Merge fix/trusted-tls-prod-verify (R-TLS-01/03 green on LE-prod)
This commit is contained in:
2 files changed
+25
-75
No files matched your search
@@ -4,18 +4,20 @@
|
|||||||
# Spec: docs/09 (Gateway API + DNS-01 wildcard), ADR-0006 (LE issuers)
|
# Spec: docs/09 (Gateway API + DNS-01 wildcard), ADR-0006 (LE issuers)
|
||||||
#
|
#
|
||||||
# GIVEN the shared Gateway terminating TLS with the cert-manager wildcard cert,
|
# GIVEN the shared Gateway terminating TLS with the cert-manager wildcard cert,
|
||||||
# WHEN a probe dials it (SNI *.home.keithjackson.dev) and verifies the chain,
|
# WHEN an in-cluster probe dials it by hostname (SNI *.home.keithjackson.dev) and
|
||||||
# THEN the served cert is non-self-signed, unexpired, covers the wildcard SAN,
|
# verifies the chain against the SYSTEM trust store,
|
||||||
# and CHAINS TO A REAL CA ROOT (R-TLS-01). The wildcard SAN also covers
|
# THEN the served cert is non-self-signed, unexpired, covers the wildcard SAN, and
|
||||||
# internal-only hostnames, so internal services get the same trusted cert
|
# chains to a PUBLICLY-TRUSTED CA root (R-TLS-01). The wildcard SAN also covers
|
||||||
# (R-TLS-03).
|
# internal-only hostnames, so internal services get the same trusted cert (R-TLS-03).
|
||||||
#
|
#
|
||||||
# TRUST MODEL (operator decision "A", DECISIONS-LOG): dev issues from Let's
|
# TRUST MODEL: the cluster issues from Let's Encrypt **PRODUCTION** (ACME_CLUSTER_ISSUER
|
||||||
# Encrypt **STAGING** (ADR-0006, to avoid prod rate limits) — a real CA, but not
|
# = letsencrypt-prod), whose root (ISRG Root X1) is in the system trust store — so the
|
||||||
# in the system trust store. So the probe verifies the chain against the LE
|
# probe verifies against the container's DEFAULT CA bundle (no --cacert). A clean verify
|
||||||
# STAGING root (fixtures/le-staging-root-ca.yaml, "(STAGING) Pretend Pear X1"),
|
# is exactly what real in-cluster OIDC clients (oauth2-proxy, Grafana) depend on. The
|
||||||
# which is the faithful "chains to a trusted root" check for this environment.
|
# probe resolves the hostname via in-cluster split-horizon DNS (coredns-custom → Gateway
|
||||||
# A prod overlay (LE-prod) would verify against the system store instead.
|
# VIP, R-DNS-01) — the same path real clients use — so no --connect-to hack is needed.
|
||||||
|
# Replaced the earlier LE-staging + embedded-root check when dev switched to LE-prod so
|
||||||
|
# in-cluster SSO clients trust the cert (DECISIONS-LOG Session 7).
|
||||||
# =============================================================================
|
# =============================================================================
|
||||||
apiVersion: chainsaw.kyverno.io/v1alpha1
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
||||||
kind: Test
|
kind: Test
|
||||||
@@ -31,14 +33,10 @@ metadata:
|
|||||||
conformance.home.k3s/executable: "true"
|
conformance.home.k3s/executable: "true"
|
||||||
conformance.home.k3s/intent: >-
|
conformance.home.k3s/intent: >-
|
||||||
The shared Gateway serves a valid, unexpired, non-self-signed wildcard cert
|
The shared Gateway serves a valid, unexpired, non-self-signed wildcard cert
|
||||||
that chains to a real CA root (LE-staging in dev); the wildcard SAN covers
|
that chains to a publicly-trusted CA root (LE production); the wildcard SAN
|
||||||
internal-only hostnames too.
|
covers internal-only hostnames too.
