Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug 1882176: Validate certs for the current IP address of the node #461

Merged
merged 2 commits into from Jan 16, 2021
Merged

Bug 1882176: Validate certs for the current IP address of the node #461

merged 2 commits into from Jan 16, 2021

Conversation

retroflexer
Copy link
Contributor

Currently cluster-etcd-operator only checks the existence of the certificates, but doesn't verify the SAN configured in the certs against the current node IP address (hostname).

This PR fixes the problem by parsing the certificate to validate the SAN. If there is a SAN mismatch, it generates a new set of certificates.

@openshift-ci-robot openshift-ci-robot added the bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. label Oct 2, 2020
@openshift-ci-robot
Copy link

@retroflexer: This pull request references Bugzilla bug 1882176, which is invalid:

  • expected the bug to target the "4.6.0" release, but it targets "4.7.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 1882176: Verify the certs are valid for the current configured IP address

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot openshift-ci-robot added the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label Oct 2, 2020
@retroflexer retroflexer changed the title Bug 1882176: Verify the certs are valid for the current configured IP address Bug 1882176: Validate certs for the current IP address of the node Oct 3, 2020
@retroflexer
Copy link
Contributor Author

/retest

1 similar comment
@retroflexer
Copy link
Contributor Author

/retest

@retroflexer retroflexer force-pushed the regen-certs-if-san-mismatch branch 2 times, most recently from 5cbda40 to 718966e Compare October 5, 2020 13:22
@retroflexer
Copy link
Contributor Author

/bugzilla refresh

@openshift-ci-robot openshift-ci-robot added bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. and removed bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. labels Oct 8, 2020
@openshift-ci-robot
Copy link

@retroflexer: This pull request references Bugzilla bug 1882176, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.7.0) matches configured target release for branch (4.7.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@retroflexer
Copy link
Contributor Author

/retest

@openshift-ci-robot
Copy link

@retroflexer: The following tests failed, say /retest to rerun all failed tests:

Test name Commit Details Rerun command
ci/prow/e2e-upgrade cd2a644 link /test e2e-upgrade
ci/prow/e2e-disruptive cd2a644 link /test e2e-disruptive

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@retroflexer
Copy link
Contributor Author

/test e2e-upgrade

@retroflexer retroflexer force-pushed the regen-certs-if-san-mismatch branch 3 times, most recently from 6e414e4 to c116df3 Compare January 13, 2021 14:07
@retroflexer
Copy link
Contributor Author

/hold cancel

@openshift-ci-robot openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 13, 2021
@retroflexer
Copy link
Contributor Author

/test verify

@retroflexer
Copy link
Contributor Author

/retest

@retroflexer
Copy link
Contributor Author

/test e2e-agnostic

hexfusion
hexfusion reviewed Jan 14, 2021
View reviewed changes
Copy link
Contributor

@hexfusion hexfusion left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@retroflexer looks good a few optional things to look at here. I can tag when you are ready.

/approve

pkg/operator/etcdcertsigner/etcdcertsignercontroller.go Show resolved Hide resolved
pkg/operator/etcdendpointscontroller/etcdendpointscontroller_test.go Outdated Show resolved Hide resolved
pkg/operator/etcdcertsigner/etcdcertsignercontroller.go Show resolved Hide resolved
@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 14, 2021
@retroflexer retroflexer force-pushed the regen-certs-if-san-mismatch branch 2 times, most recently from 9f13370 to 2d32a71 Compare January 14, 2021 18:49
@hexfusion
Copy link
Contributor

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 14, 2021
@openshift-ci-robot openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label Jan 14, 2021
@hexfusion
Copy link
Contributor

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 14, 2021
@openshift-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hexfusion, retroflexer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

3 similar comments
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot openshift-merge-robot merged commit e1614aa into openshift:master Jan 16, 2021
@openshift-ci-robot
Copy link

@retroflexer: All pull requests linked via external trackers have merged:

Bugzilla bug 1882176 has been moved to the MODIFIED state.

In response to this:

Bug 1882176: Validate certs for the current IP address of the node

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hexfusion hexfusion mentioned this pull request Jan 16, 2021
Merged
@retroflexer retroflexer deleted the regen-certs-if-san-mismatch branch June 1, 2021 23:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marun marun marun left review comments

@hexfusion hexfusion hexfusion left review comments

@ironcladlou ironcladlou Awaiting requested review from ironcladlou

Assignees

@marun marun

@hexfusion hexfusion

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@retroflexer @openshift-ci-robot @hexfusion @marun @openshift-merge-robot @openshift-bot