kubeadm: add validation to verify that the CertificateKey is a valid hex encoded AES key

[SataQiu]

What type of PR is this?

/kind feature

What this PR does / why we need it:

kubeadm: add validation to verify that the CertificateKey is a valid hex encoded AES key

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

kubeadm: add validation to verify that the CertificateKey is a valid hex encoded AES key

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[k8s-ci-robot]

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[neolit123]

our util is flexible to allow various key sizes:

kubernetes/cmd/kubeadm/app/util/crypto/crypto.go

Line 38 in eae63c8

func EncryptBytes(data, key []byte) ([]byte, error) {

but we do hardcode the required (security wize, default) size to 32 bytes only.

kubernetes/cmd/kubeadm/app/phases/copycerts/copycerts.go

Line 81 in eae63c8

randBytes, err := cryptoutil.CreateRandBytes(kubeadmconstants.CertificateKeySize)

here in the validation we can do:

	if len(decodedKey) != kubeadmconstants.CertificateKeySize {
		allErrs = append(allErrs, field.Invalid(fldPath, certificateKey, fmt.Sprintf("invalid certificate key size %d, the key must be an AES key of size %d", k, kubeadmconstants.CertificateKeySize)))

one issue around DecryptBytes is that i don't see size validation impleneted already for it. this means users could have written a valid AES key with smaller size and it would have worked. ..and that's why the comments about validation.go were left i guess.

the main point is that kubeadm by default generates 32 bytes, which is secure.

i think we should just error for size != 32.

[neolit123]

/lgtm
/approve
/retest

please check the extra args v1beta4 pr when you can.

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: bff1f3edc14d92db160aed6dd9cec3e6ada6c092

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: neolit123, SataQiu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kubeadm/OWNERS [SataQiu,neolit123]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment