Skip to content

Let it be possible to specify optional CAcert for trust of remote cfssl#51

Merged
ferringb merged 4 commits intocloudflare:masterfrom
johanot:remote-tls-rootca
Jun 12, 2019
Merged

Let it be possible to specify optional CAcert for trust of remote cfssl#51
ferringb merged 4 commits intocloudflare:masterfrom
johanot:remote-tls-rootca

Conversation

@johanot
Copy link
Copy Markdown
Contributor

@johanot johanot commented Aug 23, 2018

If you run cfssl apiserver tls-enabled, it is currently not possible to use self-signed certificate, because certmgr will reject it.

This PR makes it possible to use self-signed certificate on the cfssl apiserver, by providing an optional cert-spec option root_ca.

@johanot
Copy link
Copy Markdown
Contributor Author

johanot commented Aug 28, 2018

@cbroglie Don't know if you work with certmgr as well? But since you merged my latest PR on cfssl, perhaps you'd care to review this as well? :) thanks in any case.

cert/cert.go Outdated
if len(ca.RootCACert) > 0 {
rootCABytes, err := ioutil.ReadFile(ca.RootCACert)
if err != nil {
panic(err)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why panic here? why not simply return nil, err?

cert/cert.go Outdated
rootCaCertPool := x509.NewCertPool()
ok := rootCaCertPool.AppendCertsFromPEM(rootCABytes)
if !ok {
panic("failed to parse rootCA certs")
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you should probably return nil, errors.New("failed to parse rootCA certs")

cert/cert.go Outdated
panic(err)
}

if err == nil {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Go devs are not fond of if..else blocks, can you change this entire block to:

if err != nil {
  return nil, err
}
rootCaCertPool := x509.NewCertPool() ...

also don't panic :)

cert/cert.go Outdated

func (ca *CA) getRemoteCert() ([]byte, error) {
remote := client.NewServer(ca.Remote)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remove newline on top.

…sl tls cert.

This makes it possible to use self-signed certificate on the cfssl apiserver.
@johanot johanot force-pushed the remote-tls-rootca branch from 3fe00d5 to bfbe3b4 Compare August 29, 2018 07:54
@johanot
Copy link
Copy Markdown
Contributor Author

johanot commented Aug 29, 2018

@kalbasit Thanks for the review. Check bfbe3b4 now. Sorry about the poor error handling. The panics were clearly remnants of my debugging and shouldn't have made it to the PR :) embarrassing.

kalbasit
kalbasit previously approved these changes Aug 29, 2018
@kalbasit
Copy link
Copy Markdown

@johanot no worries :), it looks great now, hopwfully someone can merge this soon. Today, I will take a look at the k8s pr over on nixpkgs.

@johanot
Copy link
Copy Markdown
Contributor Author

johanot commented Aug 30, 2018

@kisom Can I kindly ask for your comment/opinion on this change?

@johanot
Copy link
Copy Markdown
Contributor Author

johanot commented Sep 4, 2018

@terinjokes Poking blindly here, but I would be very grateful if you or one of your colleagues could take a look at this PR and tell me whether it makes sense? :) We would like to include certmgr 1.6.1 (with this patch) in the upstream NixOS Kubernetes module.

@johanot
Copy link
Copy Markdown
Contributor Author

johanot commented Sep 24, 2018

@kisom @terinjokes Re-ping -> one month after PR creation.

cert/cert.go Outdated
func (ca *CA) getRemoteCert() ([]byte, error) {
remote := client.NewServer(ca.Remote)
var tlsConfig tls.Config
if len(ca.RootCACert) > 0 {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For consistency with other checks in this file (eg, AuthKeyFile), we might want to compare against an empty string, rather than a length check.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @terinjokes.

Fixed in 519f8db .. Will squash if you approve. Any other comments to the functionality in general? It does make sense to implement support for self-signed certs on cfssl-apiserver this way right?

@johanot
Copy link
Copy Markdown
Contributor Author

johanot commented Oct 26, 2018

@terinjokes @kisom Is this something you will consider merging at some point, or is it just too far from the the core principals of certmgr? We've discussed in the NixOS kubernetes community whether to fork certmgr to be able to use self-signed certs with cfssl, or to build a new cfssl client; but I genuinely think that would be sad. I very much prefer to hear some sort of opinion from you on this, so that we can decide on whether to stick with upstream certmgr as cfssl client or not. Thanks a lot. :)

@adamtulinius
Copy link
Copy Markdown

@terinjokes @kisom Any updates on this?

@kisom
Copy link
Copy Markdown
Contributor

kisom commented Nov 16, 2018

@johanot @adamtulinius I'm no longer at Cloudflare and don't have access to this repo anymore :).

cert/cert.go Outdated
}
}

remote := client.NewServerTLS(ca.Remote, &tlsConfig)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unless I'm missing something, this code change will result in an empty/zero initialized struct being passed for tlsConfig- rather than nil; does the consuming code make a difference in that regard?

More specifically, I want to confirm that these changes won't break the existing pathway, and tests don't exist so it's hard to evaluate this as a drive by reviewer.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ferringb You're right. Changed the tlsConfig var to be a pointer instead: aa36ac4 ... nil should be supported by the cfssl client lib. (https://github.com/cloudflare/cfssl/blob/master/api/client/client.go#L138)

Copy link
Copy Markdown
Contributor

@ferringb ferringb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The README.md should be updated w/ documentation for this new feature

@johanot
Copy link
Copy Markdown
Contributor Author

johanot commented Jan 30, 2019

@ferringb Is this sufficient docs? 55c595a

@ferringb
Copy link
Copy Markdown
Contributor

@johanot it is- pardon the delay in follow up.

@ferringb ferringb merged commit a88efd2 into cloudflare:master Jun 12, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants