Merge pull request #1656 from rksharma95/fix-certloader-bug

fix(cert): read ca crt file only with externalcertloader

KubeArmor/cert/cert.go

@@ -46,14 +46,16 @@ var DefaultKubeArmorClientConfig = CertConfig{
 var DefaultKubeArmorCAConfig = CertConfig{
 	CN:           KubeArmor_CN,
 	Organization: KubeArmor_ORG,
-	KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+	IsCa:         true,
+	KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
 }
 
 type CertConfig struct {
 	CN           string // Common Name
 	Organization string
 	DNS          []string
 	IPs          []string
+	IsCa         bool
 	KeyUsage     x509.KeyUsage
 	ExtKeyUsage  []x509.ExtKeyUsage
 	NotAfter     time.Time
@@ -200,8 +202,10 @@ func GenerateCert(cfg *CertConfig) (*CertKeyPair, error) {
 		NotAfter:              cfg.NotAfter,
 		KeyUsage:              cfg.KeyUsage,
 		ExtKeyUsage:           cfg.ExtKeyUsage,
+		IsCA:                  cfg.IsCa,
 		BasicConstraintsValid: true,
 	}
+	template.DNSNames = append(template.DNSNames, cfg.DNS...)
 
 	for _, ip := range cfg.IPs {
 		template.IPAddresses = append(template.IPAddresses, net.ParseIP(ip))

KubeArmor/cert/certloader.go

@@ -7,6 +7,7 @@ package cert
 import (
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/pem"
 
 	"k8s.io/client-go/kubernetes"
 )
@@ -58,12 +59,13 @@ func (loader *ExternalCertLoader) GetCertificateAndCaPool() (*tls.Certificate, *
 	if err != nil {
 		return nil, nil, err
 	}
-	caCert, err := GetCertKeyPairFromCertBytes(caCertBytes)
+	caCertPem, _ := pem.Decode(caCertBytes.Crt)
+	caCert, err := x509.ParseCertificate(caCertPem.Bytes)
 	if err != nil {
 		return nil, nil, err
 	}
 	caCertPool := x509.NewCertPool()
-	caCertPool.AddCert(caCert.Crt)
+	caCertPool.AddCert(caCert)
 	// load server/client certificate from cert path
 	certBytes, err := ReadCertFromFile(&loader.CertPath)
 	if err != nil {