forked from bitly/oauth2_proxy
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #160 from marun/4.3-reload-serving-cert
[release-4.3] Bug 1809253: Reload serving certs
- Loading branch information
Showing
33 changed files
with
4,457 additions
and
2 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,74 @@ | ||
/* | ||
Copyright 2019 The Kubernetes Authors. | ||
Licensed under the Apache License, Version 2.0 (the "License"); | ||
you may not use this file except in compliance with the License. | ||
You may obtain a copy of the License at | ||
http://www.apache.org/licenses/LICENSE-2.0 | ||
Unless required by applicable law or agreed to in writing, software | ||
distributed under the License is distributed on an "AS IS" BASIS, | ||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
See the License for the specific language governing permissions and | ||
limitations under the License. | ||
*/ | ||
|
||
package dynamiccertificates | ||
|
||
import ( | ||
"bytes" | ||
) | ||
|
||
// CertKeyContentProvider provides a certificate and matching private key | ||
type CertKeyContentProvider interface { | ||
// Name is just an identifier | ||
Name() string | ||
// CurrentCertKeyContent provides cert and key byte content | ||
CurrentCertKeyContent() ([]byte, []byte) | ||
} | ||
|
||
// SNICertKeyContentProvider provides a certificate and matching private key as well as optional explicit names | ||
type SNICertKeyContentProvider interface { | ||
CertKeyContentProvider | ||
// SNINames provides names used for SNI. May return nil. | ||
SNINames() []string | ||
} | ||
|
||
// certKeyContent holds the content for the cert and key | ||
type certKeyContent struct { | ||
cert []byte | ||
key []byte | ||
} | ||
|
||
func (c *certKeyContent) Equal(rhs *certKeyContent) bool { | ||
if c == nil || rhs == nil { | ||
return c == rhs | ||
} | ||
|
||
return bytes.Equal(c.key, rhs.key) && bytes.Equal(c.cert, rhs.cert) | ||
} | ||
|
||
// sniCertKeyContent holds the content for the cert and key as well as any explicit names | ||
type sniCertKeyContent struct { | ||
certKeyContent | ||
sniNames []string | ||
} | ||
|
||
func (c *sniCertKeyContent) Equal(rhs *sniCertKeyContent) bool { | ||
if c == nil || rhs == nil { | ||
return c == rhs | ||
} | ||
|
||
if len(c.sniNames) != len(rhs.sniNames) { | ||
return false | ||
} | ||
|
||
for i := range c.sniNames { | ||
if c.sniNames[i] != rhs.sniNames[i] { | ||
return false | ||
} | ||
} | ||
|
||
return c.certKeyContent.Equal(&rhs.certKeyContent) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,81 @@ | ||
/* | ||
Copyright 2019 The Kubernetes Authors. | ||
Licensed under the Apache License, Version 2.0 (the "License"); | ||
you may not use this file except in compliance with the License. | ||
You may obtain a copy of the License at | ||
http://www.apache.org/licenses/LICENSE-2.0 | ||
Unless required by applicable law or agreed to in writing, software | ||
distributed under the License is distributed on an "AS IS" BASIS, | ||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
See the License for the specific language governing permissions and | ||
limitations under the License. | ||
*/ | ||
|
||
package dynamiccertificates | ||
|
||
import ( | ||
"bytes" | ||
"crypto/x509" | ||
) | ||
|
||
// CAContentProvider provides ca bundle byte content | ||
type CAContentProvider interface { | ||
// Name is just an identifier | ||
Name() string | ||
// CurrentCABundleContent provides ca bundle byte content. Errors can be contained to the controllers initializing | ||
// the value. By the time you get here, you should always be returning a value that won't fail. | ||
CurrentCABundleContent() []byte | ||
// VerifyOptions provides VerifyOptions for authenticators | ||
VerifyOptions() (x509.VerifyOptions, bool) | ||
} | ||
|
||
// dynamicCertificateContent holds the content that overrides the baseTLSConfig | ||
type dynamicCertificateContent struct { | ||
// clientCA holds the content for the clientCA bundle | ||
clientCA caBundleContent | ||
servingCert certKeyContent | ||
sniCerts []sniCertKeyContent | ||
} | ||
|
||
// caBundleContent holds the content for the clientCA bundle. Wrapping the bytes makes the Equals work nicely with the | ||
// method receiver. | ||
type caBundleContent struct { | ||
caBundle []byte | ||
} | ||
|
||
func (c *dynamicCertificateContent) Equal(rhs *dynamicCertificateContent) bool { | ||
if c == nil || rhs == nil { | ||
return c == rhs | ||
} | ||
|
||
if !c.clientCA.Equal(&rhs.clientCA) { | ||
return false | ||
} | ||
|
||
if !c.servingCert.Equal(&rhs.servingCert) { | ||
return false | ||
} | ||
|
||
if len(c.sniCerts) != len(rhs.sniCerts) { | ||
return false | ||
} | ||
|
||
for i := range c.sniCerts { | ||
if !c.sniCerts[i].Equal(&rhs.sniCerts[i]) { | ||
return false | ||
} | ||
} | ||
|
||
return true | ||
} | ||
|
||
func (c *caBundleContent) Equal(rhs *caBundleContent) bool { | ||
if c == nil || rhs == nil { | ||
return c == rhs | ||
} | ||
|
||
return bytes.Equal(c.caBundle, rhs.caBundle) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
package dynamiccertificates | ||
|
||
// This package contains the forked contents of | ||
// k8s.io/apiserver/pkg/server/dynamiccertificates from kube 1.17. The scope | ||
// of the fork was considerably less than the changes that would have been | ||
// required to bump the release-4.3 branch of oauth-proxy to 1.17. |
Oops, something went wrong.