djpbessems
/
ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #29 from mattmoyer/increase-cert-ttl 

Increase client cert TTL from 5m to 1h.
This commit is contained in:
Matt Moyer 2020-07-27 14:56:08 -05:00 committed by GitHub
parent 425e95bed4 f986600d5b
commit ce71a5bac8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/registry/loginrequest/rest.go
View File

@ -23,6 +23,9 @@ import (
placeholderapi "github.com/suzerain-io/placeholder-name-api/pkg/apis/placeholder" placeholderapi "github.com/suzerain-io/placeholder-name-api/pkg/apis/placeholder"
) )
// clientCertificateTTL is the TTL for short-lived client certificates returned by this API.
const clientCertificateTTL = 1 * time.Hour
var ( var (
_ rest.Creater = &REST{} _ rest.Creater = &REST{}
_ rest.NamespaceScopedStrategy = &REST{} _ rest.NamespaceScopedStrategy = &REST{}
@ -128,7 +131,7 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
OrganizationalUnit: authResponse.User.GetGroups(), OrganizationalUnit: authResponse.User.GetGroups(),
}, },
[]string{}, []string{},
5*time.Minute, clientCertificateTTL,
) )
if err != nil { if err != nil {
klog.Warningf("failed to issue short lived client certificate: %v", err) klog.Warningf("failed to issue short lived client certificate: %v", err)

2
pkg/registry/loginrequest/rest_test.go
View File

@ -144,7 +144,7 @@ func TestCreateSucceedsWhenGivenATokenAndTheWebhookAuthenticatesTheToken(t *test
CommonName: "test-user", CommonName: "test-user",
OrganizationalUnit: []string{"test-group-1", "test-group-2"}}, OrganizationalUnit: []string{"test-group-1", "test-group-2"}},
[]string{}, []string{},
5*time.Minute, 1*time.Hour,
).Return([]byte("test-cert"), []byte("test-key"), nil) ).Return([]byte("test-cert"), []byte("test-key"), nil)
storage := NewREST(&webhook, issuer) storage := NewREST(&webhook, issuer)