116 lines
4.7 KiB
Diff
116 lines
4.7 KiB
Diff
From 8e1e06e2e4794c85c19d4ee9a528b6b2d35d9624 Mon Sep 17 00:00:00 2001
|
|
From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
|
|
Date: Tue, 18 Jan 2022 16:56:42 +0800
|
|
Subject: [PATCH 20/24] add digitalSignature for certificates
|
|
|
|
Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
|
|
---
|
|
pkg/utils/certs/approvecsr.go | 10 ++++++----
|
|
pkg/utils/certs/localcerts.go | 2 +-
|
|
pkg/utils/template/template.go | 2 +-
|
|
pkg/utils/template/template_test.go | 6 +++---
|
|
4 files changed, 11 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/pkg/utils/certs/approvecsr.go b/pkg/utils/certs/approvecsr.go
|
|
index 92af905..dfebbee 100644
|
|
--- a/pkg/utils/certs/approvecsr.go
|
|
+++ b/pkg/utils/certs/approvecsr.go
|
|
@@ -69,7 +69,7 @@ func (cv1 *CertificateV1) check(csr certificatesv1.CertificateSigningRequest, wo
|
|
|
|
// 3. check csr is requested for serving certificates
|
|
// usageRequired: "server auth"
|
|
- // usagesOptional: "digital signature", "key encipherment"
|
|
+ // usagesOptional: "digital signature", "key encipherment", "data encipherment"
|
|
required := false
|
|
for _, u := range csr.Spec.Usages {
|
|
if u == certificatesv1.UsageServerAuth {
|
|
@@ -77,7 +77,8 @@ func (cv1 *CertificateV1) check(csr certificatesv1.CertificateSigningRequest, wo
|
|
continue
|
|
}
|
|
|
|
- if u != certificatesv1.UsageDigitalSignature && u != certificatesv1.UsageKeyEncipherment {
|
|
+ if u != certificatesv1.UsageDigitalSignature && u != certificatesv1.UsageKeyEncipherment &&
|
|
+ u != certificatesv1.UsageDataEncipherment {
|
|
logrus.Warnf("csr %s is not requested for serving certificates", csr.Name)
|
|
return false
|
|
}
|
|
@@ -166,7 +167,7 @@ func (cv1beta1 *CertificateV1beta1) check(csr certificatesv1beta1.CertificateSig
|
|
|
|
// 3. check csr is requested for serving certificates
|
|
// usageRequired: "server auth"
|
|
- // usagesOptional: "digital signature", "key encipherment"
|
|
+ // usagesOptional: "digital signature", "key encipherment", "data encipherment"
|
|
required := false
|
|
for _, u := range csr.Spec.Usages {
|
|
if u == certificatesv1beta1.UsageServerAuth {
|
|
@@ -174,7 +175,8 @@ func (cv1beta1 *CertificateV1beta1) check(csr certificatesv1beta1.CertificateSig
|
|
continue
|
|
}
|
|
|
|
- if u != certificatesv1beta1.UsageDigitalSignature && u != certificatesv1beta1.UsageKeyEncipherment {
|
|
+ if u != certificatesv1beta1.UsageDigitalSignature && u != certificatesv1beta1.UsageKeyEncipherment &&
|
|
+ u != certificatesv1beta1.UsageDataEncipherment {
|
|
logrus.Warnf("csr %s is not requested for serving certificates", csr.Name)
|
|
return false
|
|
}
|
|
diff --git a/pkg/utils/certs/localcerts.go b/pkg/utils/certs/localcerts.go
|
|
index c5fe2e5..d613ea9 100644
|
|
--- a/pkg/utils/certs/localcerts.go
|
|
+++ b/pkg/utils/certs/localcerts.go
|
|
@@ -148,7 +148,7 @@ func (l *LocalCertGenerator) CreateCertAndKey(caCertPath, caKeyPath string, conf
|
|
DNSNames: config.AltNames.DNSNames,
|
|
IPAddresses: ips,
|
|
SerialNumber: serial,
|
|
- KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
|
|
+ KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageDataEncipherment,
|
|
ExtKeyUsage: config.Usages,
|
|
NotBefore: caCert.NotBefore,
|
|
NotAfter: time.Now().Add(time.Hour * 24 * 36500).UTC(),
|
|
diff --git a/pkg/utils/template/template.go b/pkg/utils/template/template.go
|
|
index 3b3138a..b16f55a 100644
|
|
--- a/pkg/utils/template/template.go
|
|
+++ b/pkg/utils/template/template.go
|
|
@@ -77,7 +77,7 @@ IP.{{ Add $i 1 }} = {{ $v }}
|
|
[ v3_ext ]
|
|
authorityKeyIdentifier = keyid,issuer:always
|
|
basicConstraints = CA:FALSE
|
|
-keyUsage = keyEncipherment,dataEncipherment
|
|
+keyUsage = digitalSignature,keyEncipherment,dataEncipherment
|
|
extendedKeyUsage = {{ .ExtendedKeyUsage }}
|
|
{{- if .HaveAltNames }}
|
|
subjectAltName = @alt_names
|
|
diff --git a/pkg/utils/template/template_test.go b/pkg/utils/template/template_test.go
|
|
index ae46d48..30d6f2d 100644
|
|
--- a/pkg/utils/template/template_test.go
|
|
+++ b/pkg/utils/template/template_test.go
|
|
@@ -46,7 +46,7 @@ IP.3 = 127.0.0.1
|
|
[ v3_ext ]
|
|
authorityKeyIdentifier = keyid,issuer:always
|
|
basicConstraints = CA:FALSE
|
|
-keyUsage = keyEncipherment,dataEncipherment
|
|
+keyUsage = digitalSignature,keyEncipherment,dataEncipherment
|
|
extendedKeyUsage = serverAuth,clientAuth
|
|
subjectAltName = @alt_names
|
|
`
|
|
@@ -71,7 +71,7 @@ CN = kube-apiserver-kubelet-client
|
|
[ v3_ext ]
|
|
authorityKeyIdentifier=keyid,issuer:always
|
|
basicConstraints=CA:FALSE
|
|
-keyUsage=keyEncipherment,dataEncipherment
|
|
+keyUsage=digitalSignature,keyEncipherment,dataEncipherment
|
|
extendedKeyUsage=clientAuth
|
|
`
|
|
kubelet_conf := &CsrConfig{
|
|
@@ -92,7 +92,7 @@ CN = front-proxy-client
|
|
[ v3_ext ]
|
|
authorityKeyIdentifier=keyid,issuer:always
|
|
basicConstraints=CA:FALSE
|
|
-keyUsage=keyEncipherment,dataEncipherment
|
|
+keyUsage=digitalSignature,keyEncipherment,dataEncipherment
|
|
extendedKeyUsage=clientAuth
|
|
`
|
|
front_proxy_client_conf := &CsrConfig{
|
|
--
|
|
2.25.1
|
|
|