Skip to content

Commit be674d6

Browse files
mr-milesmr-miles
authored
Correct annotations for certificates generated via vault intermediate CA (#1544)
* Add handling of intermediate CAs from vault * Add PKIRootPath to VaultTLSSpec * Tests for extra field
1 parent 62d64ca commit be674d6

File tree

4 files changed

+83
-9
lines changed

4 files changed

+83
-9
lines changed

Diff for: ‎api/v1beta1/rabbitmqcluster_types.go

+6
Original file line numberDiff line numberDiff line change
@@ -152,11 +152,17 @@ type VaultTLSSpec struct {
152152
// Specifies the requested IP Subject Alternative Names, in a comma-delimited list.
153153
// +optional
154154
IpSans string `json:"ipSans,omitempty"`
155+
// Specifies an optional path to retrieve the root CA from vault. Useful if certificates are issued by an intermediate CA
156+
// +optional
157+
PKIRootPath string `json:"pkiRootPath,omitempty"`
155158
}
156159

157160
func (spec *VaultSpec) TLSEnabled() bool {
158161
return spec.TLS.PKIIssuerPath != ""
159162
}
163+
func (spec *VaultSpec) RootCAEnabled() bool {
164+
return spec.TLS.PKIRootPath != ""
165+
}
160166
func (spec *VaultSpec) DefaultUserSecretEnabled() bool {
161167
return spec.DefaultUserPath != ""
162168
}

Diff for: ‎api/v1beta1/rabbitmqcluster_types_test.go

+25
Original file line numberDiff line numberDiff line change
@@ -427,6 +427,31 @@ var _ = Describe("RabbitmqCluster", func() {
427427
Expect(fetchedRabbit.VaultDefaultUserSecretEnabled()).To(BeFalse())
428428
Expect(fetchedRabbit.Spec.SecretBackend.Vault.DefaultUserSecretEnabled()).To(BeFalse())
429429
Expect(fetchedRabbit.VaultTLSEnabled()).To(BeTrue())
430+
Expect(fetchedRabbit.Spec.SecretBackend.Vault.RootCAEnabled()).To(BeFalse())
431+
Expect(fetchedRabbit.Spec.SecretBackend.Vault.TLSEnabled()).To(BeTrue())
432+
})
433+
})
434+
When("only TLS is configured and root CA path is specified", func() {
435+
It("sets vault configuration correctly", func() {
436+
rabbit := generateRabbitmqClusterObject("rabbit-vault-tls-ca")
437+
rabbit.Spec.SecretBackend.Vault = &VaultSpec{
438+
Role: "test-role",
439+
TLS: VaultTLSSpec{
440+
PKIIssuerPath: "pki/issue/hashicorp-com",
441+
PKIRootPath: "pki-root/certs/ca",
442+
},
443+
}
444+
Expect(k8sClient.Create(context.Background(), rabbit)).To(Succeed())
445+
fetchedRabbit := &RabbitmqCluster{}
446+
Expect(k8sClient.Get(context.Background(), getKey(rabbit), fetchedRabbit)).To(Succeed())
447+
448+
Expect(fetchedRabbit.Spec.SecretBackend.Vault.Role).To(Equal("test-role"))
449+
Expect(fetchedRabbit.Spec.SecretBackend.Vault.TLS.PKIRootPath).To(Equal("pki-root/certs/ca"))
450+
Expect(fetchedRabbit.VaultEnabled()).To(BeTrue())
451+
Expect(fetchedRabbit.VaultDefaultUserSecretEnabled()).To(BeFalse())
452+
Expect(fetchedRabbit.Spec.SecretBackend.Vault.DefaultUserSecretEnabled()).To(BeFalse())
453+
Expect(fetchedRabbit.VaultTLSEnabled()).To(BeTrue())
454+
Expect(fetchedRabbit.Spec.SecretBackend.Vault.RootCAEnabled()).To(BeTrue())
430455
Expect(fetchedRabbit.Spec.SecretBackend.Vault.TLSEnabled()).To(BeTrue())
431456
})
432457
})

