Skip to content

Commit

Permalink
certgraphanalysis: add more locations for CA locations
Browse files Browse the repository at this point in the history
  CAs can be stored in a variety of keys. This commits adds more
  common used configmap key names for CAs
  • Loading branch information
vrutkovs committed Oct 9, 2024
1 parent 5964764 commit cbe9e01
Showing 1 changed file with 24 additions and 2 deletions.
26 changes: 24 additions & 2 deletions pkg/certs/cert-inspection/certgraphanalysis/analyzer.go
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package certgraphanalysis

import (
"fmt"
"slices"

"github.com/openshift/library-go/pkg/certs/cert-inspection/certgraphapi"
certificatesv1 "k8s.io/api/certificates/v1"
Expand All @@ -13,6 +14,16 @@ import (
"k8s.io/client-go/util/cert"
)

var caBundleKeys = []string{
"ca-bundle.crt",
"client-ca-file",
"client-ca.crt",
"metrics-ca-bundle.crt",
"requestheader-client-ca-file",
"image-registry.openshift-image-registry.svc..5000",
"image-registry.openshift-image-registry.svc.cluster.local..5000",
}

func InspectSecret(obj *corev1.Secret) ([]*certgraphapi.CertKeyPair, error) {
tlsCrt, isTLS := obj.Data["tls.crt"]
if !isTLS || len(tlsCrt) == 0 {
Expand Down Expand Up @@ -60,8 +71,19 @@ func InspectConfigMap(obj *corev1.ConfigMap) (*certgraphapi.CertificateAuthority
return details, nil
}

caBundle, ok := obj.Data["ca-bundle.crt"]
if !ok || len(caBundle) == 0 {
var caBundle string
for key := range obj.Data {
if !slices.Contains(caBundleKeys, key) {
continue
}
value, ok := obj.Data[key]
if ok && len(value) > 0 {
caBundle = value
break
}
}

if len(caBundle) == 0 {
return nil, nil
}

Expand Down

0 comments on commit cbe9e01

Please sign in to comment.