Skip to content

✨enable webhook server set-up mTLS service to verify client's certificate #802

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 4, 2020
Merged

✨enable webhook server set-up mTLS service to verify client's certificate #802

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
74aee23
enable webhook server set-up mTLS service to verify client's certific…
answer1991 Feb 17, 2020
39ee87b
fix typo
answer1991 Feb 27, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 24 additions & 1 deletion pkg/webhook/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,9 @@ package webhook
import (
"context"
"crypto/tls"
"crypto/x509"
"fmt"
"io/ioutil"
"net"
"net/http"
"os"
Expand Down Expand Up @@ -54,9 +56,13 @@ type Server struct {
// CertName is the server certificate name. Defaults to tls.crt.
CertName string

// CertName is the server key name. Defaults to tls.key.
// KeyName is the server key name. Defaults to tls.key.
KeyName string

// ClientCAName is the CA certificate name which server used to verify remote(client)'s certificate.
// Defaults to "", which means server does not verify client's certificate.
ClientCAName string

// WebhookMux is the multiplexer that handles different webhooks.
WebhookMux *http.ServeMux

Expand Down Expand Up @@ -168,6 +174,23 @@ func (s *Server) Start(stop <-chan struct{}) error {
GetCertificate: certWatcher.GetCertificate,
}

// load CA to verify client certificate
if s.ClientCAName != "" {
certPool := x509.NewCertPool()
clientCABytes, err := ioutil.ReadFile(filepath.Join(s.CertDir, s.ClientCAName))
if err != nil {
return fmt.Errorf("failed to read client CA cert: %v", err)
}

ok := certPool.AppendCertsFromPEM(clientCABytes)
if !ok {
return fmt.Errorf("failed to append client CA cert to CA pool")
}

cfg.ClientCAs = certPool
cfg.ClientAuth = tls.RequireAndVerifyClientCert
}

listener, err := tls.Listen("tcp", net.JoinHostPort(s.Host, strconv.Itoa(int(s.Port))), cfg)
if err != nil {
return err
Expand Down