mirror of https://github.com/helm/helm
Austin Abro
8 months ago
commit
fc10174fa0
@ -1,58 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright The Helm Authors.
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package tlsutil
|
|
||||||
|
|
||||||
import (
|
|
||||||
"crypto/tls"
|
|
||||||
"crypto/x509"
|
|
||||||
"os"
|
|
||||||
|
|
||||||
"github.com/pkg/errors"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Options represents configurable options used to create client and server TLS configurations.
|
|
||||||
type Options struct {
|
|
||||||
CaCertFile string
|
|
||||||
// If either the KeyFile or CertFile is empty, ClientConfig() will not load them.
|
|
||||||
KeyFile string
|
|
||||||
CertFile string
|
|
||||||
// Client-only options
|
|
||||||
InsecureSkipVerify bool
|
|
||||||
}
|
|
||||||
|
|
||||||
// ClientConfig returns a TLS configuration for use by a Helm client.
|
|
||||||
func ClientConfig(opts Options) (cfg *tls.Config, err error) {
|
|
||||||
var cert *tls.Certificate
|
|
||||||
var pool *x509.CertPool
|
|
||||||
|
|
||||||
if opts.CertFile != "" || opts.KeyFile != "" {
|
|
||||||
if cert, err = CertFromFilePair(opts.CertFile, opts.KeyFile); err != nil {
|
|
||||||
if os.IsNotExist(err) {
|
|
||||||
return nil, errors.Wrapf(err, "could not load x509 key pair (cert: %q, key: %q)", opts.CertFile, opts.KeyFile)
|
|
||||||
}
|
|
||||||
return nil, errors.Wrapf(err, "could not read x509 key pair (cert: %q, key: %q)", opts.CertFile, opts.KeyFile)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if !opts.InsecureSkipVerify && opts.CaCertFile != "" {
|
|
||||||
if pool, err = CertPoolFromFile(opts.CaCertFile); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
cfg = &tls.Config{InsecureSkipVerify: opts.InsecureSkipVerify, Certificates: []tls.Certificate{*cert}, RootCAs: pool}
|
|
||||||
return cfg, nil
|
|
||||||
}
|
|
||||||
@ -0,0 +1,105 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package tlsutil
|
||||||
|
|
||||||
|
import (
|
||||||
|
"path/filepath"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
const tlsTestDir = "../../testdata"
|
||||||
|
|
||||||
|
const (
|
||||||
|
testCaCertFile = "rootca.crt"
|
||||||
|
testCertFile = "crt.pem"
|
||||||
|
testKeyFile = "key.pem"
|
||||||
|
)
|
||||||
|
|
||||||
|
func testfile(t *testing.T, file string) (path string) {
|
||||||
|
var err error
|
||||||
|
if path, err = filepath.Abs(filepath.Join(tlsTestDir, file)); err != nil {
|
||||||
|
t.Fatalf("error getting absolute path to test file %q: %v", file, err)
|
||||||
|
}
|
||||||
|
return path
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNewTLSConfig(t *testing.T) {
|
||||||
|
certFile := testfile(t, testCertFile)
|
||||||
|
keyFile := testfile(t, testKeyFile)
|
||||||
|
caCertFile := testfile(t, testCaCertFile)
|
||||||
|
insecureSkipTLSverify := false
|
||||||
|
|
||||||
|
{
|
||||||
|
cfg, err := NewTLSConfig(
|
||||||
|
WithInsecureSkipVerify(insecureSkipTLSverify),
|
||||||
|
WithCertKeyPairFiles(certFile, keyFile),
|
||||||
|
WithCAFile(caCertFile),
|
||||||
|
)
|
||||||
|
if err != nil {
|
||||||
|
t.Error(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if got := len(cfg.Certificates); got != 1 {
|
||||||
|
t.Fatalf("expecting 1 client certificates, got %d", got)
|
||||||
|
}
|
||||||
|
if cfg.InsecureSkipVerify {
|
||||||
|
t.Fatalf("insecure skip verify mismatch, expecting false")
|
||||||
|
}
|
||||||
|
if cfg.RootCAs == nil {
|
||||||
|
t.Fatalf("mismatch tls RootCAs, expecting non-nil")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
{
|
||||||
|
cfg, err := NewTLSConfig(
|
||||||
|
WithInsecureSkipVerify(insecureSkipTLSverify),
|
||||||
|
WithCAFile(caCertFile),
|
||||||
|
)
|
||||||
|
if err != nil {
|
||||||
|
t.Error(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if got := len(cfg.Certificates); got != 0 {
|
||||||
|
t.Fatalf("expecting 0 client certificates, got %d", got)
|
||||||
|
}
|
||||||
|
if cfg.InsecureSkipVerify {
|
||||||
|
t.Fatalf("insecure skip verify mismatch, expecting false")
|
||||||
|
}
|
||||||
|
if cfg.RootCAs == nil {
|
||||||
|
t.Fatalf("mismatch tls RootCAs, expecting non-nil")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
cfg, err := NewTLSConfig(
|
||||||
|
WithInsecureSkipVerify(insecureSkipTLSverify),
|
||||||
|
WithCertKeyPairFiles(certFile, keyFile),
|
||||||
|
)
|
||||||
|
if err != nil {
|
||||||
|
t.Error(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if got := len(cfg.Certificates); got != 1 {
|
||||||
|
t.Fatalf("expecting 1 client certificates, got %d", got)
|
||||||
|
}
|
||||||
|
if cfg.InsecureSkipVerify {
|
||||||
|
t.Fatalf("insecure skip verify mismatch, expecting false")
|
||||||
|
}
|
||||||
|
if cfg.RootCAs != nil {
|
||||||
|
t.Fatalf("mismatch tls RootCAs, expecting nil")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -1,114 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright The Helm Authors.
