make MatchPeerCertificatesFromSecret work with certificate chains #664
Conversation
knative-prow
bot
added
the
size/M
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: maschmid, matzew The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
knative-prow
bot
added
the
approved
knative-prow
bot
merged commit 3bf004c
into
knative-extensions:main
|
/cherry-pick release-1.11 |
|
/cherry-pick release-1.12 |
|
/cherry-pick release-1.13 |
|
@maschmid: new pull request created: #665 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@maschmid: new pull request created: #666 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@maschmid: new pull request created: #667 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Changes
/kind enhancement
When using intermediate CAs, the secret can contain more than one certificate (a certificate chain), so the comparison
cannot work
Instead, we parse all the certificates in the chain from the secret with
pem.Decode, and we make sure that each of the certificates is present in theinfo.Connection.TLS.PemPeerCertificates