From bcbbbc2e418526c87a76c0c101dcfbff8540b96a Mon Sep 17 00:00:00 2001 From: Stavros kois Date: Thu, 26 Jan 2023 13:49:25 +0200 Subject: [PATCH] forbid using revoked or expired certs --- docs/common/values/certificates.md | 8 --- docs/common/values/global.md | 4 -- .../tests/cert/cert_dict_test.yaml | 53 ------------------- .../tests/cert/cert_list_test.yaml | 53 ------------------- .../templates/lib/certificate/_certGet.tpl | 18 +------ library/common/1.0.0/values.yaml | 10 ---- 6 files changed, 2 insertions(+), 144 deletions(-) diff --git a/docs/common/values/certificates.md b/docs/common/values/certificates.md index 547fe1edbc..2fc9cee945 100644 --- a/docs/common/values/certificates.md +++ b/docs/common/values/certificates.md @@ -38,10 +38,6 @@ scaleCerts: certPath: /some/path/in/the/container/crt.key # Optional, If populated, it will mount the private key in the container's path keyPath: /some/path/in/the/container/key.key - # Optional, Allow the use of revoked certs, even if is not allowed globally - useRevoked: false - # Optional, Allow the use of expired certs, even if is not allowed globally - useExpired: false ``` --- @@ -81,8 +77,4 @@ scaleCertsList: certPath: # Optional keyPath: - # Optional - useRevoked: false - # Optional - useExpired: false ``` diff --git a/docs/common/values/global.md b/docs/common/values/global.md index 12b7246c17..b1f91ac58f 100644 --- a/docs/common/values/global.md +++ b/docs/common/values/global.md @@ -11,10 +11,6 @@ # If not defined on per pod or in ixChartContext, assume this. # Empty means NO runtimeClassName runtimeClassName: "" - # If not defined on the the cert item, assume this - useRevokedCerts: false - # If not defined on the the cert item, assume this - useExpiredCerts: false # If not defined on the pod, assume this dnsPolicy: ClusterFirst # If no restart Policy is defined, assume this diff --git a/library/common-test/tests/cert/cert_dict_test.yaml b/library/common-test/tests/cert/cert_dict_test.yaml index f381c6cfca..21acce8d1a 100644 --- a/library/common-test/tests/cert/cert_dict_test.yaml +++ b/library/common-test/tests/cert/cert_dict_test.yaml @@ -184,59 +184,6 @@ tests: expired: true asserts: *basicAssertion - - it: should pass with 1 REVOKED secret created and global allow - documentIndex: *secretDoc - set: - global: - defaults: - useRevokedCerts: true - scaleCerts: - certname: - id: 1 - # Simulating middleware injection - ixCertificates: - "1": - privatekey: some_key - certificate: cert_content - revoked: true - asserts: *basicAssertion - - - it: should pass with 1 EXPIRED secret created and local allow - documentIndex: *secretDoc - set: - global: - defaults: - useExpiredCerts: false - scaleCerts: - certname: - id: 1 - useExpired: true - # Simulating middleware injection - ixCertificates: - "1": - certificate: cert_content - privatekey: some_key - expired: true - asserts: *basicAssertion - - - it: should pass with 1 REVOKED secret created and local allow - documentIndex: *secretDoc - set: - global: - defaults: - useRevokedCerts: false - scaleCerts: - certname: - id: 1 - useRevoked: true - # Simulating middleware injection - ixCertificates: - "1": - privatekey: some_key - certificate: cert_content - revoked: true - asserts: *basicAssertion - - it: should pass with 2 secret created (doc1) documentIndex: *secretDoc set: diff --git a/library/common-test/tests/cert/cert_list_test.yaml b/library/common-test/tests/cert/cert_list_test.yaml index 262b3f32cf..6615607140 100644 --- a/library/common-test/tests/cert/cert_list_test.yaml +++ b/library/common-test/tests/cert/cert_list_test.yaml @@ -184,59 +184,6 @@ tests: expired: true asserts: *basicAssertion - - it: should pass with 1 REVOKED secret created