Max workload cert lifetime should not apply to istiod's server cert #28640
Conversation
google-cla
bot
added
the
cla: yes
istio-testing
added
the
size/L
| // returns the certificate chain and the private key. | ||
| func (ca *IstioCA) GenKeyCert(hostnames []string, certTTL time.Duration) ([]byte, []byte, error) { |
There was a problem hiding this comment.
Would it be a good idea to pass in the checkLifetime parameter to this function as well? This function appears to be called by a couple of test_functions that use it to generate a key-cert pair for workload certs as well. Perhaps we just don't need lifetime checking in those cases?
pilot/pkg/xds/ads_test.go
Outdated
| @@ -80,7 +80,7 @@ func TestAgent(t *testing.T) { | |||
| defer tearDown() | |||
|
|
|||
| // TODO: when authz is implemented, verify labels are checked. | |||
| cert, key, err := bs.CA.GenKeyCert([]string{spiffe.Identity{"cluster.local", "test", "sa"}.String()}, 1*time.Hour) | |||
| cert, key, err := bs.CA.GenKeyCertNoLifetimeCheck([]string{spiffe.Identity{"cluster.local", "test", "sa"}.String()}, 1*time.Hour) | |||
There was a problem hiding this comment.
Looks like we are generating certs for a workload. Should be okay to not check the lifetime in this case though...
There was a problem hiding this comment.
Oh, I didn't notice this test is generating for a workload... I can write a function GenKeyCert() for this test, to make this 100% accurate.
|
@howardjohn I'll add a unit test for it. |
myidpt
added
the
release-notes-none
|
/test release-notes_istio |
|
/test integ-multicluster-k8s-tests_istio |
|
/retest |
When using self-signed Istiod CA, Istiod server needs a long-lived cert signed by Istiod CA itself (we make its lifetime equals the CA cert lifetime). Because the Istiod CA checks the requested lifetime should be smaller than the max workload cert lifetime, we extended the max workload cert to be equal to the CA cert lifetime. This actually makes the max workload cert lifetime effectiveless.
This PR fixes this by not conducting the max workload cert lifetime check for the Istiod server's certificate issuance (called via GenKeyCertNoLifetimeChecking). The max workload cert lifetime is still effective (by default 90 days) against normal workload cert issuance.
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ X ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Pull Request Attributes
Please check any characteristics that apply to this pull request.
[ ] Does not have any changes that may affect Istio users.