From 5ba3f9d46dcdbc0d1e0ceb7b35e40d8d8eec54ef Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Tue, 25 Aug 2026 08:21:55 -0500 Subject: [PATCH] fix(conformance): trusted-tls verifies LE-prod cert via system trust + split-horizon DNS (R-TLS-01/03) Rewrote the probe for the LE-production switch: no embedded staging root, no --cacert (system CA bundle validates ISRG Root X1), resolves the hostname via in-cluster split-horizon DNS to the Gateway VIP (the real-client path). PASSES live (9s). Removed the le-staging-root-ca fixture. --- .../trusted-tls/chainsaw-test.yaml | 62 ++++++++----------- .../fixtures/le-staging-root-ca.yaml | 38 ------------ 2 files changed, 25 insertions(+), 75 deletions(-) delete mode 100644 conformance/tests/l2-behavioral/trusted-tls/fixtures/le-staging-root-ca.yaml diff --git a/conformance/tests/l2-behavioral/trusted-tls/chainsaw-test.yaml b/conformance/tests/l2-behavioral/trusted-tls/chainsaw-test.yaml index e5faf8f..d6c7f71 100644 --- a/conformance/tests/l2-behavioral/trusted-tls/chainsaw-test.yaml +++ b/conformance/tests/l2-behavioral/trusted-tls/chainsaw-test.yaml @@ -4,18 +4,20 @@ # Spec: docs/09 (Gateway API + DNS-01 wildcard), ADR-0006 (LE issuers) # # GIVEN the shared Gateway terminating TLS with the cert-manager wildcard cert, -# WHEN a probe dials it (SNI *.home.keithjackson.dev) and verifies the chain, -# THEN the served cert is non-self-signed, unexpired, covers the wildcard SAN, -# and CHAINS TO A REAL CA ROOT (R-TLS-01). The wildcard SAN also covers -# internal-only hostnames, so internal services get the same trusted cert -# (R-TLS-03). +# WHEN an in-cluster probe dials it by hostname (SNI *.home.keithjackson.dev) and +# verifies the chain against the SYSTEM trust store, +# THEN the served cert is non-self-signed, unexpired, covers the wildcard SAN, and +# chains to a PUBLICLY-TRUSTED CA root (R-TLS-01). The wildcard SAN also covers +# internal-only hostnames, so internal services get the same trusted cert (R-TLS-03). # -# TRUST MODEL (operator decision "A", DECISIONS-LOG): dev issues from Let's -# Encrypt **STAGING** (ADR-0006, to avoid prod rate limits) — a real CA, but not -# in the system trust store. So the probe verifies the chain against the LE -# STAGING root (fixtures/le-staging-root-ca.yaml, "(STAGING) Pretend Pear X1"), -# which is the faithful "chains to a trusted root" check for this environment. -# A prod overlay (LE-prod) would verify against the system store instead. +# TRUST MODEL: the cluster issues from Let's Encrypt **PRODUCTION** (ACME_CLUSTER_ISSUER +# = letsencrypt-prod), whose root (ISRG Root X1) is in the system trust store — so the +# probe verifies against the container's DEFAULT CA bundle (no --cacert). A clean verify +# is exactly what real in-cluster OIDC clients (oauth2-proxy, Grafana) depend on. The +# probe resolves the hostname via in-cluster split-horizon DNS (coredns-custom → Gateway +# VIP, R-DNS-01) — the same path real clients use — so no --connect-to hack is needed. +# Replaced the earlier LE-staging + embedded-root check when dev switched to LE-prod so +# in-cluster SSO clients trust the cert (DECISIONS-LOG Session 7). # ============================================================================= apiVersion: chainsaw.kyverno.io/v1alpha1 kind: Test @@ -31,14 +33,10 @@ metadata: conformance.home.k3s/executable: "true" conformance.home.k3s/intent: >- The shared Gateway serves a valid, unexpired, non-self-signed wildcard cert - that chains to a real CA root (LE-staging in dev); the wildcard SAN covers - internal-only hostnames too. + that chains to a publicly-trusted CA root (LE production); the wildcard SAN + covers internal-only hostnames too. spec: steps: - - name: given-le-staging-root-trust-anchor - try: - - apply: - file: fixtures/le-staging-root-ca.yaml - name: then-gateway-cert-chains-to-trusted-root try: - apply: @@ -49,39 +47,29 @@ spec: name: tls-probe spec: backoffLimit: 4 - activeDeadlineSeconds: 120 + activeDeadlineSeconds: 180 template: spec: restartPolicy: Never - volumes: - - name: ca - configMap: - name: le-staging-root containers: - name: probe image: curlimages/curl:8.11.1 - volumeMounts: - - name: ca - mountPath: /ca - readOnly: true command: - sh - -c - | set -eu - gw="cilium-gateway-shared.gateway.svc.cluster.local" # Probe TWO wildcard hostnames — one "public", one "internal-only". Both - # match *.home.keithjackson.dev, so a clean verify against the LE-staging - # root for BOTH proves R-TLS-01 (chains to a real CA root) AND R-TLS-03 - # (the same trusted wildcard covers internal-only names). - # --connect-to sends SNI/Host=$host but DIALS the gateway Service by name - # (env-agnostic — no hardcoded VIP). curl (no -f) exits 0 on the gateway's - # 404 once TLS+hostname verify; it exits 60 if the chain/hostname fails - # (verified empirically), so `set -e` + rc=0 is the assertion. TLS - # terminates at the gateway before HTTP routing, so no backend is needed. + # match *.home.keithjackson.dev, so a clean verify against the SYSTEM CA + # bundle for BOTH proves R-TLS-01 (chains to a publicly-trusted root) AND + # R-TLS-03 (the same trusted wildcard covers internal-only names). Names + # resolve via in-cluster split-horizon DNS to the Gateway VIP. curl (no + # --cacert, no -k) validates against the default CA bundle and exits 0 on + # the gateway's 404 once TLS+hostname verify; it exits 60 if the chain or + # hostname fails. TLS terminates at the gateway before HTTP routing, so no + # backend is needed. for host in conformance.home.keithjackson.dev internal-only.home.keithjackson.dev; do - curl -sS --cacert /ca/root.pem \ - --connect-to "${host}:443:${gw}:443" \ + curl -sS --retry 5 --retry-connrefused --retry-delay 3 --max-time 20 \ -o /dev/null "https://${host}/" echo "TLS_TRUSTED ${host}" done diff --git a/conformance/tests/l2-behavioral/trusted-tls/fixtures/le-staging-root-ca.yaml b/conformance/tests/l2-behavioral/trusted-tls/fixtures/le-staging-root-ca.yaml deleted file mode 100644 index 1286539..0000000 --- a/conformance/tests/l2-behavioral/trusted-tls/fixtures/le-staging-root-ca.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: v1 -data: - root.pem: | - -----BEGIN CERTIFICATE----- - MIIFmDCCA4CgAwIBAgIQU9C87nMpOIFKYpfvOHFHFDANBgkqhkiG9w0BAQsFADBm - MQswCQYDVQQGEwJVUzEzMDEGA1UEChMqKFNUQUdJTkcpIEludGVybmV0IFNlY3Vy - aXR5IFJlc2VhcmNoIEdyb3VwMSIwIAYDVQQDExkoU1RBR0lORykgUHJldGVuZCBQ - ZWFyIFgxMB4XDTE1MDYwNDExMDQzOFoXDTM1MDYwNDExMDQzOFowZjELMAkGA1UE - BhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBTZWN1cml0eSBSZXNl - YXJjaCBHcm91cDEiMCAGA1UEAxMZKFNUQUdJTkcpIFByZXRlbmQgUGVhciBYMTCC - AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALbagEdDTa1QgGBWSYkyMhsc - ZXENOBaVRTMX1hceJENgsL0Ma49D3MilI4KS38mtkmdF6cPWnL++fgehT0FbRHZg - jOEr8UAN4jH6omjrbTD++VZneTsMVaGamQmDdFl5g1gYaigkkmx8OiCO68a4QXg4 - wSyn6iDipKP8utsE+x1E28SA75HOYqpdrk4HGxuULvlr03wZGTIf/oRt2/c+dYmD - oaJhge+GOrLAEQByO7+8+vzOwpNAPEx6LW+crEEZ7eBXih6VP19sTGy3yfqK5tPt - TdXXCOQMKAp+gCj/VByhmIr+0iNDC540gtvV303WpcbwnkkLYC0Ft2cYUyHtkstO - fRcRO+K2cZozoSwVPyB8/J9RpcRK3jgnX9lujfwA/pAbP0J2UPQFxmWFRQnFjaq6 - rkqbNEBgLy+kFL1NEsRbvFbKrRi5bYy2lNms2NJPZvdNQbT/2dBZKmJqxHkxCuOQ - FjhJQNeO+Njm1Z1iATS/3rts2yZlqXKsxQUzN6vNbD8KnXRMEeOXUYvbV4lqfCf8 - mS14WEbSiMy87GB5S9ucSV1XUrlTG5UGcMSZOBcEUpisRPEmQWUOTWIoDQ5FOia/ - GI+Ki523r2ruEmbmG37EBSBXdxIdndqrjy+QVAmCebyDx9eVEGOIpn26bW5LKeru - mJxa/CFBaKi4bRvmdJRLAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB - Af8EBTADAQH/MB0GA1UdDgQWBBS182Xy/rAKkh/7PH3zRKCsYyXDFDANBgkqhkiG - 9w0BAQsFAAOCAgEAncDZNytDbrrVe68UT6py1lfF2h6Tm2p8ro42i87WWyP2LK8Y - nLHC0hvNfWeWmjZQYBQfGC5c7aQRezak+tHLdmrNKHkn5kn+9E9LCjCaEsyIIn2j - qdHlAkepu/C3KnNtVx5tW07e5bvIjJScwkCDbP3akWQixPpRFAsnP+ULx7k0aO1x - qAeaAhQ2rgo1F58hcflgqKTXnpPM02intVfiVVkX5GXpJjK5EoQtLceyGOrkxlM/ - sTPq4UrnypmsqSagWV3HcUlYtDinc+nukFk6eR4XkzXBbwKajl0YjztfrCIHOn5Q - CJL6TERVDbM/aAPly8kJ1sWGLuvvWYzMYgLzDul//rUF10gEMWaXVZV51KpS9DY/ - 5CunuvCXmEQJHo7kGcViT7sETn6Jz9KOhvYcXkJ7po6d93A/jy4GKPIPnsKKNEmR - xUuXY4xRdh45tMJnLTUDdC9FIU0flTeO9/vNpVA8OPU1i14vCz+MU8KX1bV3GXm/ - fxlB7VBBjX9v5oUep0o/j68R/iDlCOM4VVfRa8gX6T2FU7fNdatvGro7uQzIvWof - gN9WUwCbEMBy/YhBSrXycKA8crgGg3x1mIsopn88JKwmMBa68oS7EHM9w7C4y71M - 7DiA+/9Qdp9RBWJpTS9i/mDnJg1xvo8Xz49mrrgfmcAXTCJqXi24NatI3Oc= - -----END CERTIFICATE----- -kind: ConfigMap -metadata: - name: le-staging-root