Allow to specify private key algorithm and size #168

MartinWeindel · 2024-03-19T16:22:50Z

What this PR does / why we need it:
The algorithm and size for the private key can now be specified in the certificate spec section to override the default algorithm RSA with key size 2048.
Supported algorithms are RSA and ECDSA. For RSA the allowed key sizes are 2048, 3072, and 4096 with 2048 as default is not specified explicitly. For ECDSA the allowed key sizes are 256 and 384 with 256 as default.
These algorithms and key sizes are supported by Let's encrypt. For other ACME servers please check their documentation for information about supported combinations.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

The algorithm and size for the private key can now be specified in the certificate spec section to override the default algorithm `RSA` with key size 2048.
Supported algorithms are `RSA` and `ECDSA`. For `RSA` the allowed key sizes are `2048`, `3072`, and `4096` with `2048` as default is not specified explicitly. For `ECDSA` the allowed key sizes are `256` and `384` with `256` as default.
These algorithms and key sizes are supported by Let's Encrypt. For other ACME servers please check their documentation for information about supported combinations.

MartinWeindel · 2024-03-19T16:23:19Z

/invite @timuthy

gardener-robot · 2024-03-19T16:29:01Z

@MartinWeindel Command "/invite @timuthy " failed with "Reviews may only be requested from collaborators. One or more of the users or teams you specified is not a collaborator of the gardener/cert-management repository.".

Additional Information

Redacted in public. Check backend logs.

timuthy · 2024-03-20T08:08:25Z

/assign

timuthy

Nice feature 🙂

timuthy · 2024-03-21T10:34:37Z

README.md

@@ -352,6 +354,33 @@ spec:

 In this case the secret `my-secret` will contains the labels.

+### Specifying private key algorithm and size
+
+By default, the certificate uses `RSA` with a key size of 2048 bits for the private key


Suggested change

By default, the certificate uses `RSA` with a key size of 2048 bits for the private key

By default, the certificate uses `RSA` with a key size of 2048 bits for the private key.

timuthy · 2024-03-21T10:37:37Z

pkg/apis/cert/v1alpha1/types.go

+	// key size of 2048 will be used for `RSA` key algorithm and
+	// key size of 256 will be used for `ECDSA` key algorithm.
+	// +optional
+	Algorithm PrivateKeyAlgorithm `json:"algorithm,omitempty"`


Suggested change

Algorithm PrivateKeyAlgorithm `json:"algorithm,omitempty"`

Algorithm *PrivateKeyAlgorithm `json:"algorithm,omitempty"`

timuthy · 2024-03-21T10:38:12Z

pkg/apis/cert/v1alpha1/types.go

+	// and will default to `256` if not specified.
+	// No other values are allowed.
+	// +optional
+	Size int `json:"size,omitempty"`


Suggested change

Size int `json:"size,omitempty"`

Size *int32 `json:"size,omitempty"`

See https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#primitive-types.

timuthy · 2024-03-21T10:41:15Z

pkg/cert/legobridge/certificate.go

+	return keyType, nil
+}
+
+// FromKeyType converts key type back to


Doc string incomplete.

timuthy · 2024-03-21T10:41:31Z

pkg/cert/legobridge/certificate.go

 	}
 	return client.Certificate.Obtain(request)
 }

-func obtainForCSR(client *lego.Client, csr []byte, deactivateAuthz bool, preferredChain string) (*certificate.Resource, error) {
+// ToKeyType extracts the key type from the


Doc string incomplete.

timuthy · 2024-03-21T11:25:39Z

pkg/apis/cert/v1alpha1/types.go

+	// key size of 256 will be used for `ECDSA` key algorithm.
+	// +optional


Can we work with // +kubebuilder:validation:Enum=RSA;ECDSA here, maybe also for the size?

Interestingly, you can really define an enumeration for numbers.🤩

timuthy

One doubt left, the rest looks good to me ✅

timuthy · 2024-03-21T16:36:11Z

pkg/cert/source/reconciler.go

-			}
+		newPrivateKey := createPrivateKey(info.PrivateKeyAlgorithm, info.PrivateKeySize)
+		if !reflect.DeepEqual(spec.PrivateKey, newPrivateKey) {
+			spec.PrivateKey = newPrivateKey


Not sure if I understand the code correctly: Does this mean that the controller writes back the defaulted values to the certificate.spec.privateKey if it's not set before? If yes, won't this cause all existing certificates to be re-generated when this feature is rolled out because the spec checksum changes?

