mirror of
https://github.com/GoogleContainerTools/kaniko
synced 2026-10-19 10:19:51 +02:00
Eric
7525828ef9
* Add mTLS (client cert) support Add support for Mutual TLS (mTLS) client certificate authentication. The expected format of the new --registry-client-cert flag is the same as the existing --registry-certificate flag, which will allow different client certificates for different registries: --registry-client-cert my.registry.url=/path/to/cert.crt,/path/to/key.key * tidy: Rename mTLS (Client Cert) flag to be in line with others This flag didn't describe that it was for the client certs uses with the registry. Although this should be reasonably obvious, I like the consistency with the other registry flag. * test: Added unit tests for mTLS (Client Cert) loading * test: Add 2 more tests for comma split formatting since the comma splitting is a new portion of code let's make sure that that format works well too in other cases * tidy: Fix formatting of flag help text * tidy: Made invalid cert format error consistent I was running the tests and saw the message: Failed to load client certificate/key '/path/to/client/certificate.cert' for my.registry.name, format is my.registry.name=/path/to/cert,/path/to/key I then realized that it'd be a lot nicer if this showed the user what they input, and how they should change it (rather than decomposing it: Failed to load client certificate/key 'my.registry.name=/path/to/client/certificate.cert', expected format: my.registry.name=/path/to/cert,/path/to/key * test: Fixed incorrect test argument This didn't fail the test before because it's only attempting to show that certs only get loaded and used for their associated registry but it's important to keep this correct. This case is covered by the test below, "RegistriesClientCertificates incorrect cert format" * doc: Add new flag to README.md * mod: Fail to push if there was a problem loading client certs Rather than warning that there was an issue, we should fail if the requested client certificates were not found or failed to load. This feels a lot better than waiting for the build to finish then failing later. * mod: Return an error if the certificate authority fails to load, just like client certs The MakeTransport function was changed in the previous commit to allow returning errors if there was a problem loading certificates, rather than just print warnings. This feels a lot better as you get the error immediately that there's a problem to fix, rather than getting a warning, then later an error that the server's certificate could not be verified. * tidy: fix golint issues
112 lines
3.1 KiB
Go
112 lines
3.1 KiB
Go
/*
|
|
Copyright 2020 Google LLC
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package util
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"io/ioutil"
|
|
"net/http"
|
|
|
|
"github.com/GoogleContainerTools/kaniko/pkg/config"
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
type CertPool interface {
|
|
value() *x509.CertPool
|
|
append(path string) error
|
|
}
|
|
|
|
type X509CertPool struct {
|
|
inner x509.CertPool
|
|
}
|
|
|
|
func (p *X509CertPool) value() *x509.CertPool {
|
|
return &p.inner
|
|
}
|
|
|
|
func (p *X509CertPool) append(path string) error {
|
|
pem, err := ioutil.ReadFile(path)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
p.inner.AppendCertsFromPEM(pem)
|
|
return nil
|
|
}
|
|
|
|
var systemCertLoader CertPool
|
|
|
|
type KeyPairLoader interface {
|
|
load(string, string) (tls.Certificate, error)
|
|
}
|
|
|
|
type X509KeyPairLoader struct {
|
|
}
|
|
|
|
func (p *X509KeyPairLoader) load(certFile, keyFile string) (tls.Certificate, error) {
|
|
return tls.LoadX509KeyPair(certFile, keyFile)
|
|
}
|
|
|
|
var systemKeyPairLoader KeyPairLoader
|
|
|
|
func init() {
|
|
systemCertPool, err := x509.SystemCertPool()
|
|
if err != nil {
|
|
logrus.Warn("Failed to load system cert pool. Loading empty one instead.")
|
|
systemCertPool = x509.NewCertPool()
|
|
}
|
|
systemCertLoader = &X509CertPool{
|
|
inner: *systemCertPool,
|
|
}
|
|
|
|
systemKeyPairLoader = &X509KeyPairLoader{}
|
|
}
|
|
|
|
func MakeTransport(opts config.RegistryOptions, registryName string) (http.RoundTripper, error) {
|
|
// Create a transport to set our user-agent.
|
|
var tr http.RoundTripper = http.DefaultTransport.(*http.Transport).Clone()
|
|
if opts.SkipTLSVerify || opts.SkipTLSVerifyRegistries.Contains(registryName) {
|
|
tr.(*http.Transport).TLSClientConfig = &tls.Config{
|
|
InsecureSkipVerify: true,
|
|
}
|
|
} else if certificatePath := opts.RegistriesCertificates[registryName]; certificatePath != "" {
|
|
if err := systemCertLoader.append(certificatePath); err != nil {
|
|
return nil, fmt.Errorf("failed to load certificate %s for %s: %w", certificatePath, registryName, err)
|
|
}
|
|
tr.(*http.Transport).TLSClientConfig = &tls.Config{
|
|
RootCAs: systemCertLoader.value(),
|
|
}
|
|
}
|
|
|
|
if clientCertificatePath := opts.RegistriesClientCertificates[registryName]; clientCertificatePath != "" {
|
|
certFiles := strings.Split(clientCertificatePath, ",")
|
|
if len(certFiles) != 2 {
|
|
return nil, fmt.Errorf("failed to load client certificate/key '%s=%s', expected format: %s=/path/to/cert,/path/to/key", registryName, clientCertificatePath, registryName)
|
|
}
|
|
cert, err := systemKeyPairLoader.load(certFiles[0], certFiles[1])
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to load client certificate/key '%s' for %s: %w", clientCertificatePath, registryName, err)
|
|
}
|
|
tr.(*http.Transport).TLSClientConfig.Certificates = []tls.Certificate{cert}
|
|
}
|
|
|
|
return tr, nil
|
|
}
|