|
| 1 | +diff --git a/pkg/controller/virtinformers.go b/pkg/controller/virtinformers.go |
| 2 | +index 5cbb8197f..82f6f9238 100644 |
| 3 | +--- a/pkg/controller/virtinformers.go |
| 4 | ++++ b/pkg/controller/virtinformers.go |
| 5 | +@@ -300,6 +300,8 @@ type KubeInformerFactory interface { |
| 6 | + ResourceQuota() cache.SharedIndexInformer |
| 7 | + |
| 8 | + K8SInformerFactory() informers.SharedInformerFactory |
| 9 | ++ |
| 10 | ++ VirtualizationCA() cache.SharedIndexInformer |
| 11 | + } |
| 12 | + |
| 13 | + type kubeInformerFactory struct { |
| 14 | +@@ -1293,3 +1295,12 @@ func VolumeSnapshotClassInformer(clientSet kubecli.KubevirtClient, resyncPeriod |
| 15 | + lw := cache.NewListWatchFromClient(restClient, "volumesnapshotclasses", k8sv1.NamespaceAll, fields.Everything()) |
| 16 | + return cache.NewSharedIndexInformer(lw, &vsv1.VolumeSnapshotClass{}, resyncPeriod, cache.Indexers{}) |
| 17 | + } |
| 18 | ++ |
| 19 | ++func (f *kubeInformerFactory) VirtualizationCA() cache.SharedIndexInformer { |
| 20 | ++ return f.getInformer("extensionsVirtualizationCAConfigMapInformer", func() cache.SharedIndexInformer { |
| 21 | ++ restClient := f.clientSet.CoreV1().RESTClient() |
| 22 | ++ fieldSelector := fields.OneTermEqualSelector("metadata.name", "virtualization-ca") |
| 23 | ++ lw := cache.NewListWatchFromClient(restClient, "configmaps", f.kubevirtNamespace, fieldSelector) |
| 24 | ++ return cache.NewSharedIndexInformer(lw, &k8sv1.ConfigMap{}, f.defaultResync, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}) |
| 25 | ++ }) |
| 26 | ++} |
| 27 | +diff --git a/pkg/util/tls/tls.go b/pkg/util/tls/tls.go |
| 28 | +index e9e140548..e2a349012 100644 |
| 29 | +--- a/pkg/util/tls/tls.go |
| 30 | ++++ b/pkg/util/tls/tls.go |
| 31 | +@@ -132,6 +132,55 @@ func SetupTLSWithCertManager(caManager ClientCAManager, certManager certificate. |
| 32 | + return tlsConfig |
| 33 | + } |
| 34 | + |
| 35 | ++func SetupTLSWithVirtualizationCAManager(caManager, virtualizationCAManager ClientCAManager, certManager certificate.Manager, clientAuth tls.ClientAuthType, clusterConfig *virtconfig.ClusterConfig) *tls.Config { |
| 36 | ++ tlsConfig := &tls.Config{ |
| 37 | ++ GetCertificate: func(info *tls.ClientHelloInfo) (certificate *tls.Certificate, err error) { |
| 38 | ++ cert := certManager.Current() |
| 39 | ++ if cert == nil { |
| 40 | ++ return nil, fmt.Errorf(noSrvCertMessage) |
| 41 | ++ } |
| 42 | ++ return cert, nil |
| 43 | ++ }, |
| 44 | ++ GetConfigForClient: func(hi *tls.ClientHelloInfo) (*tls.Config, error) { |
| 45 | ++ cert := certManager.Current() |
| 46 | ++ if cert == nil { |
| 47 | ++ return nil, fmt.Errorf(noSrvCertMessage) |
| 48 | ++ } |
| 49 | ++ |
| 50 | ++ clientCAPool, err := caManager.GetCurrent() |
| 51 | ++ if err != nil { |
| 52 | ++ log.Log.Reason(err).Error("Failed to get requestheader client CA") |
| 53 | ++ return nil, err |
| 54 | ++ } |
| 55 | ++ |
| 56 | ++ virtualizationCA, err := virtualizationCAManager.GetCurrentRaw() |
| 57 | ++ if err != nil { |
| 58 | ++ log.Log.Reason(err).Error("Failed to get CA from config-map virtualization-ca") |
| 59 | ++ return nil, err |
| 60 | ++ } |
| 61 | ++ |
| 62 | ++ clientCAPool.AppendCertsFromPEM(virtualizationCA) |
| 63 | ++ |
| 64 | ++ kv := clusterConfig.GetConfigFromKubeVirtCR() |
| 65 | ++ tlsConfig := getTLSConfiguration(kv) |
| 66 | ++ ciphers := CipherSuiteIds(tlsConfig.Ciphers) |
| 67 | ++ minTLSVersion := TLSVersion(tlsConfig.MinTLSVersion) |
| 68 | ++ config := &tls.Config{ |
| 69 | ++ CipherSuites: ciphers, |
| 70 | ++ MinVersion: minTLSVersion, |
| 71 | ++ Certificates: []tls.Certificate{*cert}, |
