gitrepo: add support for specifying CA data via `ca.crt`
Check the auth secret for the `ca.crt` key for CA certificate data. `ca.crt` takes precdence over `caFile`. Signed-off-by: Sanskar Jaiswal <jaiswalsanskar078@gmail.com>
This commit is contained in:
parent
6fe3c96311
commit
2a7f67de48
|
|
@ -161,8 +161,9 @@ data:
|
||||||
#### HTTPS Certificate Authority
|
#### HTTPS Certificate Authority
|
||||||
|
|
||||||
To provide a Certificate Authority to trust while connecting with a Git
|
To provide a Certificate Authority to trust while connecting with a Git
|
||||||
repository over HTTPS, the referenced Secret can contain a `.data.caFile`
|
repository over HTTPS, the referenced Secret's `.data` can contain a `ca.crt`
|
||||||
value.
|
or `caFile` key. `ca.crt` takes precedence over `caFile`, i.e. if both keys
|
||||||
|
are present, the value of `ca.crt` will be taken into consideration.
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
---
|
---
|
||||||
|
|
@ -173,7 +174,7 @@ metadata:
|
||||||
namespace: default
|
namespace: default
|
||||||
type: Opaque
|
type: Opaque
|
||||||
data:
|
data:
|
||||||
caFile: <BASE64>
|
ca.crt: <BASE64>
|
||||||
```
|
```
|
||||||
|
|
||||||
#### SSH authentication
|
#### SSH authentication
|
||||||
|
|
|
||||||
|
|
@ -410,6 +410,32 @@ func TestGitRepositoryReconciler_reconcileSource_authStrategy(t *testing.T) {
|
||||||
*conditions.UnknownCondition(meta.ReadyCondition, meta.ProgressingReason, "building artifact: new upstream revision 'master@sha1:<commit>'"),
|
*conditions.UnknownCondition(meta.ReadyCondition, meta.ProgressingReason, "building artifact: new upstream revision 'master@sha1:<commit>'"),
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
name: "HTTPS with CAFile secret with both ca.crt and caFile keys makes Reconciling=True and ignores caFile",
|
||||||
|
protocol: "https",
|
||||||
|
server: options{
|
||||||
|
publicKey: tlsPublicKey,
|
||||||
|
privateKey: tlsPrivateKey,
|
||||||
|
ca: tlsCA,
|
||||||
|
},
|
||||||
|
secret: &corev1.Secret{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "ca-file",
|
||||||
|
},
|
||||||
|
Data: map[string][]byte{
|
||||||
|
"ca.crt": tlsCA,
|
||||||
|
"caFile": []byte("invalid"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
beforeFunc: func(obj *sourcev1.GitRepository) {
|
||||||
|
obj.Spec.SecretRef = &meta.LocalObjectReference{Name: "ca-file"}
|
||||||
|
},
|
||||||
|
want: sreconcile.ResultSuccess,
|
||||||
|
assertConditions: []metav1.Condition{
|
||||||
|
*conditions.TrueCondition(meta.ReconcilingCondition, meta.ProgressingReason, "building artifact: new upstream revision 'master@sha1:<commit>'"),
|
||||||
|
*conditions.UnknownCondition(meta.ReadyCondition, meta.ProgressingReason, "building artifact: new upstream revision 'master@sha1:<commit>'"),
|
||||||
|
},
|
||||||
|
},
|
||||||
{
|
{
|
||||||
name: "HTTPS with invalid CAFile secret makes CheckoutFailed=True and returns error",
|
name: "HTTPS with invalid CAFile secret makes CheckoutFailed=True and returns error",
|
||||||
protocol: "https",
|
protocol: "https",
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue