|
1 | 1 | package k8s |
2 | 2 |
|
3 | 3 | import ( |
| 4 | + "crypto/x509" |
| 5 | + "encoding/pem" |
4 | 6 | "fmt" |
5 | 7 | "time" |
6 | 8 |
|
7 | 9 | "github.com/go-logr/logr" |
8 | 10 | "github.com/pmylund/go-cache" |
| 11 | + corev1 "k8s.io/api/core/v1" |
| 12 | + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" |
| 13 | + "k8s.io/apimachinery/pkg/runtime" |
9 | 14 | "k8s.io/apimachinery/pkg/types" |
10 | 15 |
|
11 | 16 | "github.com/jetstack/preflight/api" |
@@ -39,9 +44,141 @@ func logCacheUpdateFailure(log logr.Logger, obj interface{}, operation string) { |
39 | 44 | log.Error(err, "Cache update failure", "operation", operation) |
40 | 45 | } |
41 | 46 |
|
| 47 | +// cacheFilterFunction is a function that takes an object and returns true if the |
| 48 | +// object should not be added to the cache, false otherwise. |
| 49 | +// This can be used to filter out objects that are not relevant for the data gatherer. |
| 50 | +type cacheFilterFunction func(logr.Logger, interface{}) bool |
| 51 | + |
| 52 | +// IgnoreTLSSecretsContainingNonClientCertificates filters out all TLS secrets that do not |
| 53 | +// contain a client certificate in the `tls.crt` key. |
| 54 | +// Secrets are obtained by a DynamicClient, so they have type |
| 55 | +// *unstructured.Unstructured. |
| 56 | +func IgnoreTLSSecretsContainingNonClientCertificates(log logr.Logger, obj interface{}) bool { |
| 57 | + _, ok := obj.(cacheResource) |
| 58 | + if !ok { |
| 59 | + log.V(4).Info("Object is not a cacheResource", "type", fmt.Sprintf("%T", obj)) |
| 60 | + return false |
| 61 | + } |
| 62 | + // Check if the object is a Unstructured |
| 63 | + unstructuredObj, ok := obj.(*unstructured.Unstructured) |
| 64 | + if !ok { |
| 65 | + log.V(4).Info("Object is not a Unstructured", "type", fmt.Sprintf("%T", obj)) |
| 66 | + return false |
| 67 | + } |
| 68 | + |
| 69 | + // Check if the object is a Secret |
| 70 | + if unstructuredObj.GetKind() != "Secret" { |
| 71 | + log.V(4).Info("Object is not a Secret", "kind", unstructuredObj.GetKind()) |
| 72 | + return false |
| 73 | + } |
| 74 | + if unstructuredObj.GetAPIVersion() != "v1" { |
| 75 | + log.V(4).Info("Object is not a v1 Secret", "apiVersion", unstructuredObj.GetAPIVersion()) |
| 76 | + return false |
| 77 | + } |
| 78 | + secretType, found, err := unstructured.NestedString(unstructuredObj.Object, "type") |
| 79 | + if err != nil || !found || secretType != string(corev1.SecretTypeTLS) { |
| 80 | + log.V(4).Info("Object is not a TLS Secret", "type", secretType) |
| 81 | + return false |
| 82 | + } |
| 83 | + |
| 84 | + // Get the Secret data |
| 85 | + var secret corev1.Secret |
| 86 | + err = runtime.DefaultUnstructuredConverter.FromUnstructured(unstructuredObj.Object, &secret) |
| 87 | + if err != nil { |
| 88 | + log.V(4).Info("failed to convert Unstructured to Secret", "error", err.Error()) |
| 89 | + return true |
| 90 | + } |
| 91 | + |
| 92 | + // Check if the secret contains the `tls.crt` key |
| 93 | + data, found := secret.Data[corev1.TLSCertKey] |
| 94 | + if !found || len(data) == 0 { |
| 95 | + log.V(4).Info("TLS Secret does not contain tls.crt key") |
| 96 | + return true |
| 97 | + } |
| 98 | + |
| 99 | + // Try to parse the data as a PEM encoded X.509 certificate chain |
| 100 | + certs, err := parsePEMCertificateChain(data) |
| 101 | + if err != nil { |
| 102 | + log.V(4).Info("Failed to parse tls.crt as PEM encoded X.509 certificate chain", "error", err.Error()) |
| 103 | + return true |
| 104 | + } |
| 105 | + |