| 72 | ++ ClientCAs: clientCAPool, |
| 73 | ++ ClientAuth: clientAuth, |
| 74 | ++ } |
| 75 | ++ |
| 76 | ++ config.BuildNameToCertificate() |
| 77 | ++ return config, nil |
| 78 | ++ }, |
| 79 | ++ } |
| 80 | ++ tlsConfig.BuildNameToCertificate() |
| 81 | ++ return tlsConfig |
| 82 | ++} |
| 83 | ++ |
| 84 | + func SetupTLSForVirtHandlerServer(caManager ClientCAManager, certManager certificate.Manager, externallyManaged bool, clusterConfig *virtconfig.ClusterConfig) *tls.Config { |
| 85 | + // #nosec cause: InsecureSkipVerify: true |
| 86 | + // resolution: Neither the client nor the server should validate anything itself, `VerifyPeerCertificate` is still executed |
| 87 | +diff --git a/pkg/virt-api/api.go b/pkg/virt-api/api.go |
| 88 | +index 120f2d68f..4b82edd13 100644 |
| 89 | +--- a/pkg/virt-api/api.go |
| 90 | ++++ b/pkg/virt-api/api.go |
| 91 | +@@ -884,7 +884,7 @@ func (app *virtAPIApp) registerMutatingWebhook(informers *webhooks.Informers) { |
| 92 | + }) |
| 93 | + } |
| 94 | + |
| 95 | +-func (app *virtAPIApp) setupTLS(k8sCAManager kvtls.ClientCAManager, kubevirtCAManager kvtls.ClientCAManager) { |
| 96 | ++func (app *virtAPIApp) setupTLS(k8sCAManager, kubevirtCAManager, virtualizationCAManager kvtls.ClientCAManager) { |
| 97 | + |
| 98 | + // A VerifyClientCertIfGiven request means we're not guaranteed |
| 99 | + // a client has been authenticated unless they provide a peer |
| 100 | +@@ -901,7 +901,7 @@ func (app *virtAPIApp) setupTLS(k8sCAManager kvtls.ClientCAManager, kubevirtCAMa |
| 101 | + // response is given. That status request won't send a peer cert regardless |
| 102 | + // if the TLS handshake requests it. As a result, the TLS handshake fails |
| 103 | + // and our aggregated endpoint never becomes available. |
| 104 | +- app.tlsConfig = kvtls.SetupTLSWithCertManager(k8sCAManager, app.certmanager, tls.VerifyClientCertIfGiven, app.clusterConfig) |
| 105 | ++ app.tlsConfig = kvtls.SetupTLSWithVirtualizationCAManager(k8sCAManager, virtualizationCAManager, app.certmanager, tls.VerifyClientCertIfGiven, app.clusterConfig) |
| 106 | + app.handlerTLSConfiguration = kvtls.SetupTLSForVirtHandlerClients(kubevirtCAManager, app.handlerCertManager, app.externallyManaged) |
| 107 | + } |
| 108 | + |
| 109 | +@@ -919,10 +919,12 @@ func (app *virtAPIApp) startTLS(informerFactory controller.KubeInformerFactory) |
| 110 | + |
| 111 | + authConfigMapInformer := informerFactory.ApiAuthConfigMap() |
| 112 | + kubevirtCAConfigInformer := informerFactory.KubeVirtCAConfigMap() |
| 113 | ++ virtualizationCAConfigInformer := informerFactory.VirtualizationCA() |
| 114 | + |
| 115 | + k8sCAManager := kvtls.NewKubernetesClientCAManager(authConfigMapInformer.GetStore()) |
| 116 | + kubevirtCAInformer := kvtls.NewCAManager(kubevirtCAConfigInformer.GetStore(), app.namespace, app.caConfigMapName) |
| 117 | +- app.setupTLS(k8sCAManager, kubevirtCAInformer) |
| 118 | ++ virtualizationCAInformer := kvtls.NewCAManager(virtualizationCAConfigInformer.GetStore(), app.namespace, "virtualization-ca") |
| 119 | ++ app.setupTLS(k8sCAManager, kubevirtCAInformer, virtualizationCAInformer) |
| 120 | + |
| 121 | + app.Compose() |
| 122 | + |
| 123 | +@@ -1007,6 +1009,7 @@ func (app *virtAPIApp) Run() { |
| 124 | + |
| 125 | + kubeInformerFactory.ApiAuthConfigMap() |
| 126 | + kubeInformerFactory.KubeVirtCAConfigMap() |
| 127 | ++ kubeInformerFactory.VirtualizationCA() |
| 128 | + crdInformer := kubeInformerFactory.CRD() |
| 129 | + vmiPresetInformer := kubeInformerFactory.VirtualMachinePreset() |
| 130 | + vmRestoreInformer := kubeInformerFactory.VirtualMachineRestore() |
0 commit comments