|
||||||
spec:
|
spec:
|
||||||
steps:
|
steps:
|
||||||
- name: given-le-staging-root-trust-anchor
|
|
||||||
try:
|
|
||||||
- apply:
|
|
||||||
file: fixtures/le-staging-root-ca.yaml
|
|
||||||
- name: then-gateway-cert-chains-to-trusted-root
|
- name: then-gateway-cert-chains-to-trusted-root
|
||||||
try:
|
try:
|
||||||
- apply:
|
- apply:
|
||||||
@@ -49,39 +47,29 @@ spec:
|
|||||||
name: tls-probe
|
name: tls-probe
|
||||||
spec:
|
spec:
|
||||||
backoffLimit: 4
|
backoffLimit: 4
|
||||||
activeDeadlineSeconds: 120
|
activeDeadlineSeconds: 180
|
||||||
template:
|
template:
|
||||||
spec:
|
spec:
|
||||||
restartPolicy: Never
|
restartPolicy: Never
|
||||||
volumes:
|
|
||||||
- name: ca
|
|
||||||
configMap:
|
|
||||||
name: le-staging-root
|
|
||||||
containers:
|
containers:
|
||||||
- name: probe
|
- name: probe
|
||||||
image: curlimages/curl:8.11.1
|
image: curlimages/curl:8.11.1
|
||||||
volumeMounts:
|
|
||||||
- name: ca
|
|
||||||
mountPath: /ca
|
|
||||||
readOnly: true
|
|
||||||
command:
|
command:
|
||||||
- sh
|
- sh
|
||||||
- -c
|
- -c
|
||||||
- |
|
- |
|
||||||
set -eu
|
set -eu
|
||||||
gw="cilium-gateway-shared.gateway.svc.cluster.local"
|
|
||||||
# Probe TWO wildcard hostnames — one "public", one "internal-only". Both
|
# Probe TWO wildcard hostnames — one "public", one "internal-only". Both
|
||||||
# match *.home.keithjackson.dev, so a clean verify against the LE-staging
|
# match *.home.keithjackson.dev, so a clean verify against the SYSTEM CA
|
||||||
# root for BOTH proves R-TLS-01 (chains to a real CA root) AND R-TLS-03
|
# bundle for BOTH proves R-TLS-01 (chains to a publicly-trusted root) AND
|
||||||
# (the same trusted wildcard covers internal-only names).
|
# R-TLS-03 (the same trusted wildcard covers internal-only names). Names
|
||||||
# --connect-to sends SNI/Host=$host but DIALS the gateway Service by name
|
# resolve via in-cluster split-horizon DNS to the Gateway VIP. curl (no
|
||||||
# (env-agnostic — no hardcoded VIP). curl (no -f) exits 0 on the gateway's
|
# --cacert, no -k) validates against the default CA bundle and exits 0 on
|
||||||
# 404 once TLS+hostname verify; it exits 60 if the chain/hostname fails
|
# the gateway's 404 once TLS+hostname verify; it exits 60 if the chain or
|
||||||
# (verified empirically), so `set -e` + rc=0 is the assertion. TLS
|
# hostname fails. TLS terminates at the gateway before HTTP routing, so no
|
||||||
# terminates at the gateway before HTTP routing, so no backend is needed.
|
# backend is needed.
|
||||||
for host in conformance.home.keithjackson.dev internal-only.home.keithjackson.dev; do
|
for host in conformance.home.keithjackson.dev internal-only.home.keithjackson.dev; do
|
||||||
curl -sS --cacert /ca/root.pem \
|
curl -sS --retry 5 --retry-connrefused --retry-delay 3 --max-time 20 \
