weiguoqiang/cert-manager
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Relax resource validation for CloudDNS service account credentials

Browse Source 
Signed-off-by: James Munnelly <james@munnelly.eu>
This commit is contained in:
James Munnelly 2018-09-12 08:39:50 +01:00
parent 3cdcf21701
commit 01ab38e5ff
2 changed files with 44 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pkg/apis/certmanager/validation/issuer.go
View File

@ -167,7 +167,11 @@ func ValidateACMEIssuerDNS01Config(iss *v1alpha1.ACMEIssuerDNS01Config, fldPath
el = append(el, field.Forbidden(fldPath.Child("clouddns"), "may not specify more than one provider type"))
} else {
numProviders++
el = append(el, ValidateSecretKeySelector(&p.CloudDNS.ServiceAccount, fldPath.Child("clouddns", "serviceAccountSecretRef"))...)
// if either of serviceAccount.name or serviceAccount.key is set, we
// validate the entire secret key selector
if p.CloudDNS.ServiceAccount.Name != "" || p.CloudDNS.ServiceAccount.Key != "" {
el = append(el, ValidateSecretKeySelector(&p.CloudDNS.ServiceAccount, fldPath.Child("clouddns", "serviceAccountSecretRef"))...)
}
if len(p.CloudDNS.Project) == 0 {
el = append(el, field.Required(fldPath.Child("clouddns", "project"), ""))
}

44
pkg/apis/certmanager/validation/issuer_test.go
View File

@ -278,7 +278,45 @@ func TestValidateACMEIssuerDNS01Config(t *testing.T) {
field.Required(providersPath.Index(0).Child("clouddns", "project"), ""),
},
},
"missing clouddns service account": {
"missing clouddns service account key": {
cfg: &v1alpha1.ACMEIssuerDNS01Config{
Providers: []v1alpha1.ACMEIssuerDNS01Provider{
{
Name: "a name",
CloudDNS: &v1alpha1.ACMEIssuerDNS01ProviderCloudDNS{
Project: "valid",
ServiceAccount: v1alpha1.SecretKeySelector{
LocalObjectReference: v1alpha1.LocalObjectReference{Name: "something"},
Key: "",
},
},
},
},
},
errs: []*field.Error{
field.Required(providersPath.Index(0).Child("clouddns", "serviceAccountSecretRef", "key"), "secret key is required"),
},
},
"missing clouddns service account name": {
cfg: &v1alpha1.ACMEIssuerDNS01Config{
Providers: []v1alpha1.ACMEIssuerDNS01Provider{
{
Name: "a name",
CloudDNS: &v1alpha1.ACMEIssuerDNS01ProviderCloudDNS{
Project: "valid",
ServiceAccount: v1alpha1.SecretKeySelector{
LocalObjectReference: v1alpha1.LocalObjectReference{Name: ""},
Key: "something",
},
},
},
},
},
errs: []*field.Error{
field.Required(providersPath.Index(0).Child("clouddns", "serviceAccountSecretRef", "name"), "secret name is required"),
},
},
"clouddns serviceAccount field not set should be allowed for ambient auth": {
cfg: &v1alpha1.ACMEIssuerDNS01Config{
Providers: []v1alpha1.ACMEIssuerDNS01Provider{
{
@ -289,10 +327,6 @@ func TestValidateACMEIssuerDNS01Config(t *testing.T) {
},
},
},
errs: []*field.Error{
field.Required(providersPath.Index(0).Child("clouddns", "serviceAccountSecretRef", "name"), "secret name is required"),
field.Required(providersPath.Index(0).Child("clouddns", "serviceAccountSecretRef", "key"), "secret key is required"),
},
},
"missing cloudflare token": {
cfg: &v1alpha1.ACMEIssuerDNS01Config{