[release-4.12] OCPBUGS-14454, OCPBUGS-14455: Handle mTLS CRLs, and fix accidental CRL duplication - #489
[release-4.12] OCPBUGS-14454, OCPBUGS-14455: Handle mTLS CRLs, and fix accidental CRL duplication#489rfredette wants to merge 3 commits into
Conversation
The CRLs on disk don't include enough information to accurately determine which CA certificate they were downloaded for. Instead of re-parsing the CRLs on disk, keep them in a map indexed by the CA's subject key, so we can avoid unnecessary downloads and incorrect attribution.
Allows easier backporting to releases reliant on go 1.18 or older
openshift-ci-robot
added
jira/severity-critical
|
@rfredette: This pull request references Jira Issue OCPBUGS-14455, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@rfredette: This pull request references Jira Issue OCPBUGS-14455. The bug has been updated to no longer refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Accidentally opened against master branch, instead of release-4.12. Closing and opening against the correct branch |
2 participants
Manual cherry-pick of #472
This PR makes the router parse the certificates supplied in ROUTER_MUTUAL_TLS_AUTH_CA, download CRLs from any CRL distribution points that are found, and write them to a file that is supplied to HAProxy for mTLS certificate validation.
It also includes a fix for an issue where, when a CRL is distributed in a certificate that is not its issuer, the CRL would sometimes be missing or two copies of the CRL would be present.