newTLSConfigFromSecret creates a tls.Config from the given CA secret.
(ctx context.Context, opts TLSConfigOptions)
| 51 | |
| 52 | // newTLSConfigFromSecret creates a tls.Config from the given CA secret. |
| 53 | func newTLSConfigFromSecret(ctx context.Context, opts TLSConfigOptions) (*tls.Config, error) { |
| 54 | secret := &corev1.Secret{} |
| 55 | err := opts.Client.Get(ctx, opts.CASecret, secret) |
| 56 | if err != nil { |
| 57 | return nil, fmt.Errorf("while getting caSecret %s: %w", opts.CASecret.Name, err) |
| 58 | } |
| 59 | |
| 60 | caCertificate, ok := secret.Data[CACertKey] |
| 61 | if !ok { |
| 62 | return nil, fmt.Errorf("missing %s entry in secret %s", CACertKey, opts.CASecret.Name) |
| 63 | } |
| 64 | |
| 65 | // The operator will verify the certificates only against the CA, ignoring the DNS name. |
| 66 | // This behavior is because user-provided certificates could not have the DNS name |
| 67 | // for the <cluster>-rw service, which would cause a name verification error. |
| 68 | caCertPool := x509.NewCertPool() |
| 69 | caCertPool.AppendCertsFromPEM(caCertificate) |
| 70 | |
| 71 | return NewTLSConfigFromCertPool(caCertPool), nil |
| 72 | } |
| 73 | |
| 74 | // verifyCertificates validates the peer certificate chain against the trusted CA pool. |
| 75 | func verifyCertificates(certPool *x509.CertPool, certs []*x509.Certificate) error { |
no test coverage detected