (# 13859)%0A > 22783d6 Deployment probe fixes (# 13885)%0A > 113616b add support for downwardAPI in projected volumes (# 13896)%0A > 55f8dd7 upgrade to latest dependencies (# 13912)%0A > b2a416f Update net-gateway-api nightly (# 13907)%0A > 91ac3b3 Update net-certmanager nightly (# 13904)%0A > 787ac48 Update net-istio nightly (# 13902)%0A > d315f71 Update net-contour nightly (# 13903)%0A > b38ef3a Update net-istio nightly (# 13899)%0A > b9b9d13 Update net-contour nightly (# 13900)%0A > 9530fe9 Update net-certmanager nightly (# 13897)%0A > 12bd205 Update net-kourier nightly (# 13898)%0A > 4db179f upgrade to latest dependencies (# 13895)%0A > 0c8f091 Update net-gateway-api nightly (# 13894)%0A > f83732d Update net-kourier nightly (# 13893)%0A > 87af840 upgrade to latest dependencies (# 13891)%0A > 171cecd change mininum TLS version for tag to digest resolution (# 13886)%0A > ef58d9b Update net-contour nightly (# 13881)%0A > 842c516 Update net-istio nightly (# 13883)%0A > cb946ff Update net-certmanager nightly (# 13882)%0A > d0eea80 Update net-gateway-api nightly (# 13880)%0A > c377269 Update actions (# 13879)%0A > 018c7f8 Update net-kourier nightly (# 13871)%0A > 235e7f1 Update net-contour nightly (# 13870)%0A > 29089ce Update net-gateway-api nightly (# 13873)%0A > f87c4d7 Update net-istio nightly (# 13872)%0A > a96e2c5 upgrade to latest dependencies (# 13875)%0A > e363b61 Update net-certmanager nightly (# 13874)%0A > 9af99e5 Load certificate when they are updated when internal-encryption is enabled (# 13854)%0A > 3efe96d Update community files (# 13868)%0A > 944e8e0 Update net-kourier nightly (# 13864)%0A > 4d85bc0 Update net-contour nightly (# 13865)%0Abumping knative.dev/hack 9153cc6...f591fea:%0A > f591fea individual globbing is required (# 284)%0A > 4b3f230 Update community files (# 283)%0Abumping knative.dev/pkg ef19121...dfad48e:%0A > dfad48e upgrade to latest dependencies (# 2728)%0A > 53f04b3 Make minimum TLS version configurable for webhooks (# 2721)%0A > ce10b06 Update actions (# 2726)%0A > d3d7625 Update community files (# 2724)%0A > 166893c upgrade to latest dependencies (# 2719) Signed-off-by: Knative Automation <[email protected]>
- Loading branch information
1 parent
30d81ad
commit 562735c
Showing
14 changed files
with
366 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
197 changes: 197 additions & 0 deletions
197
vendor/knative.dev/eventing/pkg/eventingtls/eventingtls.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,197 @@ | ||
| /* | ||
| Copyright 2023 The Knative Authors | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package eventingtls | ||
|
|
||
| import ( | ||
| "context" | ||
| "crypto/tls" | ||
| "crypto/x509" | ||
| "fmt" | ||
| "strings" | ||
| "sync/atomic" | ||
|
|
||
| "go.uber.org/zap" | ||
| corev1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/types" | ||
| coreinformersv1 "k8s.io/client-go/informers/core/v1" | ||
| "k8s.io/client-go/kubernetes" | ||
| "k8s.io/client-go/tools/cache" | ||
| "knative.dev/pkg/apis" | ||
| "knative.dev/pkg/controller" | ||
| "knative.dev/pkg/logging" | ||
| ) | ||
|
|
||
| const ( | ||
| // TLSKey is the key in the TLS secret for the private key of TLS servers | ||
| TLSKey = "tls.key" | ||
| // TLSCrt is the key in the TLS secret for the public key of TLS servers | ||
| TLSCrt = "tls.crt" | ||
| // DefaultMinTLSVersion is the default minimum TLS version for servers and clients. | ||
| DefaultMinTLSVersion = tls.VersionTLS12 | ||
| ) | ||
|
|
||
| type ClientConfig struct { | ||
| // CACerts are Certification Authority (CA) certificates in PEM format | ||
| // according to https://www.rfc-editor.org/rfc/rfc7468. | ||
| CACerts *string | ||
| } | ||
|
|
||
| type ServerConfig struct { | ||
| // GetCertificate returns a Certificate based on the given | ||
| // ClientHelloInfo. It will only be called if the client supplies SNI | ||
| // information or if Certificates is empty. | ||
| // | ||
| // If GetCertificate is nil or returns nil, then the certificate is | ||
| // retrieved from NameToCertificate. If NameToCertificate is nil, the | ||
| // best element of Certificates will be used. | ||
| GetCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error) | ||
| } | ||
|
|
||
| // GetCertificate returns a Certificate based on the given | ||
| // ClientHelloInfo. It will only be called if the client supplies SNI | ||
| // information or if Certificates is empty. | ||
