Validate server cert against ca cert for registry mirror #2414
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
eks-distro-bot
added
the
size/L
vivek-koppuru
force-pushed
the
cert-verify
branch
from
491bd4e to
8b48486
Compare
Codecov Report
@@ Coverage Diff @@
## main #2414 +/- ##
==========================================
+ Coverage 56.94% 56.96% +0.02%
==========================================
Files 306 306
Lines 24844 24868 +24
==========================================
+ Hits 14147 14166 +19
- Misses 9399 9400 +1
- Partials 1298 1302 +4
Continue to review full report at Codecov.
|
vivek-koppuru
force-pushed
the
cert-verify
branch
from
8b48486 to
09ceba7
Compare
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: vivek-koppuru The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
g-gaston
reviewed
Jun 16, 2022
vivek-koppuru
force-pushed
the
cert-verify
branch
2 times, most recently
from
6696369 to
85c36ad
Compare
vivek-koppuru
force-pushed
the
cert-verify
branch
6 times, most recently
from
611b6da to
769b0a6
Compare
vivek-koppuru
force-pushed
the
cert-verify
branch
from
769b0a6 to
ac87715
Compare
g-gaston
approved these changes
Jun 17, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue #, if available:
#1857
Description of changes:
As described in the issue above, we weren't checking for the validity of the cert if the caCert passed in is not the self-signed server cert instead. This allows for checking the validity of the cert against the server itself instead of just checking for whether the cert is valid without actually making a call to the server. Also modified the unit tests to spin up a test http server to test the cert setup.
Testing (if applicable):
Ran against ci registry mirror configuration and another public one
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.