mirror of https://github.com/helm/helm
Austin Abro
7 months ago
commit
fc10174fa0
@ -1,58 +0,0 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package tlsutil
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"os"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
// Options represents configurable options used to create client and server TLS configurations.
|
||||
type Options struct {
|
||||
CaCertFile string
|
||||
// If either the KeyFile or CertFile is empty, ClientConfig() will not load them.
|
||||
KeyFile string
|
||||
CertFile string
|
||||
// Client-only options
|
||||
InsecureSkipVerify bool
|
||||
}
|
||||
|
||||
// ClientConfig returns a TLS configuration for use by a Helm client.
|
||||
func ClientConfig(opts Options) (cfg *tls.Config, err error) {
|
||||
var cert *tls.Certificate
|
||||
var pool *x509.CertPool
|
||||
|
||||
if opts.CertFile != "" || opts.KeyFile != "" {
|
||||
if cert, err = CertFromFilePair(opts.CertFile, opts.KeyFile); err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
return nil, errors.Wrapf(err, "could not load x509 key pair (cert: %q, key: %q)", opts.CertFile, opts.KeyFile)
|
||||
}
|
||||
return nil, errors.Wrapf(err, "could not read x509 key pair (cert: %q, key: %q)", opts.CertFile, opts.KeyFile)
|
||||
}
|
||||
}
|
||||
if !opts.InsecureSkipVerify && opts.CaCertFile != "" {
|
||||
if pool, err = CertPoolFromFile(opts.CaCertFile); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
cfg = &tls.Config{InsecureSkipVerify: opts.InsecureSkipVerify, Certificates: []tls.Certificate{*cert}, RootCAs: pool}
|
||||
return cfg, nil
|
||||
}
|
||||
@ -0,0 +1,105 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package tlsutil
|
||||
|
||||
import (
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
const tlsTestDir = "../../testdata"
|
||||
|
||||
const (
|
||||
testCaCertFile = "rootca.crt"
|
||||
testCertFile = "crt.pem"
|
||||
testKeyFile = "key.pem"
|
||||
)
|
||||
|
||||
func testfile(t *testing.T, file string) (path string) {
|
||||
var err error
|
||||
if path, err = filepath.Abs(filepath.Join(tlsTestDir, file)); err != nil {
|
||||
t.Fatalf("error getting absolute path to test file %q: %v", file, err)
|
||||
}
|
||||
return path
|
||||
}
|
||||
|
||||
func TestNewTLSConfig(t *testing.T) {
|
||||
certFile := testfile(t, testCertFile)
|
||||
keyFile := testfile(t, testKeyFile)
|
||||
caCertFile := testfile(t, testCaCertFile)
|
||||
insecureSkipTLSverify := false
|
||||
|
||||
{
|
||||
cfg, err := NewTLSConfig(
|
||||
WithInsecureSkipVerify(insecureSkipTLSverify),
|
||||
WithCertKeyPairFiles(certFile, keyFile),
|
||||
WithCAFile(caCertFile),
|
||||
)
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
|
||||
if got := len(cfg.Certificates); got != 1 {
|
||||
t.Fatalf("expecting 1 client certificates, got %d", got)
|
||||
}
|
||||
if cfg.InsecureSkipVerify {
|
||||
t.Fatalf("insecure skip verify mismatch, expecting false")
|
||||
}
|
||||
if cfg.RootCAs == nil {
|
||||
t.Fatalf("mismatch tls RootCAs, expecting non-nil")
|
||||
}
|
||||
}
|
||||
{
|
||||
cfg, err := NewTLSConfig(
|
||||
WithInsecureSkipVerify(insecureSkipTLSverify),
|
||||
WithCAFile(caCertFile),
|
||||
)
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
|
||||
if got := len(cfg.Certificates); got != 0 {
|
||||
t.Fatalf("expecting 0 client certificates, got %d", got)
|
||||
}
|
||||
if cfg.InsecureSkipVerify {
|
||||
t.Fatalf("insecure skip verify mismatch, expecting false")
|
||||
}
|
||||
if cfg.RootCAs == nil {
|
||||
t.Fatalf("mismatch tls RootCAs, expecting non-nil")
|
||||
}
|
||||
}
|
||||
|
||||
{
|
||||
cfg, err := NewTLSConfig(
|
||||
WithInsecureSkipVerify(insecureSkipTLSverify),
|
||||
WithCertKeyPairFiles(certFile, keyFile),
|
||||
)
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
|
||||
if got := len(cfg.Certificates); got != 1 {
