Skip to content

[release-4.11] OCPBUGS-14456, OCPBUGS-14457: Handle mTLS CRLs, and fix accidental CRL duplication #492

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
openshift-merge-robot merged 3 commits into from
Jun 8, 2023
Merged

[release-4.11] OCPBUGS-14456, OCPBUGS-14457: Handle mTLS CRLs, and fix accidental CRL duplication #492

openshift-merge-robot merged 3 commits into from
Jun 8, 2023

Conversation

@rfredette
Copy link
Contributor

@rfredette rfredette commented Jun 1, 2023

Manual cherry-pick of #472

This PR makes the router parse the certificates supplied in ROUTER_MUTUAL_TLS_AUTH_CA, download CRLs from any CRL distribution points that are found, and write them to a file that is supplied to HAProxy for mTLS certificate validation.

It also includes a fix for an issue where, when a CRL is distributed in a certificate that is not its issuer, the CRL would sometimes be missing or two copies of the CRL would be present.

rfredette added 3 commits June 1, 2023 18:40
@rfredette
Download and manage CRLs in openshift-router
a8f7e17
@rfredette
Cache current CRLs in memory instead of re-parsing from disk
632f8fd 
The CRLs on disk don't include enough information to accurately
determine which CA certificate they were downloaded for. Instead of
re-parsing the CRLs on disk, keep them in a map indexed by the CA's
subject key, so we can avoid unnecessary downloads and incorrect
attribution.
@rfredette
Revert to pkix.CertificateList instead of x509.RevocationList
8794ab1 
Allows easier backporting to releases reliant on go 1.18 or older
@openshift-ci-robot openshift-ci-robot added jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jun 1, 2023
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jun 1, 2023

@rfredette: This pull request references Jira Issue OCPBUGS-14457, which is invalid:

  • expected Jira Issue OCPBUGS-14457 to depend on a bug targeting a version in 4.12.0, 4.12.z and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Manual cherry-pick of #472

This PR makes the router parse the certificates supplied in ROUTER_MUTUAL_TLS_AUTH_CA, download CRLs from any CRL distribution points that are found, and write them to a file that is supplied to HAProxy for mTLS certificate validation.

It also includes a fix for an issue where, when a CRL is distributed in a certificate that is not its issuer, the CRL would sometimes be missing or two copies of the CRL would be present.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@rfredette rfredette changed the title [release-4.12] OCPBUGS-14456, OCPBUGS-14457: Handle mTLS CRLs, and fix accidental CRL duplication [release-4.11] OCPBUGS-14456, OCPBUGS-14457: Handle mTLS CRLs, and fix accidental CRL duplication Jun 1, 2023
@openshift-ci openshift-ci bot requested review from Miciah and candita June 1, 2023 22:47
@frobware
Copy link
Contributor

frobware commented Jun 2, 2023

/retest

@frobware
Copy link
Contributor

frobware commented Jun 2, 2023

/lgtm
/approve

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jun 2, 2023
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jun 2, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: frobware

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 2, 2023
@frobware frobware mentioned this pull request Jun 2, 2023
Merged
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jun 2, 2023

@rfredette: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@sferich888
Copy link
Contributor

sferich888 commented Jun 5, 2023

/jira refresh

@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jun 5, 2023

@sferich888: This pull request references Jira Issue OCPBUGS-14457, which is invalid:

  • expected Jira Issue OCPBUGS-14457 to depend on a bug targeting a version in 4.12.0, 4.12.z and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@sferich888
Copy link
Contributor

sferich888 commented Jun 5, 2023

/jira refresh

@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jun 5, 2023

@sferich888: This pull request references Jira Issue OCPBUGS-14457, which is invalid:

  • expected dependent Jira Issue OCPBUGS-14455 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is POST instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@Miciah
Copy link
Contributor

Miciah commented Jun 5, 2023

/label backport-risk-assessed

@openshift-ci openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Jun 5, 2023
@lihongan
Copy link
Contributor

lihongan commented Jun 6, 2023

/label cherry-pick-approved

@openshift-ci openshift-ci bot added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Jun 6, 2023
@lihongan
Copy link
Contributor

lihongan commented Jun 8, 2023

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jun 8, 2023
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jun 8, 2023

@lihongan: This pull request references Jira Issue OCPBUGS-14457, which is valid.

6 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.11.z) matches configured target version for branch (4.11.z)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
  • dependent bug Jira Issue OCPBUGS-14455 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE))
  • dependent Jira Issue OCPBUGS-14455 targets the "4.12.z" version, which is one of the valid target versions: 4.12.0, 4.12.z
  • bug has dependents

Requesting review from QA contact:
/cc @lihongan

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot requested a review from lihongan June 8, 2023 07:01
@openshift-merge-robot openshift-merge-robot merged commit 2cf11b1 into openshift:release-4.11 Jun 8, 2023
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jun 8, 2023

@rfredette: Jira Issue OCPBUGS-14457: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

These pull request must merge or be unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-14457 has not been moved to the MODIFIED state.

Details

In response to this:

Manual cherry-pick of #472

This PR makes the router parse the certificates supplied in ROUTER_MUTUAL_TLS_AUTH_CA, download CRLs from any CRL distribution points that are found, and write them to a file that is supplied to HAProxy for mTLS certificate validation.

It also includes a fix for an issue where, when a CRL is distributed in a certificate that is not its issuer, the CRL would sometimes be missing or two copies of the CRL would be present.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-merge-robot
Copy link
Contributor

openshift-merge-robot commented Jun 9, 2023

Fix included in accepted release 4.11.0-0.nightly-2023-06-08-182148

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@candita candita Awaiting requested review from candita

@Miciah Miciah Awaiting requested review from Miciah

@lihongan lihongan Awaiting requested review from lihongan

Assignees

@frobware frobware

@lihongan lihongan

@melvinjoseph86 melvinjoseph86

@ShudiLi ShudiLi

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

@rfredette @openshift-ci-robot @frobware @sferich888 @Miciah @lihongan @openshift-merge-robot @melvinjoseph86 @ShudiLi