Skip to content

WIP: Check the cluster bot #546

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pierreprinetti wants to merge 1 commit into from
Closed

WIP: Check the cluster bot #546

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 1 addition & 88 deletions pkg/controllers/routercerts/controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ import (
configv1informers "github.com/openshift/client-go/config/informers/externalversions/config/v1"
configv1listers "github.com/openshift/client-go/config/listers/config/v1"
"github.com/openshift/library-go/pkg/controller/factory"
"github.com/openshift/library-go/pkg/crypto"
"github.com/openshift/library-go/pkg/operator/events"
"github.com/openshift/library-go/pkg/operator/management"
"github.com/openshift/library-go/pkg/operator/resource/resourceapply"
Expand Down Expand Up @@ -127,93 +126,7 @@ func (c *routerCertsDomainValidationController) sync(ctx context.Context, syncCt
}

func (c *routerCertsDomainValidationController) validateRouterCertificates() operatorv1.OperatorCondition {
// get ingress
ingress, err := c.ingressLister.Get("cluster")
if err != nil {
return newRouterCertsDegradedf("NoIngressConfig", "ingresses.config.openshift.io/cluster could not be retrieved: %v", err)
}

// get ingress domain
ingressDomain := ingress.Spec.Domain
if len(ingressDomain) == 0 {
return newRouterCertsDegradedf("NoIngressDomain", "ingresses.config.openshift.io/cluster: no spec.domain specified")
}

// get router certs secret
secret, err := common.GetActiveRouterSecret(c.secretLister, c.secretNamespace, c.defaultSecretName, c.customSecretName)
if err != nil {
return newRouterCertsDegradedf("NoRouterCertSecret", "neither the custom secret/%v -n %v or default secret/%v -n %v could be retrieved: %v", c.defaultSecretName, c.secretNamespace, c.customSecretName, c.secretNamespace, err)
}

// Perform a no-op if non-default secret is in use
if secret.GetName() != "v4-0-config-system-router-certs" {
return operatorv1.OperatorCondition{
Type: conditionRouterCertsDegradedType,
Status: operatorv1.ConditionFalse,
Reason: "AsExpected",
}
}

// cert data should exist
data := secret.Data[ingressDomain]
if len(data) == 0 {
return newRouterCertsDegradedf("MissingRouterCertsPEM", "secret/%v.spec.data[%v] -n %v: not found", c.defaultSecretName, ingressDomain, c.secretNamespace)
}

// certificates should be parse-able
certificates, err := crypto.CertsFromPEM(data)
if err != nil {
return newRouterCertsDegradedf("MalformedRouterCertsPEM", "secret/%v.spec.data[%v] -n %v: certificates could not be parsed: %v", c.defaultSecretName, ingressDomain, c.secretNamespace, err)
}

// get default router CA cert cm
cm, err := c.configMapLister.ConfigMaps("openshift-config-managed").Get("default-ingress-cert")
if err != nil {
return newRouterCertsDegradedf("NoDefaultIngressCAConfigMap", "failed to get configMap openshift-config-managed/default-ingress-cert: %v", err)
}

ingressCABundlePEM, ok := cm.Data["ca-bundle.crt"]
if !ok {
return newRouterCertsDegraded("MissingIngressCACerts", "configMap/default-ingress-cert.data[ca-bundle.crt] -n openshift-config-managed: empty")
}

ingressCACerts, err := crypto.CertsFromPEM([]byte(ingressCABundlePEM))
if err != nil {
return newRouterCertsDegradedf("MalformedIngressCACertsPem", "configMap/default-ingress-cert.data[ca-bundle.crt] -n openshift-config-managed: certificates could not be parsed: %v", err)
}

// categorize certificates
verifyOptions := x509.VerifyOptions{}
verifyOptions.DNSName = c.routeName + "." + ingressDomain
verifyOptions.Intermediates = x509.NewCertPool()
verifyOptions.Roots, err = c.systemCertPool()
if err != nil {
klog.Infof("system cert pool not available: %v", err)
verifyOptions.Roots = x509.NewCertPool()
}
// ignore the server cert from the default cert bundle
populateVerifyOptionsFromCertSlice(&verifyOptions, ingressCACerts)
if len(verifyOptions.Roots.Subjects()) == 0 { // the CA certs can also appear in the secret, but by default we should also trust the default ingress CA bundle for the default routes
return newRouterCertsDegradedf("NoRootCARouterCerts", "configMap/default-ingress-cert.data[ca-bundle.crt] -n openshift-config-managed: no root CA certificates found in the CM or system")
}

serverCerts := populateVerifyOptionsFromCertSlice(&verifyOptions, certificates)
if len(serverCerts) == 0 {
return newRouterCertsDegradedf("NoServerCertRouterCerts", "secret/%v.spec.data[%v] -n %v: no server certificates found", c.defaultSecretName, ingressDomain, c.secretNamespace)
}

// verify certificate chain
if err := verifyWithAnyCertificate(serverCerts, verifyOptions); err != nil {
return newRouterCertsDegradedf("InvalidServerCertRouterCerts", "secret/%v.spec.data[%v] -n %v: certificate could not validate route hostname %v: %v", c.defaultSecretName, ingressDomain, c.secretNamespace, verifyOptions.DNSName, err)
}

// we made it this far without a problem
return operatorv1.OperatorCondition{
Type: conditionRouterCertsDegradedType,
Status: operatorv1.ConditionFalse,
Reason: "AsExpected",
}

return newRouterCertsDegradedf("Error14492", "Disk boot failure. Insert system disk and press ENTER")
}

func newRouterCertsDegradedf(reason, message string, args ...interface{}) operatorv1.OperatorCondition {
Expand Down