Commit Graph

153 Commits

Author SHA1 Message Date
James Munnelly
a4a40bdf2d Fix checking for invalid data in issuer secrets 2017-10-26 22:47:17 +01:00
jetstack-bot
bc44f708dd Merge pull request #166 from munnerz/fix-http01
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Error if existing presented key and expected key do not match

**What this PR does / why we need it**:

A type in the HTTP01 solver caused it to not return an error if the key presented by the ingress and the expected key do not match.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Fixes #163 

**Special notes for your reviewer**:

**Release note**:

```release-note
Fix bug in ACME HTTP01 solver causing self-check to return true before paths have propagated
```
2017-10-26 22:07:31 +01:00
James Munnelly
a05b67dc4b Error if existing presented key and expected key do not match 2017-10-26 21:53:02 +01:00
James Munnelly
dc22822394 Fix panic in ACME issuer setup 2017-10-26 21:21:48 +01:00
jetstack-bot
d5a5c63333 Merge pull request #156 from munnerz/require-5-http-passes
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Ensure ACME HTTP01 reachability test passes 5 times before issuing certificate

**What this PR does / why we need it**:

See #154 for details. Sometimes HTTP routes have not propagated yet when using a controller such as GCLB. This forces us to wait for 5 consecutive passes of the HTTP01 self-check before proceeding.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Closes #154 

**Special notes for your reviewer**:

* This adds an extra 10s delay onto *any* HTTP01 validation
* The '5 tries' number is hardcoded into the HTTP01 solver

**Release note**:

```release-note
Ensure 5 consecutive HTTP01 self-checks to pass before issuing ACME certificate
```
2017-10-26 14:18:48 +01:00
James Munnelly
16cde96fd8 Ensure ACME HTTP01 reachability test passes 5 times before issuing certificate 2017-10-26 12:10:35 +01:00
James Munnelly
8c9d235e8d Ensure Present and CleanUp run in serial 2017-10-26 10:46:17 +01:00
James Munnelly
14cf0d495f Consistent use of glog 2017-10-16 14:50:27 +01:00
James Munnelly
dc5929ce29 Fix Issuer sync_test.go 2017-10-16 13:38:53 +01:00
James Munnelly
59e2af767a Perform Issuer/ClusterIssuer status updates in controller 2017-10-16 12:59:46 +01:00
James Munnelly
1f278d659b Refactor e2e setup into scripts. Speed up e2e tests.
Build images whilst services are starting