Diff for: ‎internal/resource/statefulset.go

+31-5
Original file line numberDiff line numberDiff line change
@@ -860,15 +860,15 @@ default_pass = {{ .Data.data.password }}
860860
certDir := strings.TrimSuffix(tlsCertDir, "/")
861861
vaultAnnotations["vault.hashicorp.com/secret-volume-path-"+tlsCertFilename] = certDir
862862
vaultAnnotations["vault.hashicorp.com/agent-inject-secret-"+tlsCertFilename] = pathCert
863-
vaultAnnotations["vault.hashicorp.com/agent-inject-template-"+tlsCertFilename] = generateVaultTLSTemplate(commonName, altNames, vault, "certificate")
863+
vaultAnnotations["vault.hashicorp.com/agent-inject-template-"+tlsCertFilename] = generateVaultTLSCertificateTemplate(commonName, altNames, vault)
864864

865865
vaultAnnotations["vault.hashicorp.com/secret-volume-path-"+tlsKeyFilename] = certDir
866866
vaultAnnotations["vault.hashicorp.com/agent-inject-secret-"+tlsKeyFilename] = pathCert
867-
vaultAnnotations["vault.hashicorp.com/agent-inject-template-"+tlsKeyFilename] = generateVaultTLSTemplate(commonName, altNames, vault, "private_key")
867+
vaultAnnotations["vault.hashicorp.com/agent-inject-template-"+tlsKeyFilename] = generateVaultTLSTemplate(commonName, altNames, vault.TLS.PKIIssuerPath, vault.TLS.IpSans, "private_key")
868868

869869
vaultAnnotations["vault.hashicorp.com/secret-volume-path-"+caCertFilename] = certDir
870870
vaultAnnotations["vault.hashicorp.com/agent-inject-secret-"+caCertFilename] = pathCert
871-
vaultAnnotations["vault.hashicorp.com/agent-inject-template-"+caCertFilename] = generateVaultTLSTemplate(commonName, altNames, vault, "issuing_ca")
871+
vaultAnnotations["vault.hashicorp.com/agent-inject-template-"+caCertFilename] = generateVaultCATemplate(commonName, altNames, vault)
872872
}
873873

874874
return metadata.ReconcileAnnotations(currentAnnotations, vaultAnnotations, vault.Annotations)
@@ -883,11 +883,37 @@ func podHostNames(instance *rabbitmqv1beta1.RabbitmqCluster) string {
883883
return strings.TrimPrefix(altNames, ",")
884884
}
885885

886-
func generateVaultTLSTemplate(commonName, altNames string, vault *rabbitmqv1beta1.VaultSpec, tlsAttribute string) string {
886+
func generateVaultTLSTemplate(commonName, altNames string, vaultPath string, ipSans string, tlsAttribute string) string {
887887
return fmt.Sprintf(`
888888
{{- with secret "%s" "common_name=%s" "alt_names=%s" "ip_sans=%s" -}}
889889
{{ .Data.%s }}
890-
{{- end }}`, vault.TLS.PKIIssuerPath, commonName, altNames, vault.TLS.IpSans, tlsAttribute)
890+
{{- end }}`, vaultPath, commonName, altNames, ipSans, tlsAttribute)
891+
}
892+
893+
func generateVaultCATemplate(commonName, altNames string, vault *rabbitmqv1beta1.VaultSpec) string {
894+
if (vault.TLS.PKIRootPath == "") {
895+
return generateVaultTLSTemplate(commonName, altNames, vault.TLS.PKIIssuerPath, vault.TLS.IpSans, "issuing_ca")
896+
} else {
897+
return fmt.Sprintf(`
898+
{{- with secret "%s" -}}
899+
{{ .Data.certificate }}
900+
{{- end }}`, vault.TLS.PKIRootPath)
901+
}
902+
}
903+
904+
func generateVaultTLSCertificateTemplate(commonName, altNames string, vault *rabbitmqv1beta1.VaultSpec) string {
905+
return fmt.Sprintf(`
906+
{{- with secret "%s" "common_name=%s" "alt_names=%s" "ip_sans=%s" -}}
907+
{{ .Data.certificate }}
908+
{{- if .Data.ca_chain -}}
909+
{{- $lastintermediatecertindex := len .Data.ca_chain | subtract 1 -}}
910+
{{ range $index, $cacert := .Data.ca_chain }}
911+
{{ if (lt $index $lastintermediatecertindex) }}
912+
{{ $cacert }}
913+
{{ end }}
914+
{{ end }}
915+
{{- end -}}
916+
{{- end -}}`, vault.TLS.PKIIssuerPath, commonName, altNames, vault.TLS.IpSans)
891917
}
892918

