From 660be1d2784c02065ce72be63c9f5ccc112d9089 Mon Sep 17 00:00:00 2001 From: Sankalp Yengaldas Date: Wed, 24 Apr 2024 02:31:09 -0400 Subject: [PATCH] add caBundleSecretRef field support to internal APIs Signed-off-by: Sankalp Yengaldas --- internal/apis/certmanager/types_issuer.go | 7 +++++++ .../apis/certmanager/v1alpha2/types_issuer.go | 8 ++++++++ .../apis/certmanager/v1alpha3/types_issuer.go | 8 ++++++++ .../apis/certmanager/v1beta1/types_issuer.go | 8 ++++++++ .../apis/certmanager/validation/issuer.go | 19 +++++++++++++++++++ .../certmanager/validation/issuer_test.go | 19 +++++++++++++++++++ 6 files changed, 69 insertions(+) diff --git a/internal/apis/certmanager/types_issuer.go b/internal/apis/certmanager/types_issuer.go index e9a91f8db..236d00112 100644 --- a/internal/apis/certmanager/types_issuer.go +++ b/internal/apis/certmanager/types_issuer.go @@ -142,6 +142,13 @@ type VenafiTPP struct { // If undefined, the certificate bundle in the cert-manager controller container // is used to validate the chain. CABundle []byte + + // Reference to a Secret containing a base64-encoded bundle of PEM CAs + // which will be used to validate the certificate chain presented by the TPP server. + // Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. + // If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in + // the cert-manager controller container is used to validate the TLS connection. + CABundleSecretRef *cmmeta.SecretKeySelector `json:"caBundleSecretRef,omitempty"` } // VenafiCloud defines connection configuration details for Venafi Cloud diff --git a/internal/apis/certmanager/v1alpha2/types_issuer.go b/internal/apis/certmanager/v1alpha2/types_issuer.go index c0db3ff02..29edefca3 100644 --- a/internal/apis/certmanager/v1alpha2/types_issuer.go +++ b/internal/apis/certmanager/v1alpha2/types_issuer.go @@ -156,6 +156,14 @@ type VenafiTPP struct { // is used to validate the chain. // +optional CABundle []byte `json:"caBundle,omitempty"` + + // Reference to a Secret containing a base64-encoded bundle of PEM CAs + // which will be used to validate the certificate chain presented by the TPP server. + // Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. + // If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in + // the cert-manager controller container is used to validate the TLS connection. + // +optional + CABundleSecretRef *cmmeta.SecretKeySelector `json:"caBundleSecretRef,omitempty"` } // VenafiCloud defines connection configuration details for Venafi Cloud diff --git a/internal/apis/certmanager/v1alpha3/types_issuer.go b/internal/apis/certmanager/v1alpha3/types_issuer.go index 73960254b..a69b8b656 100644 --- a/internal/apis/certmanager/v1alpha3/types_issuer.go +++ b/internal/apis/certmanager/v1alpha3/types_issuer.go @@ -156,6 +156,14 @@ type VenafiTPP struct { // is used to validate the chain. // +optional CABundle []byte `json:"caBundle,omitempty"` + + // Reference to a Secret containing a base64-encoded bundle of PEM CAs + // which will be used to validate the certificate chain presented by the TPP server. + // Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. + // If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in + // the cert-manager controller container is used to validate the TLS connection. + // +optional + CABundleSecretRef *cmmeta.SecretKeySelector `json:"caBundleSecretRef,omitempty"` } // VenafiCloud defines connection configuration details for Venafi Cloud diff --git a/internal/apis/certmanager/v1beta1/types_issuer.go b/internal/apis/certmanager/v1beta1/types_issuer.go index b4e1262e9..f0b18a648 100644 --- a/internal/apis/certmanager/v1beta1/types_issuer.go +++ b/internal/apis/certmanager/v1beta1/types_issuer.go @@ -158,6 +158,14 @@ type VenafiTPP struct { // is used to validate the chain. // +optional CABundle []byte `json:"caBundle,omitempty"` + + // Reference to a Secret containing a base64-encoded bundle of PEM CAs + // which will be used to validate the certificate chain presented by the TPP server. + // Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. + // If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in + // the cert-manager controller container is used to validate the TLS connection. + // +optional + CABundleSecretRef *cmmeta.SecretKeySelector `json:"caBundleSecretRef,omitempty"` } // VenafiCloud defines connection configuration details for Venafi Cloud diff --git a/internal/apis/certmanager/validation/issuer.go b/internal/apis/certmanager/validation/issuer.go index 8c8cdf336..bef5c1986 100644 --- a/internal/apis/certmanager/validation/issuer.go +++ b/internal/apis/certmanager/validation/issuer.go @@ -359,6 +359,25 @@ func ValidateVenafiTPP(tpp *certmanager.VenafiTPP, fldPath *field.Path) (el fiel // TODO: validate CABundle using validateCABundleNotEmpty + // Validate only one of CABundle/CABundleSecretRef is passed + el = append(el, validateVenafiTPPCABundleUnique(tpp, fldPath)...) + + return el +} + +func validateVenafiTPPCABundleUnique(tpp *certmanager.VenafiTPP, fldPath *field.Path) (el field.ErrorList) { + numCAs := 0 + if len(tpp.CABundle) > 0 { + numCAs++ + } + if tpp.CABundleSecretRef != nil { + numCAs++ + } + + if numCAs > 1 { + el = append(el, field.Forbidden(fldPath, "may not specify more than one of caBundle/caBundleSecretRef as TPP CA Bundle")) + } + return el } diff --git a/internal/apis/certmanager/validation/issuer_test.go b/internal/apis/certmanager/validation/issuer_test.go index 9fb182485..1e2a6408d 100644 --- a/internal/apis/certmanager/validation/issuer_test.go +++ b/internal/apis/certmanager/validation/issuer_test.go @@ -1642,6 +1642,10 @@ func TestValidateVenafiIssuerConfig(t *testing.T) { } func TestValidateVenafiTPP(t *testing.T) { + caBundle := unitcrypto.MustCreateCryptoBundle(t, + &pubcmapi.Certificate{Spec: pubcmapi.CertificateSpec{CommonName: "test"}}, + clock.RealClock{}, + ).CertBytes fldPath := field.NewPath("test") scenarios := map[string]struct { cfg *cmapi.VenafiTPP @@ -1658,6 +1662,21 @@ func TestValidateVenafiTPP(t *testing.T) { field.Required(fldPath.Child("url"), ""), }, }, + "venafi TPP issuer defines both caBundle and caBundleSecretRef": { + cfg: &cmapi.VenafiTPP{ + URL: "https://tpp.example.com/vedsdk", + CABundle: caBundle, + CABundleSecretRef: &cmmeta.SecretKeySelector{ + Key: "ca.crt", + LocalObjectReference: cmmeta.LocalObjectReference{ + Name: "test-secret", + }, + }, + }, + errs: []*field.Error{ + field.Forbidden(fldPath, "may not specify more than one of caBundle/caBundleSecretRef as TPP CA Bundle"), + }, + }, } for n, s := range scenarios {