If the source object has no private key related annotations, the function createPrivateKey returns nil. Even if you would add these annotations with the default values, the generated certificate resource will be updated, but no new certificate would be requested, as the hash code is unchanged.

timuthy

/lgtm

MartinWeindel · 2024-03-22T08:09:47Z

@timuthy Thanks for taking the time for a review!

add privateKey section to certificate spec

4ebd7bd

MartinWeindel requested a review from a team as a code owner March 19, 2024 16:22

gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Mar 19, 2024

gardener-robot-ci-1 added needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Mar 19, 2024

gardener-robot added kind/api-change API change with impact on API users needs/second-opinion Needs second review by someone else needs/review Needs review size/xl Size of pull request is huge (see gardener-robot robot/bots/size.py) labels Mar 19, 2024

strekm mentioned this pull request Mar 20, 2024

Change private key size of the certificate of the default API Gateway to 4096 bits kyma-project/api-gateway#839

Open

6 tasks

gardener-robot assigned timuthy Mar 20, 2024

fix hash code for returned certificate

f33d969

gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Mar 21, 2024

gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Mar 21, 2024

timuthy suggested changes Mar 21, 2024

View reviewed changes

gardener-robot added the needs/changes Needs (more) changes label Mar 21, 2024

addressed feedback from review

edb7087

gardener-robot-ci-2 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Mar 21, 2024

fix doc strings

7023890

gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Mar 21, 2024

gardener-robot-ci-2 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Mar 21, 2024

timuthy reviewed Mar 21, 2024

View reviewed changes

timuthy approved these changes Mar 22, 2024

View reviewed changes

gardener-robot added reviewed/lgtm Has approval for merging and removed needs/changes Needs (more) changes needs/review Needs review labels Mar 22, 2024

gardener-robot removed the needs/second-opinion Needs second review by someone else label Mar 22, 2024

gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Mar 22, 2024

MartinWeindel merged commit 56e575a into master Mar 22, 2024
7 checks passed

MartinWeindel deleted the private-key-spec branch March 22, 2024 08:10

gardener-robot added the status/closed Issue is closed (either delivered or triaged) label Mar 22, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow to specify private key algorithm and size #168

Allow to specify private key algorithm and size #168

MartinWeindel commented Mar 19, 2024

MartinWeindel commented Mar 19, 2024

gardener-robot commented Mar 19, 2024

timuthy commented Mar 20, 2024

timuthy left a comment

timuthy Mar 21, 2024

timuthy Mar 21, 2024

timuthy Mar 21, 2024

timuthy Mar 21, 2024

timuthy Mar 21, 2024

timuthy Mar 21, 2024

MartinWeindel Mar 21, 2024

timuthy left a comment

timuthy Mar 21, 2024

MartinWeindel Mar 22, 2024

timuthy left a comment

MartinWeindel commented Mar 22, 2024

	By default, the certificate uses `RSA` with a key size of 2048 bits for the private key
	By default, the certificate uses `RSA` with a key size of 2048 bits for the private key.

	Algorithm PrivateKeyAlgorithm `json:"algorithm,omitempty"`
	Algorithm *PrivateKeyAlgorithm `json:"algorithm,omitempty"`

	Size int `json:"size,omitempty"`
	Size *int32 `json:"size,omitempty"`

		// key size of 256 will be used for `ECDSA` key algorithm.
		// +optional

Allow to specify private key algorithm and size #168

Allow to specify private key algorithm and size #168

Conversation

MartinWeindel commented Mar 19, 2024

MartinWeindel commented Mar 19, 2024

gardener-robot commented Mar 19, 2024

timuthy commented Mar 20, 2024

timuthy left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

timuthy left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

timuthy left a comment

Choose a reason for hiding this comment

MartinWeindel commented Mar 22, 2024