djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
e44540043d
ContainerImage.Pinniped/internal/testutil
History
Monis Khan cd686ffdf3
Force the use of secure TLS config 
This change updates the TLS config used by all pinniped components.
There are no configuration knobs associated with this change.  Thus
this change tightens our static defaults.

There are four TLS config levels:

1. Secure (TLS 1.3 only)
2. Default (TLS 1.2+ best ciphers that are well supported)
3. Default LDAP (TLS 1.2+ with less good ciphers)
4. Legacy (currently unused, TLS 1.2+ with all non-broken ciphers)

Highlights per component:

1. pinniped CLI
   - uses "secure" config against KAS
   - uses "default" for all other connections
2. concierge
   - uses "secure" config as an aggregated API server
   - uses "default" config as a impersonation proxy API server
   - uses "secure" config against KAS
   - uses "default" config for JWT authenticater (mostly, see code)
   - no changes to webhook authenticater (see code)
3. supervisor
   - uses "default" config as a server
   - uses "secure" config against KAS
   - uses "default" config against OIDC IDPs
   - uses "default LDAP" config against LDAP IDPs

Signed-off-by: Monis Khan <mok@vmware.com>
2021-11-17 16:55:35 -05:00
..
fakekubeapi Force the use of secure TLS config 2021-11-17 16:55:35 -05:00
oidctestutil Addressing code review changes 2021-11-05 14:22:43 -07:00
testlogger Add a bit nicer assertion helper in testutil/testlogger. 2021-03-05 15:49:45 -06:00
tlsserver Force the use of secure TLS config 2021-11-17 16:55:35 -05:00
assertions.go Add custom response_mode=form_post HTML template. 2021-07-09 12:08:43 -05:00
certs.go certauthority.go: Refactor issuing client versus server certs 2021-03-12 16:09:37 -08:00
crypto.go Cleanup code via TODOs accumulated during token endpoint work 2020-12-04 10:09:42 -05:00
delete.go Improve the selectors of Deployments and Services 2021-09-14 13:35:10 -07:00
doc.go Allow multiple Pinnipeds to work on same cluster 2021-02-02 15:18:41 -08:00
ioutil.go WIP: add supervisor upstream flags to pinniped get kubeconfig 2021-04-30 14:28:03 -07:00
kube_server_compatibility.go Tests use CertificatesV1 when available, otherwise use CertificatesV1beta1 2021-09-20 17:14:58 -07:00
observable_with_informer_option.go Add Go vanity import paths. 2020-09-18 14:56:24 -05:00
observable_with_initial_event_option.go kubecertagent: use initial event for when key can't be found 2020-09-24 16:54:20 -04:00
psession.go Require refresh tokens for upstream OIDC and save more session data 2021-10-08 15:48:21 -07:00
roundtrip.go internal/groupsuffix: mutate TokenCredentialRequest's Authenticator 2021-02-10 15:53:44 -05:00
tempdir_go1.14.go Tweak some stdlib usage so we compile under Go 1.14. 2020-11-30 10:11:41 -06:00
tempdir.go Tweak some stdlib usage so we compile under Go 1.14. 2020-11-30 10:11:41 -06:00
tlsserver.go Force the use of secure TLS config 2021-11-17 16:55:35 -05:00
transcript_logger.go Save 2 lines by using inline-style comments for Copyright 2020-09-16 10:35:19 -04:00