Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🌱 Add support for SSL env vars to cert pool watcher #1672

Merged
merged 1 commit into from
Jan 30, 2025
Merged

🌱 Add support for SSL env vars to cert pool watcher #1672

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 22 additions & 2 deletions internal/httputil/certpoolwatcher.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ import (
"crypto/x509"
"fmt"
"os"
"slices"
"strings"
"sync"
"time"

Expand Down Expand Up @@ -44,8 +46,26 @@ func NewCertPoolWatcher(caDir string, log logr.Logger) (*CertPoolWatcher, error)
if err != nil {
return nil, err
}
if err = watcher.Add(caDir); err != nil {
return nil, err

// If the SSL_CERT_DIR or SSL_CERT_FILE environment variables are
// specified, this means that we have some control over the system root
// location, thus they may change, thus we should watch those locations.
watchPaths := strings.Split(os.Getenv("SSL_CERT_DIR"), ":")
watchPaths = append(watchPaths, caDir, os.Getenv("SSL_CERT_FILE"))
watchPaths = slices.DeleteFunc(watchPaths, func(p string) bool {
if p == "" {
return true
}
if _, err := os.Stat(p); err != nil {
return true
}
return false
})

for _, p := range watchPaths {
if err := watcher.Add(p); err != nil {
return nil, err
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: collect the paths in step 1, slices.DeleteFunc to stat and remove in step 2, loop over remaining to call watcher.Add in step 3?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

watchPaths := []string{caDir, os.Getenv("SSL_CERT_DIR"), os.Getenv("SSL_CERT_FILE")}

slices.DeleteFunc(watchPaths, func(p string) bool { /* do stat here */})

for _, p := range watchPaths {
    if err := watcher.Add(p); err != nil {
        return nil, err
    }
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting...

}

cpw := &CertPoolWatcher{
Expand Down
4 changes: 4 additions & 0 deletions internal/httputil/certpoolwatcher_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,10 @@ func TestCertPoolWatcher(t *testing.T) {
t.Logf("Create cert file at %q\n", certName)
createCert(t, certName)

// Update environment variables for the watcher - some of these should not exist
os.Setenv("SSL_CERT_DIR", tmpDir+":/tmp/does-not-exist.dir")
os.Setenv("SSL_CERT_FILE", "/tmp/does-not-exist.file")

// Create the cert pool watcher
cpw, err := httputil.NewCertPoolWatcher(tmpDir, log.FromContext(context.Background()))
require.NoError(t, err)
Expand Down
Loading