New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add external certificate management for the Concierge Impersonation Proxy #1582

Merged

joshuatcasey merged 6 commits into main from jtc/1547-poc

Aug 3, 2023

Member

joshuatcasey commented Jul 20, 2023 •

edited

Loading

Add external certificate management for the Concierge Impersonation Proxy

Resolves #1547 .

See the accepted proposal for the design considerations.

~~Working POC (with documented steps)~~ This will happen in the blog post announcing the release
Regenerated API for all versions of K8s
Integration tests

vmwclabot added the cla-not-required label

codecov bot commented Jul 20, 2023 •

edited

Loading

Codecov Report

Merging #1582 (dc61d13) into main (c78db66) will increase coverage by 0.00%.
The diff coverage is 76.31%.

@@           Coverage Diff           @@
##             main    #1582   +/-   ##
=======================================
  Coverage   75.48%   75.48%           
=======================================
  Files         166      166           
  Lines       15012    15083   +71     
=======================================
+ Hits        11332    11386   +54     
- Misses       3386     3399   +13     
- Partials      294      298    +4

Files Changed	Coverage Δ
...ntroller/impersonatorconfig/impersonator_config.go	`90.74% <76.31%> (-1.45%)`	⬇️

... and 1 file with indirect coverage changes

joshuatcasey force-pushed the jtc/1547-poc branch 5 times, most recently from 6c721ac to dbb23b8 Compare

July 20, 2023 20:18

joshuatcasey marked this pull request as ready for review

July 20, 2023 20:18

joshuatcasey force-pushed the jtc/1547-poc branch from dbb23b8 to 7fa1767 Compare

July 20, 2023 21:06

joshuatcasey commented

View reviewed changes

internal/controller/impersonatorconfig/impersonator_config_test.go Show resolved Hide resolved

joshuatcasey commented

View reviewed changes

internal/controller/impersonatorconfig/impersonator_config_test.go Outdated Show resolved Hide resolved

joshuatcasey force-pushed the jtc/1547-poc branch 2 times, most recently from 96c3cb6 to 9e264dc Compare

July 24, 2023 14:48

cfryanr reviewed

View reviewed changes

apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/concierge_impersonation_proxy_test.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/concierge_impersonation_proxy_test.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/concierge_impersonation_proxy_test.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

internal/controller/impersonatorconfig/impersonator_config.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

internal/controller/impersonatorconfig/impersonator_config.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

internal/controller/impersonatorconfig/impersonator_config.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

internal/controller/impersonatorconfig/impersonator_config.go Show resolved Hide resolved

joshuatcasey force-pushed the jtc/1547-poc branch 3 times, most recently from 2b87a55 to 0faae51 Compare

August 2, 2023 04:33

cfryanr approved these changes

View reviewed changes

benjaminapetersen approved these changes

View reviewed changes

joshuatcasey added 3 commits

August 3, 2023 14:57


          The impersonation controller should sync when any secret of type kube…

3e57716

…rnetes.io/tls changes in the namespace


          Add CredentialIssuer.Spec.ImpersonationProxy.TLS to configure an exte…

8df9033

…rnally provided TLS secret


          Impersonation proxy detects when the user has configured an externall…

bd035a1

…y provided TLS secret to serve TLS

- https://github.com/vmware-tanzu/pinniped/tree/main/proposals/1547_impersonation-proxy-external-certs
- https://joshuatcasey.medium.com/k8s-mtls-auth-with-tls-passthrough-1bc25e750f52

joshuatcasey added 3 commits

August 3, 2023 14:57


          Test Refactor: use explicit names for mTLS signing cert

ee75a63


          Add integration test to verify that the impersonation proxy will use …

959f18b

…an external TLS serving cert


          Address PR feedback, especially to check that the CA bundle is some k…

dc61d13

…ind of valid cert

joshuatcasey force-pushed the jtc/1547-poc branch from 0faae51 to dc61d13 Compare

August 3, 2023 19:57

joshuatcasey enabled auto-merge

August 3, 2023 19:57

joshuatcasey merged commit e2e9819 into main

joshuatcasey deleted the jtc/1547-poc branch

August 3, 2023 20:52

joshuatcasey mentioned this pull request

Bump go.mod direct dependencies #1607

Merged

joshuatcasey added a commit that referenced this pull request


          Fix #1582 by not double-decoding the ca.crt field in external TLS sec…

…rets for the impersonation proxy

joshuatcasey mentioned this pull request

Fix #1582 by not double-decoding the ca.crt field in external TLS secrets for the impersonation proxy #1615

Merged

benjaminapetersen added a commit that referenced this pull request


          Merge pull request #1615 from vmware-tanzu/jtc/fix-double-decoding-of…

c7b49d9

…-ca-crt

Fix #1582 by not double-decoding the ca.crt field in external TLS secrets for the impersonation proxy

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cla-not-required