home/cert-manager
2
0
Fork 0
mirror of https://github.com/wahyd4/cert-manager.git synced 2026-08-09 05:06:38 +10:00
Code Issues Packages Projects Releases Wiki Activity

add validation to the correct place

Browse Source 
Signed-off-by: Tomáš Freund <tomas.freund@datamole.cz>
This commit is contained in:
Tomáš Freund
2021-08-12 13:26:16 +02:00
parent bf0d2d5613
commit e343ff5015
7 changed files with 24 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/apis/acme/v1/types_issuer.go
+2 -2
View File
@@ -500,11 +500,11 @@ type ACMEIssuerDNS01ProviderAzureDNS struct {
// +optional
Environment AzureDNSEnvironment `json:"environment,omitempty"`
// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityResourceID)
// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityResourceID)
// +optional
ManagedIdentityClientID string `json:"managedIdentityClientID,omitempty"`
// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityClientID)
// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityClientID)
// +optional
ManagedIdentityResourceID string `json:"managedIdentityResourceID,omitempty"`
}
pkg/apis/acme/v1alpha2/types_issuer.go
+2 -2
View File
@@ -497,11 +497,11 @@ type ACMEIssuerDNS01ProviderAzureDNS struct {
// +optional
Environment AzureDNSEnvironment `json:"environment,omitempty"`
// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityResourceID)
// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityResourceID)
// +optional
ManagedIdentityClientID string `json:"managedIdentityClientID,omitempty"`
// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityClientID)
// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityClientID)
// +optional
ManagedIdentityResourceID string `json:"managedIdentityResourceID,omitempty"`
}
pkg/apis/acme/v1alpha3/types_issuer.go
+2 -2
View File
@@ -497,11 +497,11 @@ type ACMEIssuerDNS01ProviderAzureDNS struct {
// +optional
Environment AzureDNSEnvironment `json:"environment,omitempty"`
// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityResourceID)
// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityResourceID)
// +optional
ManagedIdentityClientID string `json:"managedIdentityClientID,omitempty"`
// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityClientID)
// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityClientID)
// +optional
ManagedIdentityResourceID string `json:"managedIdentityResourceID,omitempty"`
}
pkg/apis/acme/v1beta1/types_issuer.go
+2 -2
View File
@@ -496,11 +496,11 @@ type ACMEIssuerDNS01ProviderAzureDNS struct {
// +optional
Environment AzureDNSEnvironment `json:"environment,omitempty"`
// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityResourceID)
// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityResourceID)
// +optional
ManagedIdentityClientID string `json:"managedIdentityClientID,omitempty"`
// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityClientID)
// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityClientID)
// +optional
ManagedIdentityResourceID string `json:"managedIdentityResourceID,omitempty"`
}
pkg/internal/apis/acme/types_issuer.go
+4
View File
@@ -427,6 +427,10 @@ type ACMEIssuerDNS01ProviderAzureDNS struct {
HostedZoneName string
Environment AzureDNSEnvironment
ManagedIdentityClientID string
ManagedIdentityResourceID string
}
type AzureDNSEnvironment string
pkg/internal/apis/certmanager/validation/issuer.go
+12
View File
@@ -335,6 +335,18 @@ func ValidateACMEChallengeSolverDNS01(p *cmacme.ACMEChallengeSolverDNS01, fldPat
if len(p.AzureDNS.TenantID) == 0 {
el = append(el, field.Required(fldPath.Child("azureDNS", "tenantID"), ""))
}
if len(p.AzureDNS.ManagedIdentityClientID) > 0 {
el = append(el, field.Forbidden(fldPath.Child("azureDNS", "managedIdentityClientID"), "managed identity can not be used at the same time as clientID, tenantID or clientSecret"))
}
if len(p.AzureDNS.ManagedIdentityResourceID) > 0 {
el = append(el, field.Forbidden(fldPath.Child("azureDNS", "managedIdentityResourceID"), "managed identity can not be used at the same time as clientID, tenantID or clientSecret"))
}
} else {
// using managed identity
if len(p.AzureDNS.ManagedIdentityClientID) > 0 && len(p.AzureDNS.ManagedIdentityResourceID) > 0 {
el = append(el, field.Forbidden(fldPath.Child("azureDNS"), "managedIdentityClientID and managedIdentityResourceID connot both be specified"))
}
}
// SubscriptionID must always be defined
if len(p.AzureDNS.SubscriptionID) == 0 {
pkg/issuer/acme/dns/azuredns/azuredns.go
-4
View File
@@ -49,10 +49,6 @@ func NewDNSProviderCredentials(environment, clientID, clientSecret, subscription
}
}
if managedIdentityClientID != "" && managedIdentityResourceID != "" {
return nil, fmt.Errorf("managedIdentityClientID and managedIdentityResourceID can not be set at the same time")
}
spt, err := getAuthorization(env, clientID, clientSecret, subscriptionID, tenantID, ambient, managedIdentityClientID, managedIdentityResourceID)
if err != nil {
return nil, err