Exit on setup boulder errors

Install nsenter

Don't build nsenter

Turn up e2e pod verbosity

Set pullPolicy IfNotPresent on HTTP challenge solver
2017-10-16 12:58:47 +01:00
James Munnelly
9f79eea7d1 Use pods instead of jobs for acme solver 2017-10-13 20:15:53 +01:00
James Munnelly
9d933d9e11 Only update certificate status in the controller package to stop conflicts 2017-10-13 20:15:29 +01:00
James Munnelly
29f44c2ed6 Fix domain authorization check 2017-10-13 18:28:40 +01:00
James Munnelly
a62afaa1e7 Merge pull request #120 from jetstack-experimental/fix-http-cleanup
Fix ACME HTTP Cleanup function
2017-10-13 18:09:33 +01:00
James Munnelly
213d895865 Fix ACME HTTP Cleanup function 2017-10-13 17:59:39 +01:00
James Munnelly
22ed25955d Merge pull request #119 from jetstack-experimental/auth-per-acc
Check authorizations account URI before attempting to reuse authorization
2017-10-13 17:10:17 +01:00
James Munnelly
8d50c4102a Merge pull request #118 from jetstack-experimental/rename-config
Rename http-01 -> http01, dns-01 -> dns01
2017-10-13 16:56:17 +01:00
James Munnelly
a9eb7ee8a7 Check authorizations account URI before attempting to reuse authorization 2017-10-13 16:56:05 +01:00
James Munnelly
7060fb5019 http-01 -> http01, dns-01 -> dns01 2017-10-13 16:45:04 +01:00
James Munnelly
01e5833825 Make acmesolver image configurable through CLI. Use tagged version as default. 2017-10-13 16:39:06 +01:00
James Munnelly
c7a83606ce Merge pull request #115 from jetstack-experimental/explicity-challenge-mech
Add HTTP01 field to issuer.spec. Default HTTP01 challenges to disabled.
2017-10-13 15:37:39 +01:00
James Munnelly
79c775e389 Add HTTP01 field to issuer.spec. Default HTTP01 challenges to disabled. 2017-10-13 14:54:26 +01:00
James Munnelly
939534d5b0 Merge pull request #112 from jetstack-experimental/update-issuer-secret-change
Trigger CA Issuer re-sync when signing keypair changes
2017-10-13 14:31:35 +01:00
James Munnelly
2600cb8e14 Fix up altName->dnsName change 2017-10-13 14:04:14 +01:00
James Munnelly
bd9c202cbb regenerate files 2017-10-13 13:37:56 +01:00
James Munnelly
d7009fbfa8 Correctly check if certificate is valid when only dnsNames are specified 2017-10-13 13:32:10 +01:00
James Munnelly
a3fc5d9eaa Rename altNames to dnsNames 2017-10-13 13:31:52 +01:00
James Munnelly
45a67dc748 Merge pull request #109 from jetstack-experimental/cn-altname
Use CommonName and AltNames fields on Certificate resource
2017-10-13 13:21:47 +01:00
James Munnelly
8c6457e7b7 Trigger CA Issuer re-sync when signing keypair changes 2017-10-13 13:20:03 +01:00
James Munnelly
a4b1d346c7 Fix invalid check for empty certificate domains 2017-10-13 13:05:21 +01:00
James Munnelly
e080d1da25 Add LICENSE files for files from github.com/xenolf/lego library 2017-10-13 12:57:31 +01:00
James Munnelly
489f073d3a Require altName or subject name are specified in CA issuer 2017-10-13 12:52:36 +01:00
James Munnelly
ae1173dcec Regenerate files 2017-10-13 12:50:07 +01:00
James Munnelly
187e91f9ae Default commonName to first altName if not specified 2017-10-13 12:50:07 +01:00
James Munnelly
f8107e6fcc Use CommonName and AltNames fields on Certificate resource 2017-10-13 12:50:07 +01:00
James Munnelly
185058815e Fix controller checks for new API schema 2017-10-13 12:09:04 +01:00
James Munnelly
2d0e81fc95 Regenerate files 2017-10-13 11:56:33 +01:00
James Munnelly
a2d9733f21 Update implementation for new field names/types 2017-10-13 11:43:52 +01:00
James Munnelly
6ae8fbbbb2 Standardise SecretKeySelector field naming 2017-10-13 11:23:20 +01:00
James Munnelly
7b30b80dc5 Update ClusterIssuer to use 'kind' field instead of 'namespace' 2017-10-12 20:06:29 +01:00
James Munnelly
cd4b482410 Check Secret namespace in ClusterIssuer checks. Add TODO. 2017-09-22 09:52:09 +01:00
James Munnelly
7fffd67c86 Fix issuer CA for ClusterIssuer resources 2017-09-22 09:39:03 +01:00
James Munnelly
65366e986c Add ClusterIssuer e2e tests. Fix e2e tests. 2017-09-22 09:38:59 +01:00
James Munnelly
dc608f709d Support Certificates referencing ClusterIssuers 2017-09-22 01:46:05 +01:00
James Munnelly
852e250a69 Add clusterissuer controller 2017-09-22 00:10:42 +01:00
James Munnelly
7c425ee86f Switch issuer implementations to use GenericIssuer 2017-09-21 23:27:41 +01:00
James Munnelly
e7ebb10402 Add ClusterIssuer helpers. Add GenericIssuer interface. 2017-09-21 23:19:29 +01:00
James Munnelly
dd63a09fa9 regenerate files 2017-09-21 23:18:58 +01:00
James Munnelly
1c7a70134a Add ClusterIssuer types 2017-09-21 23:18:40 +01:00