djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Increase client cert TTL from 5m to 1h.

Browse Source 
This will make manual testing easier and seems like a reasonable tradeoff. We'll iterate more in the future.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
This commit is contained in:
Matt Moyer 2020-07-27 13:38:32 -05:00
parent 349dd98a2f
commit f986600d5b
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/registry/loginrequest/rest.go
View File

@ -23,6 +23,9 @@ import (
placeholderapi "github.com/suzerain-io/placeholder-name-api/pkg/apis/placeholder" placeholderapi "github.com/suzerain-io/placeholder-name-api/pkg/apis/placeholder"
) )
// clientCertificateTTL is the TTL for short-lived client certificates returned by this API.
const clientCertificateTTL = 1 * time.Hour
var ( var (
_ rest.Creater = &REST{} _ rest.Creater = &REST{}
_ rest.NamespaceScopedStrategy = &REST{} _ rest.NamespaceScopedStrategy = &REST{}
@ -128,7 +131,7 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
OrganizationalUnit: authResponse.User.GetGroups(), OrganizationalUnit: authResponse.User.GetGroups(),
}, },
[]string{}, []string{},
5*time.Minute, clientCertificateTTL,
) )
if err != nil { if err != nil {
klog.Warningf("failed to issue short lived client certificate: %v", err) klog.Warningf("failed to issue short lived client certificate: %v", err)

2
pkg/registry/loginrequest/rest_test.go
View File

@ -144,7 +144,7 @@ func TestCreateSucceedsWhenGivenATokenAndTheWebhookAuthenticatesTheToken(t *test
CommonName: "test-user", CommonName: "test-user",
OrganizationalUnit: []string{"test-group-1", "test-group-2"}}, OrganizationalUnit: []string{"test-group-1", "test-group-2"}},
[]string{}, []string{},
5*time.Minute, 1*time.Hour,
).Return([]byte("test-cert"), []byte("test-key"), nil) ).Return([]byte("test-cert"), []byte("test-key"), nil)
storage := NewREST(&webhook, issuer) storage := NewREST(&webhook, issuer)