-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: allowed ACM cert discovery to filter on CA ARNs (#3565) #3567
feat: allowed ACM cert discovery to filter on CA ARNs (#3565) #3567
Conversation
Welcome @the-technat! |
Hi @the-technat. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Any feedback / reviews on this? |
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mkilchhofer, the-technat The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
pkg/ingress/cert_discovery.go
Outdated
@@ -102,7 +106,10 @@ func (d *acmCertDiscovery) loadDomainsForAllCertificates(ctx context.Context) (m | |||
if err != nil { | |||
return nil, err | |||
} | |||
domainsByCertARN[certARN] = certDomains | |||
if len(certDomains.List()) > 0 { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
you can directly use len(certDomains)
which is more efficient than convert it into list.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
thx for the hint, I updated it
pkg/ingress/cert_discovery.go
Outdated
d.certDomainsCache.Set(certARN, domains, d.privateCertDomainsCacheTTL) | ||
|
||
// check if cert is issued from an allowed CA | ||
if len(d.allowedCAARNs) == 0 || slices.Contains(d.allowedCAARNs, *certDetail.CertificateAuthorityArn) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
will certDetail.CertificateAuthorityArn
guaranteed to be non-nil
? let's use awssdk.StringValue(certDetail.CertificateAuthorityArn)
to be safe(so even if it's nil, the logic still holds and won't panic)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
thx for the hint, I updated it
@M00nF1sh, @mkilchhofer somehow I accidentially closed this PR and mixed up git. Please refer to #3591 for the new and updated PR. |
Issue
Resolves #3565
Description
This PR adds a new flag that is passed to the ACMCertDiscovery type in order to filter auto-discovered certificates for a list of CA ARNs. This is usefull in situations where one needs to switch PCA while ensuring the aws-load-balancer-controller should explicitly pick the new CA to allow the old one to be removed (which is not possible when certificates are in use).
Checklist
README.md
, or thedocs
directory)BONUS POINTS checklist: complete for good vibes and maybe prizes?! 馃く