and global allow - documentIndex: *secretDoc - set: - global: - defaults: - useRevokedCerts: true - scaleCertsList: - - name: certname - id: 1 - # Simulating middleware injection - ixCertificates: - "1": - privatekey: some_key - certificate: cert_content - revoked: true - asserts: *basicAssertion - - - it: should pass with 1 EXPIRED secret created and local allow - documentIndex: *secretDoc - set: - global: - defaults: - useExpiredCerts: false - scaleCertsList: - - name: certname - id: 1 - useExpired: true - # Simulating middleware injection - ixCertificates: - "1": - certificate: cert_content - privatekey: some_key - expired: true - asserts: *basicAssertion - - - it: should pass with 1 REVOKED secret created and local allow - documentIndex: *secretDoc - set: - global: - defaults: - useRevokedCerts: false - scaleCertsList: - - name: certname - id: 1 - useRevoked: true - # Simulating middleware injection - ixCertificates: - "1": - privatekey: some_key - certificate: cert_content - revoked: true - asserts: *basicAssertion - - it: should pass with 2 secret created (doc1) documentIndex: *secretDoc set: diff --git a/library/common/1.0.0/templates/lib/certificate/_certGet.tpl b/library/common/1.0.0/templates/lib/certificate/_certGet.tpl index 6ac1caea4a..db7c320203 100644 --- a/library/common/1.0.0/templates/lib/certificate/_certGet.tpl +++ b/library/common/1.0.0/templates/lib/certificate/_certGet.tpl @@ -27,8 +27,6 @@ Example keys (certificate, privatekey, expired, revoked) {{- $root := .root -}} {{- $key := .key -}} {{- $certID := (toString $cert.id) -}} - {{- $useRevoked := $root.Values.global.defaults.useRevokedCerts -}} - {{- $useExpired := $root.Values.global.defaults.useExpiredCerts -}} {{- if not $key -}} {{/* This is something that should not happen when using this library */}} {{- fail "You need to provide a when calling this template (certificate.get)" -}} @@ -37,27 +35,15 @@ Example keys (certificate, privatekey, expired, revoked) {{- if eq (include "ix.v1.common.certificate.exists" (dict "root" $root "certID" $certID)) "true" -}} {{- $certificate := (get $root.Values.ixCertificates (toString $certID)) -}} - {{- if (hasKey $cert "useRevoked") -}} - {{- $useRevoked = $cert.useRevoked -}} - {{- end -}} - - {{- if (hasKey $cert "useExpired") -}} - {{- $useExpired = $cert.useExpired -}} - {{- end -}} - {{- if (hasKey $certificate "revoked") -}} {{- if (eq (get $certificate "revoked") true) -}} - {{- if not $useRevoked -}} - {{- fail (printf "Certificate (%s) has been revoked" $certID) -}} - {{- end -}} + {{- fail (printf "Certificate (%s) has been revoked" $certID) -}} {{- end -}} {{- end -}} {{- if (hasKey $certificate "expired") -}} {{- if (eq (get $certificate "expired") true) -}} - {{- if not $useExpired -}} - {{- fail (printf "Certificate (%s) is expired" $certID) -}} - {{- end -}} + {{- fail (printf "Certificate (%s) is expired" $certID) -}} {{- end -}} {{- end -}} diff --git a/library/common/1.0.0/values.yaml b/library/common/1.0.0/values.yaml index 4e560c5725..90495a4e2a 100644 --- a/library/common/1.0.0/values.yaml +++ b/library/common/1.0.0/values.yaml @@ -11,10 +11,6 @@ global: # If not defined on per pod or in ixChartContext, assume this. # Empty means NO runtimeClassName runtimeClassName: "" - # If not defined on the the cert item, assume this - useRevokedCerts: false - # If not defined on the the cert item, assume this - useExpiredCerts: false # If not defined on the pod, assume this dnsPolicy: ClusterFirst # If no restart Policy is defined, assume this @@ -211,12 +207,6 @@ rbac: primary: true clusterWide: false -# Creates a configmap -configmap: {} - -# Creates a secret -secret: {} - # Defines lifecycle hooks lifecycle: {}