djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #683 from enj/enj/i/credentialrequest_notafter

Browse Source 
credentialrequest: use safer approximation for ExpirationTimestamp
This commit is contained in:
Mo Khan 2021-06-23 11:55:29 -04:00 committed by GitHub
commit a6141e911c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
internal/registry/credentialrequest/rest.go
View File

@ -106,6 +106,8 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
return failureResponse(), nil return failureResponse(), nil
} }
// this timestamp should be returned from IssueClientCertPEM but this is a safe approximation
expires := metav1.NewTime(time.Now().UTC().Add(clientCertificateTTL))
certPEM, keyPEM, err := r.issuer.IssueClientCertPEM(userInfo.GetName(), userInfo.GetGroups(), clientCertificateTTL) certPEM, keyPEM, err := r.issuer.IssueClientCertPEM(userInfo.GetName(), userInfo.GetGroups(), clientCertificateTTL)
if err != nil { if err != nil {
traceFailureWithError(t, "cert issuer", err) traceFailureWithError(t, "cert issuer", err)
@ -117,7 +119,7 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
return &loginapi.TokenCredentialRequest{ return &loginapi.TokenCredentialRequest{
Status: loginapi.TokenCredentialRequestStatus{ Status: loginapi.TokenCredentialRequestStatus{
Credential: &loginapi.ClusterCredential{ Credential: &loginapi.ClusterCredential{
ExpirationTimestamp: metav1.NewTime(time.Now().UTC().Add(clientCertificateTTL)), ExpirationTimestamp: expires,
ClientCertificateData: string(certPEM), ClientCertificateData: string(certPEM),
ClientKeyData: string(keyPEM), ClientKeyData: string(keyPEM),
}, },