893919
func (builder *StatefulSetBuilder) updateContainerPorts() []corev1.ContainerPort {

Diff for: ‎internal/resource/statefulset_test.go

+21-4
Original file line numberDiff line numberDiff line change
@@ -1100,7 +1100,15 @@ default_pass = {{ .Data.data.password }}
11001100
Expect(a).To(HaveKeyWithValue("vault.hashicorp.com/agent-inject-template-tls.crt", `
11011101
{{- with secret "pki/issue/vmware-com" "common_name=myrabbit.foo-namespace.svc" "alt_names=myrabbit-server-0.myrabbit-nodes.foo-namespace" "ip_sans=" -}}
11021102
{{ .Data.certificate }}
1103-
{{- end }}`))
1103+
{{- if .Data.ca_chain -}}
1104+
{{- $lastintermediatecertindex := len .Data.ca_chain | subtract 1 -}}
1105+
{{ range $index, $cacert := .Data.ca_chain }}
1106+
{{ if (lt $index $lastintermediatecertindex) }}
1107+
{{ $cacert }}
1108+
{{ end }}
1109+
{{ end }}
1110+
{{- end -}}
1111+
{{- end -}}`))
11041112
Expect(a).To(HaveKeyWithValue("vault.hashicorp.com/agent-inject-template-tls.key", `
11051113
{{- with secret "pki/issue/vmware-com" "common_name=myrabbit.foo-namespace.svc" "alt_names=myrabbit-server-0.myrabbit-nodes.foo-namespace" "ip_sans=" -}}
11061114
{{ .Data.private_key }}
@@ -1116,6 +1124,7 @@ default_pass = {{ .Data.data.password }}
11161124
instance.Spec.SecretBackend.Vault.TLS.CommonName = "myrabbit.com"
11171125
instance.Spec.SecretBackend.Vault.TLS.AltNames = "alt1,alt2"
11181126
instance.Spec.SecretBackend.Vault.TLS.IpSans = "9.9.9.9"
1127+
instance.Spec.SecretBackend.Vault.TLS.PKIRootPath = "pki-root/certs/ca"
11191128
Expect(stsBuilder.Update(statefulSet)).To(Succeed())
11201129
})
11211130

@@ -1124,14 +1133,22 @@ default_pass = {{ .Data.data.password }}
11241133
Expect(a).To(HaveKeyWithValue("vault.hashicorp.com/agent-inject-template-tls.crt", `
11251134
{{- with secret "pki/issue/vmware-com" "common_name=myrabbit.com" "alt_names=myrabbit-server-0.myrabbit-nodes.foo-namespace,alt1,alt2" "ip_sans=9.9.9.9" -}}
11261135
{{ .Data.certificate }}
1127-
{{- end }}`))
1136+
{{- if .Data.ca_chain -}}
1137+
{{- $lastintermediatecertindex := len .Data.ca_chain | subtract 1 -}}
1138+
{{ range $index, $cacert := .Data.ca_chain }}
1139+
{{ if (lt $index $lastintermediatecertindex) }}
1140+
{{ $cacert }}
1141+
{{ end }}
1142+
{{ end }}
1143+
{{- end -}}
1144+
{{- end -}}`))
11281145
Expect(a).To(HaveKeyWithValue("vault.hashicorp.com/agent-inject-template-tls.key", `
11291146
{{- with secret "pki/issue/vmware-com" "common_name=myrabbit.com" "alt_names=myrabbit-server-0.myrabbit-nodes.foo-namespace,alt1,alt2" "ip_sans=9.9.9.9" -}}
11301147
{{ .Data.private_key }}
11311148
{{- end }}`))
11321149
Expect(a).To(HaveKeyWithValue("vault.hashicorp.com/agent-inject-template-ca.crt", `
1133-
{{- with secret "pki/issue/vmware-com" "common_name=myrabbit.com" "alt_names=myrabbit-server-0.myrabbit-nodes.foo-namespace,alt1,alt2" "ip_sans=9.9.9.9" -}}
1134-
{{ .Data.issuing_ca }}
1150+
{{- with secret "pki-root/certs/ca" -}}
1151+
{{ .Data.certificate }}
11351152
{{- end }}`))
11361153
})
11371154
})

0 commit comments

Comments
 (0)