Add support for custom upstream CAs #34

josefkarasek · 2019-02-12T21:51:09Z

No description provided.

s-urbaniak

@josefkarasek looking good so far, i have a few comments. Do you also mind to add a small unit test for the init method?

s-urbaniak · 2019-02-14T12:26:55Z

main.go

+
+	rootPEM, err := ioutil.ReadFile(upstreamCAFile)
+	if err != nil {
+		return nil, err


let's add some more context here, i.e. fmt.Errorf("error reading upstream CA file: %v", err).

s-urbaniak · 2019-02-14T12:28:00Z

main.go

+		MaxIdleConns:          100,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,


do you mind add a small comment from what Go version these default values are sourced from?

s-urbaniak · 2019-02-14T12:30:51Z

main.go

+
+	roots := x509.NewCertPool()
+	if ok := roots.AppendCertsFromPEM([]byte(rootPEM)); !ok {
+		return nil, err


this block doesn't have an err instance at hand, just an ok == false, if any certificates were not parsed successfully. I think this block needs an explicit return nil, errors.New("...").

s-urbaniak · 2019-02-14T12:33:01Z

main.go

+
+func initTransport(upstreamCAFile string) (http.RoundTripper, error) {
+	if upstreamCAFile == "" {
+		return nil, nil


if there is no upstream CA file here, we are returning nil here, which effectively uses the default transport later on. For brevity, and because this is an init method, let's return the default transport here to make it explicit.

josefkarasek · 2019-02-14T14:27:45Z

@josefkarasek looking good so far, i have a few comments. Do you also mind to add a small unit test for the init method?

@s-urbaniak Let's move it to a utils package first? Am thinking about unit testing package main.
main.go and main_test.go?

s-urbaniak · 2019-02-14T14:37:47Z

@josefkarasek it is not quite idiomatic to have general utils packages in golang. I'd rather, in this case, factor this single method in a single file transport.go and create a transport_test.go file here too, which implements the unit test. For simplicity, I'd leave this here in the main package.

squat · 2019-02-14T14:48:16Z

main.go

+		return nil, err
+	}
+
+	transport := &http.Transport{


Do we care about ALL of these settings or can we use the default transport and simply set the TLSClientConfig field?

Yes we care, they're set for a reason. You might run into troubles, eg run out of file descriptors etc.

@squat I misunderstood you.

We can use http.DefaultTransport direclty. I just wanted to be explicit, instead of changing types between http.RoundTripper and http.Transport.

But my understanding is that this would work:

transport := http.DefaultTransport.(*http.Transport) transport.TLSClientConfig = &tls.Config{RootCAs: roots} return transport, nil

s-urbaniak · 2019-02-14T16:43:54Z

transport_test.go

+func TestInitTransportWithDefault(t *testing.T) {
+	roundTripper, err := initTransport("")
+	if err != nil {
+		t.Errorf("initTransport(\"\") is legitimate. Should return http.DefaultTransport. But returned %v", err)


nit, a more idiomatic test failure would be:

t.Errorf("want err to be nil, but got %v", err)

If I understand the logic correctly, here we should return too?

s-urbaniak · 2019-02-14T16:45:24Z

transport_test.go

+	if err != nil {
+		t.Errorf("initTransport(\"\") is legitimate. Should return http.DefaultTransport. But returned %v", err)
+	}
+	if eq := reflect.DeepEqual(http.DefaultTransport, roundTripper); !eq {


I wouldn't deep equal with the stdlib one, I'd say

if roundTripper == nil { t.Errorf("expected roundtripper, got nil") }

s-urbaniak · 2019-02-14T16:45:53Z

transport_test.go

+func TestInitTransportWithCustomCA(t *testing.T) {
+	roundTripper, err := initTransport("test/ca.pem")
+	if err != nil {
+		t.Errorf("initTransport failed with: %v", err)


see above, also this should return from the test.

s-urbaniak · 2019-02-14T16:46:35Z

transport_test.go

+	}
+	transport := roundTripper.(*http.Transport)
+	if transport.TLSClientConfig.RootCAs == nil {
+		t.Error("custom CA cert want't applied")


t.Error("expected root CA to be set, got nil")

s-urbaniak · 2019-02-15T13:49:34Z

transport.go

+	}
+
+	transport := http.DefaultTransport.(*http.Transport)
+	transport.TLSClientConfig = &tls.Config{RootCAs: roots}


the previous version was better IMO. Here, you are modifying the runtime wide DefaultTransport which might have side effects.

oh crap it's a pointer... you're absolutely right

s-urbaniak

LGTM 👍

Update OWNERS file

s-urbaniak requested changes Feb 14, 2019

View reviewed changes

squat reviewed Feb 14, 2019

View reviewed changes

s-urbaniak reviewed Feb 14, 2019

View reviewed changes

josefkarasek force-pushed the upstream-ca-file branch from 49df7ed to a55a85a Compare February 14, 2019 17:09

s-urbaniak reviewed Feb 15, 2019

View reviewed changes

add support for custom upstream CAs

808ed5b

josefkarasek force-pushed the upstream-ca-file branch from a55a85a to 808ed5b Compare February 15, 2019 14:01

s-urbaniak approved these changes Feb 15, 2019

View reviewed changes

s-urbaniak merged commit 1ebcc7b into brancz:master Feb 15, 2019

brancz mentioned this pull request Feb 18, 2019

Add support for x-forwarded-for header #33

Closed

dgrisonnet pushed a commit to dgrisonnet/kube-rbac-proxy that referenced this pull request Dec 7, 2020

Merge pull request brancz#34 from dgrisonnet/update-owners

cb75b4d

Update OWNERS file

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for custom upstream CAs #34

Add support for custom upstream CAs #34

josefkarasek commented Feb 12, 2019

s-urbaniak left a comment

s-urbaniak Feb 14, 2019

s-urbaniak Feb 14, 2019

s-urbaniak Feb 14, 2019

s-urbaniak Feb 14, 2019

josefkarasek commented Feb 14, 2019

s-urbaniak commented Feb 14, 2019

squat Feb 14, 2019

josefkarasek Feb 14, 2019

josefkarasek Feb 14, 2019

s-urbaniak Feb 14, 2019

josefkarasek Feb 14, 2019

s-urbaniak Feb 14, 2019

s-urbaniak Feb 14, 2019

s-urbaniak Feb 14, 2019

s-urbaniak Feb 14, 2019

s-urbaniak Feb 15, 2019

josefkarasek Feb 15, 2019

s-urbaniak left a comment

Add support for custom upstream CAs #34

Add support for custom upstream CAs #34

Conversation

josefkarasek commented Feb 12, 2019

s-urbaniak left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

josefkarasek commented Feb 14, 2019

s-urbaniak commented Feb 14, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

s-urbaniak left a comment

Choose a reason for hiding this comment