| // | ||
| // If GetCertificate is nil or returns nil, then the certificate is | ||
| // retrieved from NameToCertificate. If NameToCertificate is nil, the | ||
| // best element of Certificates will be used. | ||
| type GetCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error) | ||
|
|
||
| // GetCertificateFromSecret returns a GetCertificate function that will automatically return | ||
| // the latest certificate that is present in the provided secret. | ||
| // | ||
| // The secret is expected to have at least 2 keys in data: see TLSKey and TLSCrt constants for | ||
| // knowing the key names. | ||
| func GetCertificateFromSecret(ctx context.Context, informer coreinformersv1.SecretInformer, kube kubernetes.Interface, secret types.NamespacedName) GetCertificate { | ||
|
|
||
| certHolder := atomic.Value{} | ||
|
|
||
| logger := logging.FromContext(ctx).Desugar(). | ||
| With(zap.String("tls.secret", secret.String())) | ||
|
|
||
| store := func(obj interface{}) { | ||
| s, ok := obj.(*corev1.Secret) | ||
| if !ok { | ||
| return | ||
| } | ||
| crt, crtOk := s.Data[TLSCrt] | ||
| key, keyOk := s.Data[TLSKey] | ||
| if !crtOk || !keyOk { | ||
| logger.Debug("Missing " + TLSCrt + " or " + TLSKey + " in the secret.data") | ||
| return | ||
| } | ||
|
|
||
| logger.Debug("Loading key pair") | ||
|
|
||
| certificate, err := tls.X509KeyPair(crt, key) | ||
| if err != nil { | ||
| logger.Error("Failed to create x.509 key pair", zap.Error(err)) | ||
| return | ||
| } | ||
|
|
||
| logger.Debug("certificate stored") | ||
| certHolder.Store(&certificate) | ||
| } | ||
|
|
||
| informer.Informer().AddEventHandler(cache.FilteringResourceEventHandler{ | ||
| FilterFunc: controller.FilterWithNameAndNamespace(secret.Namespace, secret.Name), | ||
| Handler: cache.ResourceEventHandlerFuncs{ | ||
| AddFunc: store, | ||
| UpdateFunc: func(_, newObj interface{}) { | ||
| store(newObj) | ||
| }, | ||
| DeleteFunc: nil, | ||
| }, | ||
| }) | ||
|
|
||
| // Store the current value so that we have certHolder initialized. | ||
| firstValue, err := informer.Lister().Secrets(secret.Namespace).Get(secret.Name) | ||
| if err != nil { | ||
| // Try to get the secret from the API Server when the lister failed. | ||
| firstValue, err = kube.CoreV1().Secrets(secret.Namespace).Get(ctx, secret.Name, metav1.GetOptions{}) | ||
| if err != nil { | ||
| logger.Fatal(err.Error()) | ||
| } | ||
| } | ||
| store(firstValue) | ||
|
|
||
| return func(info *tls.ClientHelloInfo) (*tls.Certificate, error) { | ||
| cert := certHolder.Load() | ||
| if cert == nil { | ||
| return nil, nil | ||
| } | ||
| return cert.(*tls.Certificate), nil | ||
| } | ||
| } | ||
|
|
||
| // NewDefaultClientConfig returns a default ClientConfig. | ||
| func NewDefaultClientConfig() ClientConfig { | ||
| return ClientConfig{} | ||
| } | ||
|
|
||
| // GetTLSClientConfig returns tls.Config based on the given ClientConfig. | ||
| func GetTLSClientConfig(config ClientConfig) (*tls.Config, error) { | ||
| pool, err := certPool(config.CACerts) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return &tls.Config{ | ||
| RootCAs: pool, | ||
| MinVersion: DefaultMinTLSVersion, | ||
| }, nil | ||
| } | ||
|
|
||
| func NewDefaultServerConfig() ServerConfig { | ||
| return ServerConfig{} | ||
| } | ||
|
|
||
| func GetTLSServerConfig(config ServerConfig) (*tls.Config, error) { | ||
| return &tls.Config{ | ||
| MinVersion: DefaultMinTLSVersion, | ||
| GetCertificate: config.GetCertificate, | ||
| }, nil | ||
| } | ||
|
|
||
| // IsHttpsSink returns true if the sink has scheme equal to https. | ||
| func IsHttpsSink(sink string) bool { | ||
| s, err := apis.ParseURL(sink) | ||
| if err != nil { | ||
| return false | ||
| } | ||
| return strings.EqualFold(s.Scheme, "https") | ||
| } | ||
|
|
||
| // certPool returns a x509.CertPool with the combined certs from: | ||
| // - the system cert pool | ||
| // - the given CA certificates | ||
| func certPool(caCerts *string) (*x509.CertPool, error) { | ||
| p, err := x509.SystemCertPool() | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| if caCerts == nil || *caCerts == "" { | ||
| return p, nil | ||
| } | ||
|
|
||
| if ok := p.AppendCertsFromPEM([]byte(*caCerts)); !ok { | ||
| return p, fmt.Errorf("failed to append CA certs from PEM") | ||
| } | ||
|
|
||
| return p, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.