8b7c30cfbd
- TLS certificates can be configured on the OIDCProviderConfig using the `secretName` field. - When listening for incoming TLS connections, choose the TLS cert based on the SNI hostname of the incoming request. - Because SNI hostname information on incoming requests does not include the port number of the request, we add a validation that OIDCProviderConfigs where the issuer hostnames (not including port number) are the same must use the same `secretName`. - Note that this approach does not yet support requests made to an IP address instead of a hostname. Also note that `localhost` is considered a hostname by SNI. - Add port 443 as a container port to the pod spec. - A new controller watches for TLS secrets and caches them in memory. That same in-memory cache is used while servicing incoming connections on the TLS port. - Make it easy to configure both port 443 and/or port 80 for various Service types using our ytt templates for the supervisor. - When deploying to kind, add another nodeport and forward it to the host on another port to expose our new HTTPS supervisor port to the host.
38 lines
1.0 KiB
Go
38 lines
1.0 KiB
Go
// Copyright 2020 the Pinniped contributors. All Rights Reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package provider
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"sync"
|
|
)
|
|
|
|
type DynamicTLSCertProvider interface {
|
|
SetIssuerHostToTLSCertMap(issuerToJWKSMap map[string]*tls.Certificate)
|
|
GetTLSCert(lowercaseIssuerHostName string) *tls.Certificate
|
|
}
|
|
|
|
type dynamicTLSCertProvider struct {
|
|
issuerHostToTLSCertMap map[string]*tls.Certificate
|
|
mutex sync.RWMutex
|
|
}
|
|
|
|
func NewDynamicTLSCertProvider() DynamicTLSCertProvider {
|
|
return &dynamicTLSCertProvider{
|
|
issuerHostToTLSCertMap: map[string]*tls.Certificate{},
|
|
}
|
|
}
|
|
|
|
func (p *dynamicTLSCertProvider) SetIssuerHostToTLSCertMap(issuerHostToTLSCertMap map[string]*tls.Certificate) {
|
|
p.mutex.Lock() // acquire a write lock
|
|
defer p.mutex.Unlock()
|
|
p.issuerHostToTLSCertMap = issuerHostToTLSCertMap
|
|
}
|
|
|
|
func (p *dynamicTLSCertProvider) GetTLSCert(issuerHostName string) *tls.Certificate {
|
|
p.mutex.RLock() // acquire a read lock
|
|
defer p.mutex.RUnlock()
|
|
return p.issuerHostToTLSCertMap[issuerHostName]
|
|
}
|