| 106 | + if len(certs) == 0 { |
| 107 | + log.V(4).Info("No certificates found in tls.crt") |
| 108 | + return true |
| 109 | + } |
| 110 | + |
| 111 | + // Check if the leaf certificate is a client certificate |
| 112 | + if isClientCertificate(certs[0]) { |
| 113 | + log.V(4).Info("TLS Secret contains a client certificate", "name", secret.Name, "namespace", secret.Namespace) |
| 114 | + return false |
| 115 | + } |
| 116 | + |
| 117 | + log.V(4).Info("TLS Secret does not contain a client certificate", "name", secret.Name, "namespace", secret.Namespace) |
| 118 | + return true |
| 119 | +} |
| 120 | + |
| 121 | +// isClientCertificate checks if the given certificate is a client certificate |
| 122 | +// by checking if it has the ClientAuth EKU. |
| 123 | +func isClientCertificate(cert *x509.Certificate) bool { |
| 124 | + if cert == nil { |
| 125 | + return false |
| 126 | + } |
| 127 | + // Check if the certificate has the ClientAuth EKU |
| 128 | + for _, eku := range cert.ExtKeyUsage { |
| 129 | + if eku == x509.ExtKeyUsageClientAuth { |
| 130 | + return true |
| 131 | + } |
| 132 | + } |
| 133 | + return false |
| 134 | +} |
| 135 | + |
| 136 | +// parsePEMCertificateChain parses a PEM encoded certificate chain and returns |
| 137 | +// a slice of x509.Certificate pointers. It returns an error if the data cannot |
| 138 | +// be parsed as a certificate chain. |
| 139 | +// The supplied data can contain multiple PEM blocks, the function will parse |
| 140 | +// all of them and return a slice of certificates. |
| 141 | +func parsePEMCertificateChain(data []byte) ([]*x509.Certificate, error) { |
| 142 | + // Parse the PEM encoded certificate chain |
| 143 | + var certs []*x509.Certificate |
| 144 | + var block *pem.Block |
| 145 | + rest := data |
| 146 | + for { |
| 147 | + block, rest = pem.Decode(rest) |
| 148 | + if block == nil { |
| 149 | + break |
| 150 | + } |
| 151 | + if block.Type != "CERTIFICATE" || len(block.Bytes) == 0 { |
| 152 | + continue |
| 153 | + } |
| 154 | + cert, err := x509.ParseCertificate(block.Bytes) |
| 155 | + if err != nil { |
| 156 | + return nil, fmt.Errorf("failed to parse certificate: %w", err) |
| 157 | + } |
| 158 | + certs = append(certs, cert) |
| 159 | + } |
| 160 | + if len(certs) == 0 { |
| 161 | + return nil, fmt.Errorf("no certificates found") |
| 162 | + } |
| 163 | + return certs, nil |
| 164 | +} |
| 165 | + |
42 | 166 | // onAdd handles the informer creation events, adding the created runtime.Object |
43 | 167 | // to the data gatherer's cache. The cache key is the uid of the object |
44 | | -func onAdd(log logr.Logger, obj interface{}, dgCache *cache.Cache) { |
| 168 | +// The object is wrapped in a GatheredResource struct. |
| 169 | +// If the object is already present in the cache, it gets replaced. |
| 170 | +// The cache key is the uid of the object |
| 171 | +// The supplied filter functions can be used to filter out objects that |
| 172 | +// should not be added to the cache. |
| 173 | +// If multiple filter functions are supplied, the object is filtered out |
| 174 | +// if any of the filter functions returns true. |
| 175 | +func onAdd(log logr.Logger, obj interface{}, dgCache *cache.Cache, filters ...cacheFilterFunction) { |
| 176 | + for _, filter := range filters { |
| 177 | + if filter != nil && filter(log, obj) { |
| 178 | + return |
| 179 | + } |
| 180 | + } |
| 181 | + |
45 | 182 | item, ok := obj.(cacheResource) |
46 | 183 | if ok { |
47 | 184 | cacheObject := &api.GatheredResource{ |
|
0 commit comments