github.com/openshift/installer@v1.4.17/pkg/asset/tls/certkey.go

package tls

import (
	"bytes"
	"context"
	"crypto/rsa"
	"crypto/x509"
	"os"

	"github.com/pkg/errors"
	"github.com/sirupsen/logrus"

	"github.com/openshift/installer/pkg/asset"
)

// CertInterface contains cert.
type CertInterface interface {
	// Cert returns the certificate.
	Cert() []byte
}

// CertKeyInterface contains a private key and the associated cert.
type CertKeyInterface interface {
	CertInterface
	// Key returns the private key.
	Key() []byte
}

// CertKey contains the private key and the cert.
type CertKey struct {
	CertRaw  []byte
	KeyRaw   []byte
	FileList []*asset.File
}

// Cert returns the certificate.
func (c *CertKey) Cert() []byte {
	return c.CertRaw
}

// Key returns the private key.
func (c *CertKey) Key() []byte {
	return c.KeyRaw
}

// Files returns the files generated by the asset.
func (c *CertKey) Files() []*asset.File {
	return c.FileList
}

// CertFile returns the certificate file.
func (c *CertKey) CertFile() *asset.File {
	return c.FileList[1]
}

func (c *CertKey) generateFiles(filenameBase string) {
	c.FileList = []*asset.File{
		{
			Filename: assetFilePath(filenameBase + ".key"),
			Data:     c.KeyRaw,
		},
		{
			Filename: assetFilePath(filenameBase + ".crt"),
			Data:     c.CertRaw,
		},
	}
}

// Load is a no-op because TLS assets are not written to disk.
func (c *CertKey) Load(asset.FileFetcher) (bool, error) {
	return false, nil
}

func (c *CertKey) loadCertKey(f asset.FileFetcher, filenameBase string) (bool, error) {
	if os.Getenv("OPENSHIFT_INSTALL_LOAD_CLUSTER_CERTS") != "true" {
		return c.Load(f)
	}

	loadFile := func(suffix string) (*asset.File, error) {
		file, err := f.FetchByName(assetFilePath(filenameBase + suffix))
		if err != nil {
			if os.IsNotExist(err) {
				return nil, nil
			}
			return nil, err
		}
		return file, err
	}

	key, err := loadFile(".key")
	if key == nil {
		return false, err
	}

	cert, err := loadFile(".crt")
	if cert == nil {
		return false, err
	}

	c.KeyRaw = key.Data
	c.CertRaw = cert.Data
	c.FileList = []*asset.File{key, cert}

	return true, nil
}

// AppendParentChoice dictates whether the parent's cert is to be added to the
// cert.
type AppendParentChoice bool

const (
	// AppendParent indicates that the parent's cert should be added.
	AppendParent AppendParentChoice = true
	// DoNotAppendParent indicates that the parent's cert should not be added.
	DoNotAppendParent AppendParentChoice = false
)

// SignedCertKey contains the private key and the cert that's
// signed by the parent CA.
type SignedCertKey struct {
	CertKey
}

// Generate generates a cert/key pair signed by the specified parent CA.
func (c *SignedCertKey) Generate(_ context.Context,
	cfg *CertCfg,
	parentCA CertKeyInterface,
	filenameBase string,
	appendParent AppendParentChoice,
) error {
	var key *rsa.PrivateKey
	var crt *x509.Certificate
	var err error

	caKey, err := PemToPrivateKey(parentCA.Key())
	if err != nil {
		logrus.Debugf("Failed to parse RSA private key: %s", err)
		return errors.Wrap(err, "failed to parse rsa private key")
	}

	caCert, err := PemToCertificate(parentCA.Cert())
	if err != nil {
		logrus.Debugf("Failed to parse x509 certificate: %s", err)
		return errors.Wrap(err, "failed to parse x509 certificate")
	}

	key, crt, err = GenerateSignedCertificate(caKey, caCert, cfg)
	if err != nil {
		logrus.Debugf("Failed to generate signed cert/key pair: %s", err)
		return errors.Wrap(err, "failed to generate signed cert/key pair")
	}

	c.KeyRaw = PrivateKeyToPem(key)
	c.CertRaw = CertToPem(crt)

	if appendParent {
		c.CertRaw = bytes.Join([][]byte{c.CertRaw, CertToPem(caCert)}, []byte("\n"))
	}

	c.generateFiles(filenameBase)

	return nil
}

// SelfSignedCertKey contains the private key and the cert that's self-signed.
type SelfSignedCertKey struct {
	CertKey
}

// Generate generates a cert/key pair signed by the specified parent CA.
func (c *SelfSignedCertKey) Generate(_ context.Context,
	cfg *CertCfg,
	filenameBase string,
) error {
	key, crt, err := GenerateSelfSignedCertificate(cfg)
	if err != nil {
		return errors.Wrap(err, "failed to generate self-signed cert/key pair")
	}

	c.KeyRaw = PrivateKeyToPem(key)
	c.CertRaw = CertToPem(crt)

	c.generateFiles(filenameBase)

	return nil
}