|
||||||
--connect-to "${host}:443:${gw}:443" \
|
|
||||||
-o /dev/null "https://${host}/"
|
-o /dev/null "https://${host}/"
|
||||||
echo "TLS_TRUSTED ${host}"
|
echo "TLS_TRUSTED ${host}"
|
||||||
done
|
done
|
||||||
|
|||||||
@@ -1,38 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
data:
|
|
||||||
root.pem: |
|
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIFmDCCA4CgAwIBAgIQU9C87nMpOIFKYpfvOHFHFDANBgkqhkiG9w0BAQsFADBm
|
|
||||||
MQswCQYDVQQGEwJVUzEzMDEGA1UEChMqKFNUQUdJTkcpIEludGVybmV0IFNlY3Vy
|
|
||||||
aXR5IFJlc2VhcmNoIEdyb3VwMSIwIAYDVQQDExkoU1RBR0lORykgUHJldGVuZCBQ
|
|
||||||
ZWFyIFgxMB4XDTE1MDYwNDExMDQzOFoXDTM1MDYwNDExMDQzOFowZjELMAkGA1UE
|
|
||||||
BhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBTZWN1cml0eSBSZXNl
|
|
||||||
YXJjaCBHcm91cDEiMCAGA1UEAxMZKFNUQUdJTkcpIFByZXRlbmQgUGVhciBYMTCC
|
|
||||||
AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALbagEdDTa1QgGBWSYkyMhsc
|
|
||||||
ZXENOBaVRTMX1hceJENgsL0Ma49D3MilI4KS38mtkmdF6cPWnL++fgehT0FbRHZg
|
|
||||||
jOEr8UAN4jH6omjrbTD++VZneTsMVaGamQmDdFl5g1gYaigkkmx8OiCO68a4QXg4
|
|
||||||
wSyn6iDipKP8utsE+x1E28SA75HOYqpdrk4HGxuULvlr03wZGTIf/oRt2/c+dYmD
|
|
||||||
oaJhge+GOrLAEQByO7+8+vzOwpNAPEx6LW+crEEZ7eBXih6VP19sTGy3yfqK5tPt
|
|
||||||
TdXXCOQMKAp+gCj/VByhmIr+0iNDC540gtvV303WpcbwnkkLYC0Ft2cYUyHtkstO
|
|
||||||
fRcRO+K2cZozoSwVPyB8/J9RpcRK3jgnX9lujfwA/pAbP0J2UPQFxmWFRQnFjaq6
|
|
||||||
rkqbNEBgLy+kFL1NEsRbvFbKrRi5bYy2lNms2NJPZvdNQbT/2dBZKmJqxHkxCuOQ
|
|
||||||
FjhJQNeO+Njm1Z1iATS/3rts2yZlqXKsxQUzN6vNbD8KnXRMEeOXUYvbV4lqfCf8
|
|
||||||
mS14WEbSiMy87GB5S9ucSV1XUrlTG5UGcMSZOBcEUpisRPEmQWUOTWIoDQ5FOia/
|
|
||||||
GI+Ki523r2ruEmbmG37EBSBXdxIdndqrjy+QVAmCebyDx9eVEGOIpn26bW5LKeru
|
|
||||||
mJxa/CFBaKi4bRvmdJRLAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
|
|
||||||
Af8EBTADAQH/MB0GA1UdDgQWBBS182Xy/rAKkh/7PH3zRKCsYyXDFDANBgkqhkiG
|
|
||||||
9w0BAQsFAAOCAgEAncDZNytDbrrVe68UT6py1lfF2h6Tm2p8ro42i87WWyP2LK8Y
|
|
||||||
nLHC0hvNfWeWmjZQYBQfGC5c7aQRezak+tHLdmrNKHkn5kn+9E9LCjCaEsyIIn2j
|
|
||||||
qdHlAkepu/C3KnNtVx5tW07e5bvIjJScwkCDbP3akWQixPpRFAsnP+ULx7k0aO1x
|
|
||||||
qAeaAhQ2rgo1F58hcflgqKTXnpPM02intVfiVVkX5GXpJjK5EoQtLceyGOrkxlM/
|
|
||||||
sTPq4UrnypmsqSagWV3HcUlYtDinc+nukFk6eR4XkzXBbwKajl0YjztfrCIHOn5Q
|
|
||||||
CJL6TERVDbM/aAPly8kJ1sWGLuvvWYzMYgLzDul//rUF10gEMWaXVZV51KpS9DY/
|
|
||||||
5CunuvCXmEQJHo7kGcViT7sETn6Jz9KOhvYcXkJ7po6d93A/jy4GKPIPnsKKNEmR
|
|
||||||
xUuXY4xRdh45tMJnLTUDdC9FIU0flTeO9/vNpVA8OPU1i14vCz+MU8KX1bV3GXm/
|
|
||||||
fxlB7VBBjX9v5oUep0o/j68R/iDlCOM4VVfRa8gX6T2FU7fNdatvGro7uQzIvWof
|
|
||||||
gN9WUwCbEMBy/YhBSrXycKA8crgGg3x1mIsopn88JKwmMBa68oS7EHM9w7C4y71M
|
|
||||||
7DiA+/9Qdp9RBWJpTS9i/mDnJg1xvo8Xz49mrrgfmcAXTCJqXi24NatI3Oc=
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: le-staging-root
|
|
||||||
Reference in new issue
Block a user