fix: Vulnerabilities in Istio Gateway Secret Rotation #2075
Conversation
kyma-bot
added
cla: yes
| go setupIstioGatewaySecretRotation(config, kcpClient, setupLog) | ||
| go gatewaysecret.NewGatewaySecretHandler(kcpClient). | ||
| StartRootCertificateWatch(kubernetes.NewForConfigOrDie(config), setupLog) |
There was a problem hiding this comment.
to reviewer: Checkmarx was complaining about potential race conditions on config and kcpClient. With this change, we keep using config and kcpClient in the current thread, and only then branch of to the go routine.
| panic(err) | ||
| return |
There was a problem hiding this comment.
to reviewer: Checkmarx was complaining that the panic is not properly handled. Since this is a go routine, I think the panic would anyway just abort the startup of the watch. Therefore we can also just return here since the error is logged and the go routine will "gracefully" stop.
There was a problem hiding this comment.
The startup of the watch is vital to the function of the istio gateway secret - the secret that allows TLS for SKR webhook communication. I believe that not being able to set up that secret is an extreme situation (highly unlikely though), and the runtime should stop the execution. If panic is not suitable in this case. I would suggest exiting with a bootstrap error code like so
c-pius
force-pushed
the
fix/vulnerability-reports-on-istio-gateway-secret-rotation
branch
from
c68398b
to
4d1faa6
Compare
Description
Changes proposed in this pull request:
Related issue(s)