|
||||
t.Fatalf("expecting 1 client certificates, got %d", got)
|
||||
}
|
||||
if cfg.InsecureSkipVerify {
|
||||
t.Fatalf("insecure skip verify mismatch, expecting false")
|
||||
}
|
||||
if cfg.RootCAs != nil {
|
||||
t.Fatalf("mismatch tls RootCAs, expecting nil")
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,114 +0,0 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package tlsutil
|
||||
|
||||
import (
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
const tlsTestDir = "../../testdata"
|
||||
|
||||
const (
|
||||
testCaCertFile = "rootca.crt"
|
||||
testCertFile = "crt.pem"
|
||||
testKeyFile = "key.pem"
|
||||
)
|
||||
|
||||
func TestClientConfig(t *testing.T) {
|
||||
opts := Options{
|
||||
CaCertFile: testfile(t, testCaCertFile),
|
||||
CertFile: testfile(t, testCertFile),
|
||||
KeyFile: testfile(t, testKeyFile),
|
||||
InsecureSkipVerify: false,
|
||||
}
|
||||
|
||||
cfg, err := ClientConfig(opts)
|
||||
if err != nil {
|
||||
t.Fatalf("error building tls client config: %v", err)
|
||||
}
|
||||
|
||||
if got := len(cfg.Certificates); got != 1 {
|
||||
t.Fatalf("expecting 1 client certificates, got %d", got)
|
||||
}
|
||||
if cfg.InsecureSkipVerify {
|
||||
t.Fatalf("insecure skip verify mismatch, expecting false")
|
||||
}
|
||||
if cfg.RootCAs == nil {
|
||||
t.Fatalf("mismatch tls RootCAs, expecting non-nil")
|
||||
}
|
||||
}
|
||||
|
||||
func testfile(t *testing.T, file string) (path string) {
|
||||
var err error
|
||||
if path, err = filepath.Abs(filepath.Join(tlsTestDir, file)); err != nil {
|
||||
t.Fatalf("error getting absolute path to test file %q: %v", file, err)
|
||||
}
|
||||
return path
|
||||
}
|
||||
|
||||
func TestNewClientTLS(t *testing.T) {
|
||||
certFile := testfile(t, testCertFile)
|
||||
keyFile := testfile(t, testKeyFile)
|
||||
caCertFile := testfile(t, testCaCertFile)
|
||||
insecureSkipTLSverify := false
|
||||
|
||||
cfg, err := NewClientTLS(certFile, keyFile, caCertFile, insecureSkipTLSverify)
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
|
||||
if got := len(cfg.Certificates); got != 1 {
|
||||
t.Fatalf("expecting 1 client certificates, got %d", got)
|
||||
}
|
||||
if cfg.InsecureSkipVerify {
|
||||
t.Fatalf("insecure skip verify mismatch, expecting false")
|
||||
}
|
||||
if cfg.RootCAs == nil {
|
||||
t.Fatalf("mismatch tls RootCAs, expecting non-nil")
|
||||
}
|
||||
|
||||
cfg, err = NewClientTLS("", "", caCertFile, insecureSkipTLSverify)
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
|
||||
if got := len(cfg.Certificates); got != 0 {
|
||||
t.Fatalf("expecting 0 client certificates, got %d", got)
|
||||
}
|
||||
if cfg.InsecureSkipVerify {
|
||||
t.Fatalf("insecure skip verify mismatch, expecting false")
|
||||
}
|
||||
if cfg.RootCAs == nil {
|
||||
t.Fatalf("mismatch tls RootCAs, expecting non-nil")
|
||||
}
|
||||
|
||||
cfg, err = NewClientTLS(certFile, keyFile, "", insecureSkipTLSverify)
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
|
||||
if got := len(cfg.Certificates); got != 1 {
|
||||
t.Fatalf("expecting 1 client certificates, got %d", got)
|
||||
}
|
||||
if cfg.InsecureSkipVerify {
|
||||
t.Fatalf("insecure skip verify mismatch, expecting false")
|
||||
}
|
||||
if cfg.RootCAs != nil {
|
||||
t.Fatalf("mismatch tls RootCAs, expecting nil")
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,33 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package registry
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/containerd/containerd/remotes"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func TestNewClientResolverNotSupported(t *testing.T) {
|
||||
var r remotes.Resolver
|
||||
|
||||
client, err := NewClient(ClientOptResolver(r))
|
||||
require.Equal(t, err, errDeprecatedRemote)
|
||||
assert.Nil(t, client)
|
||||
}
|
||||
Loading…
Reference in new issue