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package tlsutil
|
|
||||||
|
|
||||||
import (
|
|
||||||
"path/filepath"
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
const tlsTestDir = "../../testdata"
|
|
||||||
|
|
||||||
const (
|
|
||||||
testCaCertFile = "rootca.crt"
|
|
||||||
testCertFile = "crt.pem"
|
|
||||||
testKeyFile = "key.pem"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestClientConfig(t *testing.T) {
|
|
||||||
opts := Options{
|
|
||||||
CaCertFile: testfile(t, testCaCertFile),
|
|
||||||
CertFile: testfile(t, testCertFile),
|
|
||||||
KeyFile: testfile(t, testKeyFile),
|
|
||||||
InsecureSkipVerify: false,
|
|
||||||
}
|
|
||||||
|
|
||||||
cfg, err := ClientConfig(opts)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("error building tls client config: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if got := len(cfg.Certificates); got != 1 {
|
|
||||||
t.Fatalf("expecting 1 client certificates, got %d", got)
|
|
||||||
}
|
|
||||||
if cfg.InsecureSkipVerify {
|
|
||||||
t.Fatalf("insecure skip verify mismatch, expecting false")
|
|
||||||
}
|
|
||||||
if cfg.RootCAs == nil {
|
|
||||||
t.Fatalf("mismatch tls RootCAs, expecting non-nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func testfile(t *testing.T, file string) (path string) {
|
|
||||||
var err error
|
|
||||||
if path, err = filepath.Abs(filepath.Join(tlsTestDir, file)); err != nil {
|
|
||||||
t.Fatalf("error getting absolute path to test file %q: %v", file, err)
|
|
||||||
}
|
|
||||||
return path
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestNewClientTLS(t *testing.T) {
|
|
||||||
certFile := testfile(t, testCertFile)
|
|
||||||
keyFile := testfile(t, testKeyFile)
|
|
||||||
caCertFile := testfile(t, testCaCertFile)
|
|
||||||
insecureSkipTLSverify := false
|
|
||||||
|
|
||||||
cfg, err := NewClientTLS(certFile, keyFile, caCertFile, insecureSkipTLSverify)
|
|
||||||
if err != nil {
|
|
||||||
t.Error(err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if got := len(cfg.Certificates); got != 1 {
|
|
||||||
t.Fatalf("expecting 1 client certificates, got %d", got)
|
|
||||||
}
|
|
||||||
if cfg.InsecureSkipVerify {
|
|
||||||
t.Fatalf("insecure skip verify mismatch, expecting false")
|
|
||||||
}
|
|
||||||
if cfg.RootCAs == nil {
|
|
||||||
t.Fatalf("mismatch tls RootCAs, expecting non-nil")
|
|
||||||
}
|
|
||||||
|
|
||||||
cfg, err = NewClientTLS("", "", caCertFile, insecureSkipTLSverify)
|
|
||||||
if err != nil {
|
|
||||||
t.Error(err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if got := len(cfg.Certificates); got != 0 {
|
|
||||||
t.Fatalf("expecting 0 client certificates, got %d", got)
|
|
||||||
}
|
|
||||||
if cfg.InsecureSkipVerify {
|
|
||||||
t.Fatalf("insecure skip verify mismatch, expecting false")
|
|
||||||
}
|
|
||||||
if cfg.RootCAs == nil {
|
|
||||||
t.Fatalf("mismatch tls RootCAs, expecting non-nil")
|
|
||||||
}
|
|
||||||
|
|
||||||
cfg, err = NewClientTLS(certFile, keyFile, "", insecureSkipTLSverify)
|
|
||||||
if err != nil {
|
|
||||||
t.Error(err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if got := len(cfg.Certificates); got != 1 {
|
|
||||||
t.Fatalf("expecting 1 client certificates, got %d", got)
|
|
||||||
}
|
|
||||||
if cfg.InsecureSkipVerify {
|
|
||||||
t.Fatalf("insecure skip verify mismatch, expecting false")
|
|
||||||
}
|
|
||||||
if cfg.RootCAs != nil {
|
|
||||||
t.Fatalf("mismatch tls RootCAs, expecting nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -0,0 +1,33 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package registry
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/containerd/containerd/remotes"
|
||||||
|
"github.com/stretchr/testify/assert"
|
||||||
|
"github.com/stretchr/testify/require"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestNewClientResolverNotSupported(t *testing.T) {
|
||||||
|
var r remotes.Resolver
|
||||||
|
|
||||||
|
client, err := NewClient(ClientOptResolver(r))
|
||||||
|
require.Equal(t, err, errDeprecatedRemote)
|
||||||
|
assert.Nil(t, client)
|
||||||
|
}
|
||||||
Loading…
Reference in new issue