k8s.io/apiserver@v0.31.1/pkg/server/dynamiccertificates/named_certificates.go (about)

     1  /*
     2  Copyright 2019 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package dynamiccertificates
    18  
    19  import (
    20  	"crypto/tls"
    21  	"crypto/x509"
    22  	"fmt"
    23  	"strings"
    24  
    25  	corev1 "k8s.io/api/core/v1"
    26  	"k8s.io/apimachinery/pkg/util/validation"
    27  	"k8s.io/klog/v2"
    28  	netutils "k8s.io/utils/net"
    29  )
    30  
    31  // BuildNamedCertificates returns a map of *tls.Certificate by name. It's
    32  // suitable for use in tls.Config#NamedCertificates. Returns an error if any of the certs
    33  // is invalid. Returns nil if len(certs) == 0
    34  func (c *DynamicServingCertificateController) BuildNamedCertificates(sniCerts []sniCertKeyContent) (map[string]*tls.Certificate, error) {
    35  	nameToCertificate := map[string]*tls.Certificate{}
    36  	byNameExplicit := map[string]*tls.Certificate{}
    37  
    38  	// Iterate backwards so that earlier certs take precedence in the names map
    39  	for i := len(sniCerts) - 1; i >= 0; i-- {
    40  		cert, err := tls.X509KeyPair(sniCerts[i].cert, sniCerts[i].key)
    41  		if err != nil {
    42  			return nil, fmt.Errorf("invalid SNI cert keypair [%d/%q]: %v", i, c.sniCerts[i].Name(), err)
    43  		}
    44  
    45  		// error is not possible given above call to X509KeyPair
    46  		x509Cert, _ := x509.ParseCertificate(cert.Certificate[0])
    47  
    48  		names := sniCerts[i].sniNames
    49  		for _, name := range names {
    50  			byNameExplicit[name] = &cert
    51  		}
    52  
    53  		klog.V(2).InfoS("Loaded SNI cert", "index", i, "certName", c.sniCerts[i].Name(), "certDetail", GetHumanCertDetail(x509Cert))
    54  		if c.eventRecorder != nil {
    55  			c.eventRecorder.Eventf(&corev1.ObjectReference{Name: c.sniCerts[i].Name()}, nil, corev1.EventTypeWarning, "TLSConfigChanged", "SNICertificateReload", "loaded SNI cert [%d/%q]: %s with explicit names %v", i, c.sniCerts[i].Name(), GetHumanCertDetail(x509Cert), names)
    56  		}
    57  
    58  		if len(names) == 0 {
    59  			names = getCertificateNames(x509Cert)
    60  			for _, name := range names {
    61  				nameToCertificate[name] = &cert
    62  			}
    63  		}
    64  	}
    65  
    66  	// Explicitly set names must override
    67  	for k, v := range byNameExplicit {
    68  		nameToCertificate[k] = v
    69  	}
    70  
    71  	return nameToCertificate, nil
    72  }
    73  
    74  // getCertificateNames returns names for an x509.Certificate. The names are
    75  // suitable for use in tls.Config#NamedCertificates.
    76  func getCertificateNames(cert *x509.Certificate) []string {
    77  	var names []string
    78  
    79  	cn := cert.Subject.CommonName
    80  	cnIsIP := netutils.ParseIPSloppy(cn) != nil
    81  	cnIsValidDomain := cn == "*" || len(validation.IsDNS1123Subdomain(strings.TrimPrefix(cn, "*."))) == 0
    82  	// don't use the CN if it is a valid IP because our IP serving detection may unexpectedly use it to terminate the connection.
    83  	if !cnIsIP && cnIsValidDomain {
    84  		names = append(names, cn)
    85  	}
    86  	names = append(names, cert.DNSNames...)
    87  	// intentionally all IPs in the cert are ignored as SNI forbids passing IPs
    88  	// to select a cert. Before go 1.6 the tls happily passed IPs as SNI values.
    89  
    90  	return names
    91  }