-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[certificates]: validate that certs are valid for a Gitpod install
- Loading branch information
Simon Emms
committed
Sep 30, 2022
1 parent
03cbf0e
commit b5d0e49
Showing
6 changed files
with
153 additions
and
0 deletions.
There are no files selected for viewing
Validating CODEOWNERS rules …
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| packages: | ||
| - name: docker | ||
| type: docker | ||
| argdeps: | ||
| - imageRepoBase | ||
| srcs: | ||
| - entrypoint.sh | ||
| config: | ||
| dockerfile: leeway.Dockerfile | ||
| metadata: | ||
| helm-component: kots-config-check.certificate | ||
| image: | ||
| - ${imageRepoBase}/kots-config-check/certificate:${version} | ||
| - ${imageRepoBase}/kots-config-check/certificate:commit-${__git_commit} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| #!/bin/bash | ||
| # Copyright (c) 2022 Gitpod GmbH. All rights reserved. | ||
| # Licensed under the GNU Affero General Public License (AGPL). | ||
| # See License-AGPL.txt in the project root for license information. | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| DOMAIN="${1:-""}" | ||
| NAMESPACE="${2:-""}" | ||
| SECRET_NAME="${3:-""}" | ||
| TLS_CRT_KEY="${4:-"tls.crt"}" | ||
|
|
||
| cert_exists="false" | ||
| domain="false" | ||
| in_date="false" | ||
|
|
||
| CRT_FILE="/tmp/tls.crt" | ||
| CRT_CONTENTS_FILE="/tmp/tls.txt" | ||
|
|
||
| function get_cert() { | ||
| # Get certificate from secret | ||
| kubectl get secret \ | ||
| -n "${NAMESPACE}" \ | ||
| "${SECRET_NAME}" \ | ||
| -o jsonpath="{.data.${TLS_CRT_KEY//./\\.}}" \ | ||
| | base64 -d \ | ||
| > "${CRT_FILE}" | ||
|
|
||
| # Decode it as an x509 certificate | ||
| openssl x509 -in "${CRT_FILE}" -text -noout > "${CRT_CONTENTS_FILE}" | ||
| } | ||
|
|
||
| function cert_matches_domain_name() { | ||
| grep "${DOMAIN}" "${CRT_CONTENTS_FILE}" || return 1 | ||
| grep "\*.${DOMAIN}" "${CRT_CONTENTS_FILE}" || return 2 | ||
| grep "\*.ws.${DOMAIN}" "${CRT_CONTENTS_FILE}" || return 3 | ||
| } | ||
|
|
||
| function cert_in_date() { | ||
| DATES="$(openssl x509 -in "${CRT_FILE}" -noout -dates)" | ||
|
|
||
| START_DATE="$(echo "${DATES}" | awk -F= '{a[$1]=$2} END {print(a["notBefore"])}')" | ||
| END_DATE="$(echo "${DATES}" | awk -F= '{a[$1]=$2} END {print(a["notAfter"])}')" | ||
|
|
||
| echo "Certificate start date: ${START_DATE}" | ||
| echo "Certificate end date: ${END_DATE}" | ||
|
|
||
| START_EPOCH="$(date -u -D "%b %e %H:%M:%S %Y" -d "${START_DATE}" "+%s")" | ||
| END_EPOCH="$(date -u -D "%b %e %H:%M:%S %Y" -d "${END_DATE}" "+%s")" | ||
| NOW_EPOCH="$(date "+%s")" | ||
|
|
||
| if [ "${NOW_EPOCH}" -gt "${START_EPOCH}" ] && [ "${NOW_EPOCH}" -lt "${END_EPOCH}" ]; then | ||
| echo "Certificate is in date" | ||
| return 0 | ||
| fi | ||
|
|
||
| return 1 | ||
| } | ||
|
|
||
| if get_cert; then | ||
| cert_exists="true" | ||
|
|
||
| if cert_matches_domain_name; then | ||
| domain="true" | ||
| fi | ||
|
|
||
| if cert_in_date; then | ||
| in_date="true" | ||
| fi | ||
| fi | ||
|
|
||
| if [ "${cert_exists}" = "true" ]; then | ||
| echo "cert_exists: ok" | ||
| else | ||
| echo "cert_exists: error" | ||
| fi | ||
|
|
||
| if [ "${domain}" = "true" ]; then | ||
| echo "domain_name: ok" | ||
| else | ||
| echo "domain_name: error" | ||
| fi | ||
|
|
||
| if [ "${in_date}" = "true" ]; then | ||
| echo "in_date: ok" | ||
| else | ||
| echo "in_date: error" | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| # Copyright (c) 2022 Gitpod GmbH. All rights reserved. | ||
| # Licensed under the GNU Affero General Public License (AGPL). | ||
| # See License-AGPL.txt in the project root for license information. | ||
|
|
||
| FROM alpine/openssl | ||
| COPY --from=bitnami/kubectl /opt/bitnami/kubectl/bin/kubectl /usr/local/bin/kubectl | ||
| COPY entrypoint.sh /entrypoint.sh | ||
| RUN apk add --no-cache bash | ||
| ENTRYPOINT [ "/entrypoint.sh" ] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters