Skip to content

Commit 0aa142d

Browse files
rramkumar1rramkumar1
authored
Add library for generating self-signed cert (#453)
1 parent 5b82374 commit 0aa142d

File tree

3 files changed

+77
-105
lines changed

3 files changed

+77
-105
lines changed

‎internal/tls/tls.go

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tls
18+
19+
import (
20+
"crypto/rand"
21+
"crypto/rsa"
22+
"crypto/tls"
23+
"crypto/x509"
24+
"crypto/x509/pkix"
25+
"encoding/pem"
26+
"fmt"
27+
"math/big"
28+
"time"
29+
30+
"github.com/go-logr/logr"
31+
)
32+
33+
// CreateSelfSignedTLSCertificate creates a self-signed cert the server can use to serve TLS.
34+
func CreateSelfSignedTLSCertificate(logger logr.Logger) (tls.Certificate, error) {
35+
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
36+
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
37+
if err != nil {
38+
return tls.Certificate{}, fmt.Errorf("error creating serial number: %v", err)
39+
}
40+
now := time.Now()
41+
notBefore := now.UTC()
42+
template := x509.Certificate{
43+
SerialNumber: serialNumber,
44+
Subject: pkix.Name{
45+
Organization: []string{"Inference Ext"},
46+
},
47+
NotBefore: notBefore,
48+
NotAfter: now.Add(time.Hour * 24 * 365 * 10).UTC(), // 10 years
49+
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
50+
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
51+
BasicConstraintsValid: true,
52+
}
53+
54+
priv, err := rsa.GenerateKey(rand.Reader, 4096)
55+
if err != nil {
56+
return tls.Certificate{}, fmt.Errorf("error generating key: %v", err)
57+
}
58+
59+
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
60+
if err != nil {
61+
return tls.Certificate{}, fmt.Errorf("error creating certificate: %v", err)
62+
}
63+
64+
certBytes := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
65+
66+
privBytes, err := x509.MarshalPKCS8PrivateKey(priv)
67+
if err != nil {
68+
return tls.Certificate{}, fmt.Errorf("error marshalling private key: %v", err)
69+
}
70+
keyBytes := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
71+
72+
return tls.X509KeyPair(certBytes, keyBytes)
73+
}

‎pkg/body-based-routing/server/runserver.go

+2-53
Original file line numberDiff line numberDiff line change
@@ -18,21 +18,15 @@ package server
1818

1919
import (
2020
"context"
21-
"crypto/rand"
22-
"crypto/rsa"
2321
"crypto/tls"
24-
"crypto/x509"
25-
"crypto/x509/pkix"
26-
"encoding/pem"
27-
"math/big"
28-
"time"
2922

3023
extProcPb "github.com/envoyproxy/go-control-plane/envoy/service/ext_proc/v3"
3124
"github.com/go-logr/logr"
3225
"google.golang.org/grpc"
3326
"google.golang.org/grpc/credentials"
3427
"sigs.k8s.io/controller-runtime/pkg/manager"
3528
"sigs.k8s.io/gateway-api-inference-extension/internal/runnable"
29+
tlsutil "sigs.k8s.io/gateway-api-inference-extension/internal/tls"
3630
"sigs.k8s.io/gateway-api-inference-extension/pkg/body-based-routing/handlers"
3731
)
3832

@@ -56,7 +50,7 @@ func NewDefaultExtProcServerRunner() *ExtProcServerRunner {
5650
// The runnable implements LeaderElectionRunnable with leader election disabled.
5751
func (r *ExtProcServerRunner) AsRunnable(logger logr.Logger) manager.Runnable {
5852
return runnable.NoLeaderElection(manager.RunnableFunc(func(ctx context.Context) error {
59-
cert, err := createSelfSignedTLSCertificate(logger)
53+
cert, err := tlsutil.CreateSelfSignedTLSCertificate(logger)
6054
if err != nil {
6155
logger.Error(err, "Failed to create self signed certificate")
6256
return err
@@ -73,48 +67,3 @@ func (r *ExtProcServerRunner) AsRunnable(logger logr.Logger) manager.Runnable {
7367
return runnable.GRPCServer("ext-proc", srv, r.GrpcPort).Start(ctx)
7468
}))
7569
}
76-
77-
func createSelfSignedTLSCertificate(logger logr.Logger) (tls.Certificate, error) {
78-
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
79-
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
80-
if err != nil {
81-
logger.Error(err, "Failed to create serial number for self-signed cert")
82-
return tls.Certificate{}, err
83-
}
84-
now := time.Now()
85-
notBefore := now.UTC()
86-
template := x509.Certificate{
87-
SerialNumber: serialNumber,
88-
Subject: pkix.Name{
89-
Organization: []string{"Inference Ext"},
90-
},
91-
NotBefore: notBefore,
92-
NotAfter: now.Add(time.Hour * 24 * 365 * 10).UTC(), // 10 years
93-
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
94-
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
95-
BasicConstraintsValid: true,
96-
}
97-
98-
priv, err := rsa.GenerateKey(rand.Reader, 4096)
99-
if err != nil {
100-
logger.Error(err, "Failed to generate key for self-signed cert")
101-
return tls.Certificate{}, err
102-
}
103-
104-
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
105-
if err != nil {
106-
logger.Error(err, "Failed to create self-signed certificate")
107-
return tls.Certificate{}, err
108-
}
109-
110-
certBytes := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
111-
112-
privBytes, err := x509.MarshalPKCS8PrivateKey(priv)
113-
if err != nil {
114-
logger.Error(err, "Failed to marshal private key for self-signed certificate")
115-
return tls.Certificate{}, err
116-
}
117-
keyBytes := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
118-
119-
return tls.X509KeyPair(certBytes, keyBytes)
120-
}

‎pkg/epp/server/runserver.go

+2-52
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,8 @@ package server
1818

1919
import (
2020
"context"
21-
"crypto/rand"
22-
"crypto/rsa"
2321
"crypto/tls"
24-
"crypto/x509"
25-
"crypto/x509/pkix"
26-
"encoding/pem"
2722
"fmt"
28-
"math/big"
2923
"time"
3024

3125
extProcPb "github.com/envoyproxy/go-control-plane/envoy/service/ext_proc/v3"
@@ -36,6 +30,7 @@ import (
3630
ctrl "sigs.k8s.io/controller-runtime"
3731
"sigs.k8s.io/controller-runtime/pkg/manager"
3832
"sigs.k8s.io/gateway-api-inference-extension/internal/runnable"
33+
tlsutil "sigs.k8s.io/gateway-api-inference-extension/internal/tls"
3934
"sigs.k8s.io/gateway-api-inference-extension/pkg/epp/backend"
4035
"sigs.k8s.io/gateway-api-inference-extension/pkg/epp/controller"
4136
"sigs.k8s.io/gateway-api-inference-extension/pkg/epp/datastore"
@@ -139,7 +134,7 @@ func (r *ExtProcServerRunner) AsRunnable(logger logr.Logger) manager.Runnable {
139134
cert, err = tls.LoadX509KeyPair(r.CertPath+"/tls.crt", r.CertPath+"/tls.key")
140135
} else {
141136
// Create tls based credential.
142-
cert, err = createSelfSignedTLSCertificate(logger)
137+
cert, err = tlsutil.CreateSelfSignedTLSCertificate(logger)
143138
}
144139
if err != nil {
145140
logger.Error(err, "Failed to create self signed certificate")
@@ -163,48 +158,3 @@ func (r *ExtProcServerRunner) AsRunnable(logger logr.Logger) manager.Runnable {
163158
return runnable.GRPCServer("ext-proc", srv, r.GrpcPort).Start(ctx)
164159
}))
165160
}
166-
167-
func createSelfSignedTLSCertificate(logger logr.Logger) (tls.Certificate, error) {
168-
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
169-
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
170-
if err != nil {
171-
logger.Error(err, "Failed to create serial number for self-signed cert")
172-
return tls.Certificate{}, err
173-
}
174-
now := time.Now()
175-
notBefore := now.UTC()
176-
template := x509.Certificate{
177-
SerialNumber: serialNumber,
178-
Subject: pkix.Name{
179-
Organization: []string{"Inference Ext"},
180-
},
181-
NotBefore: notBefore,
182-
NotAfter: now.Add(time.Hour * 24 * 365 * 10).UTC(), // 10 years
183-
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
184-
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
185-
BasicConstraintsValid: true,
186-
}
187-
188-
priv, err := rsa.GenerateKey(rand.Reader, 4096)
189-
if err != nil {
190-
logger.Error(err, "Failed to generate key for self-signed cert")
191-
return tls.Certificate{}, err
192-
}
193-
194-
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
195-
if err != nil {
196-
logger.Error(err, "Failed to create self-signed certificate")
197-
return tls.Certificate{}, err
198-
}
199-
200-
certBytes := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
201-
202-
privBytes, err := x509.MarshalPKCS8PrivateKey(priv)
203-
if err != nil {
204-
logger.Error(err, "Failed to marshal private key for self-signed certificate")
205-
return tls.Certificate{}, err
206-
}
207-
keyBytes := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
208-
209-
return tls.X509KeyPair(certBytes, keyBytes)
210-
}

0 commit comments

Comments
 (0)