From ea84dfdb2b302145fd52375933464b546e6ef7a5 Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Sun, 4 Aug 2019 22:58:44 +0100 Subject: [PATCH] Code organisation and cleaning up code Signed-off-by: JoshVanL --- .../certificaterequests/ca/ca_test.go | 13 ++- .../certificaterequests/test/BUILD.bazel | 2 - .../certificaterequests/test/util.go | 74 ++-------------- .../certificaterequests/vault/BUILD.bazel | 2 +- .../certificaterequests/vault/vault.go | 24 ++--- .../certificaterequests/vault/vault_test.go | 87 ++++++++++++------- pkg/controller/test/BUILD.bazel | 5 +- pkg/controller/test/fake/BUILD.bazel | 27 ------ pkg/controller/test/fake/lister.go | 75 ---------------- pkg/internal/internal.go | 2 +- pkg/internal/vault/BUILD.bazel | 2 +- pkg/internal/vault/fake/vault.go | 4 +- pkg/util/pki/csr.go | 21 +++++ test/unit/gen/BUILD.bazel | 4 - test/unit/gen/lister.go | 68 --------------- 15 files changed, 101 insertions(+), 309 deletions(-) delete mode 100644 pkg/controller/test/fake/BUILD.bazel delete mode 100644 pkg/controller/test/fake/lister.go delete mode 100644 test/unit/gen/lister.go diff --git a/pkg/controller/certificaterequests/ca/ca_test.go b/pkg/controller/certificaterequests/ca/ca_test.go index f0a7ac2a6..3e66c8d31 100644 --- a/pkg/controller/certificaterequests/ca/ca_test.go +++ b/pkg/controller/certificaterequests/ca/ca_test.go @@ -54,7 +54,7 @@ func generateRSAPrivateKey(t *testing.T) *rsa.PrivateKey { return pk } -func generateCSR(t *testing.T, secretKey crypto.Signer) ([]byte, error) { +func generateCSR(t *testing.T, secretKey crypto.Signer) []byte { asn1Subj, _ := asn1.Marshal(pkix.Name{ CommonName: "test", }.ToRDNSequence()) @@ -65,12 +65,13 @@ func generateCSR(t *testing.T, secretKey crypto.Signer) ([]byte, error) { csrBytes, err := x509.CreateCertificateRequest(rand.Reader, &template, secretKey) if err != nil { - return nil, err + t.Error(err) + t.FailNow() } csr := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrBytes}) - return csr, nil + return csr } func generateSelfSignedCertFromCR(t *testing.T, cr *v1alpha1.CertificateRequest, key crypto.Signer, @@ -139,11 +140,7 @@ func TestSign(t *testing.T) { rsaPK := generateRSAPrivateKey(t) rsaPKBytes := pki.EncodePKCS1PrivateKey(rsaPK) - caCSR, err := generateCSR(t, rsaPK) - if err != nil { - t.Errorf("failed to generate CA CSR: %s", err) - t.FailNow() - } + caCSR := generateCSR(t, rsaPK) rootRSACR := gen.CertificateRequest("test-root-ca", gen.SetCertificateRequestCSR(caCSR), diff --git a/pkg/controller/certificaterequests/test/BUILD.bazel b/pkg/controller/certificaterequests/test/BUILD.bazel index c3512f25b..b26fa6343 100644 --- a/pkg/controller/certificaterequests/test/BUILD.bazel +++ b/pkg/controller/certificaterequests/test/BUILD.bazel @@ -6,10 +6,8 @@ go_library( importpath = "github.com/jetstack/cert-manager/pkg/controller/certificaterequests/test", visibility = ["//visibility:public"], deps = [ - "//pkg/apis/certmanager/v1alpha1:go_default_library", "//pkg/controller/test:go_default_library", "//pkg/issuer:go_default_library", - "//pkg/util/pki:go_default_library", ], ) diff --git a/pkg/controller/certificaterequests/test/util.go b/pkg/controller/certificaterequests/test/util.go index cecae3a6c..ac0a24ca7 100644 --- a/pkg/controller/certificaterequests/test/util.go +++ b/pkg/controller/certificaterequests/test/util.go @@ -17,60 +17,26 @@ limitations under the License. package test import ( - "bytes" - "crypto" - "crypto/rand" - "crypto/rsa" - "crypto/x509" - "crypto/x509/pkix" - "encoding/asn1" - "encoding/pem" "reflect" - "testing" - "time" - "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha1" testpkg "github.com/jetstack/cert-manager/pkg/controller/test" "github.com/jetstack/cert-manager/pkg/issuer" - "github.com/jetstack/cert-manager/pkg/util/pki" ) -func GenerateRSAPrivateKey(t *testing.T) *rsa.PrivateKey { - pk, err := pki.GenerateRSAPrivateKey(2048) - if err != nil { - t.Errorf("failed to generate private key: %v", err) - t.FailNow() - } - return pk -} - -func GenerateCSR(t *testing.T, secretKey crypto.Signer) []byte { - asn1Subj, _ := asn1.Marshal(pkix.Name{ - CommonName: "test", - }.ToRDNSequence()) - template := x509.CertificateRequest{ - RawSubject: asn1Subj, - SignatureAlgorithm: x509.SHA256WithRSA, - } - - csrBytes, err := x509.CreateCertificateRequest(rand.Reader, &template, secretKey) - if err != nil { - t.Error(err) - t.FailNow() - } - - csr := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrBytes}) - - return csr -} - +// Ensure issuer response from test is nil. func MustNoResponse(builder *testpkg.Builder, args ...interface{}) { - resp := args[0].(*issuer.IssueResponse) + resp, ok := args[0].(*issuer.IssueResponse) + if !ok { + builder.T.Errorf("unexpected argument to be of type IssuerResponse: %+v", args[0]) + } + if resp != nil { builder.T.Errorf("unexpected response, exp='nil' got='%+v'", resp) } } +// Ensure no private key exists in test response. +// Ensure no signed certificate or CA certificate in test response. func NoPrivateKeyFieldsSetCheck(expectedCA []byte) func(builder *testpkg.Builder, args ...interface{}) { return func(builder *testpkg.Builder, args ...interface{}) { resp := args[0].(*issuer.IssueResponse) @@ -89,6 +55,7 @@ func NoPrivateKeyFieldsSetCheck(expectedCA []byte) func(builder *testpkg.Builder } } +// Ensure no signed certificate or CA certificate in test response. func CertificatesFieldsSetCheck(expectedCA []byte) func(builder *testpkg.Builder, args ...interface{}) { return func(builder *testpkg.Builder, args ...interface{}) { resp := args[0].(*issuer.IssueResponse) @@ -101,26 +68,3 @@ func CertificatesFieldsSetCheck(expectedCA []byte) func(builder *testpkg.Builder } } } - -func GenerateSelfSignedCertFromCR(t *testing.T, cr *v1alpha1.CertificateRequest, key crypto.Signer, - duration time.Duration) (derBytes, pemBytes []byte) { - template, err := pki.GenerateTemplateFromCertificateRequest(cr) - if err != nil { - t.Errorf("error generating template: %v", err) - } - - derBytes, err = x509.CreateCertificate(rand.Reader, template, template, key.Public(), key) - if err != nil { - t.Errorf("error signing cert: %v", err) - t.FailNow() - } - - pemByteBuffer := bytes.NewBuffer([]byte{}) - err = pem.Encode(pemByteBuffer, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}) - if err != nil { - t.Errorf("failed to encode cert: %v", err) - t.FailNow() - } - - return derBytes, pemByteBuffer.Bytes() -} diff --git a/pkg/controller/certificaterequests/vault/BUILD.bazel b/pkg/controller/certificaterequests/vault/BUILD.bazel index 324bc8572..80a852b39 100644 --- a/pkg/controller/certificaterequests/vault/BUILD.bazel +++ b/pkg/controller/certificaterequests/vault/BUILD.bazel @@ -16,7 +16,6 @@ go_library( "//pkg/issuer:go_default_library", "//pkg/logs:go_default_library", "//pkg/util/api:go_default_library", - "//pkg/util/pki:go_default_library", "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library", "//vendor/k8s.io/client-go/listers/core/v1:go_default_library", "//vendor/k8s.io/client-go/tools/record:go_default_library", @@ -48,6 +47,7 @@ go_test( "//pkg/controller/test:go_default_library", "//pkg/internal/vault:go_default_library", "//pkg/internal/vault/fake:go_default_library", + "//pkg/util/pki:go_default_library", "//test/unit/gen:go_default_library", "//vendor/k8s.io/api/core/v1:go_default_library", "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library", diff --git a/pkg/controller/certificaterequests/vault/vault.go b/pkg/controller/certificaterequests/vault/vault.go index 78d93497a..d6040998b 100644 --- a/pkg/controller/certificaterequests/vault/vault.go +++ b/pkg/controller/certificaterequests/vault/vault.go @@ -33,7 +33,6 @@ import ( "github.com/jetstack/cert-manager/pkg/issuer" logf "github.com/jetstack/cert-manager/pkg/logs" "github.com/jetstack/cert-manager/pkg/util/api" - "github.com/jetstack/cert-manager/pkg/util/pki" ) const ( @@ -46,7 +45,7 @@ type Vault struct { secretsLister corelisters.SecretLister helper issuer.Helper - vaultFactory internal.VaultFactory + vaultClientBuilder internal.VaultClientBuilder } func init() { @@ -73,7 +72,7 @@ func NewVault(ctx *controllerpkg.Context) *Vault { ctx.SharedInformerFactory.Certmanager().V1alpha1().Issuers().Lister(), ctx.SharedInformerFactory.Certmanager().V1alpha1().ClusterIssuers().Lister(), ), - vaultFactory: vaultinternal.New, + vaultClientBuilder: vaultinternal.New, } } @@ -81,22 +80,9 @@ func (v *Vault) Sign(ctx context.Context, cr *v1alpha1.CertificateRequest, issue log := logf.FromContext(ctx, "sign") reporter := crutil.NewReporter(cr, v.recorder) - _, err := pki.DecodeX509CertificateRequestBytes(cr.Spec.CSRPEM) + client, err := v.vaultClientBuilder(cr.Namespace, v.secretsLister, issuerObj) if err != nil { - message := "Failed to decode CSR in spec" - - reporter.Failed(err, "ErrorParsingCSR", message) - log.Error(err, message) - - return nil, nil - } - - client, err := v.vaultFactory(cr.Namespace, v.secretsLister, issuerObj) - if err != nil { - log = log.WithValues( - logf.RelatedResourceNameKey, cr.Spec.IssuerRef.Name, - logf.RelatedResourceKindKey, cr.Spec.IssuerRef.Kind, - ) + log = logf.WithRelatedResource(log, issuerObj) if k8sErrors.IsNotFound(err) { message := "Required secret resource not found" @@ -111,7 +97,7 @@ func (v *Vault) Sign(ctx context.Context, cr *v1alpha1.CertificateRequest, issue reporter.Pending(err, "ErrorVaultInit", message) log.Error(err, message) - return nil, nil + return nil, err } certDuration := api.DefaultCertDuration(cr.Spec.Duration) diff --git a/pkg/controller/certificaterequests/vault/vault_test.go b/pkg/controller/certificaterequests/vault/vault_test.go index 1b1b17b33..2bebc7f23 100644 --- a/pkg/controller/certificaterequests/vault/vault_test.go +++ b/pkg/controller/certificaterequests/vault/vault_test.go @@ -18,6 +18,12 @@ package vault import ( "context" + "crypto" + "crypto/rand" + "crypto/x509" + "crypto/x509/pkix" + "encoding/asn1" + "encoding/pem" "errors" "testing" "time" @@ -32,25 +38,59 @@ import ( testpkg "github.com/jetstack/cert-manager/pkg/controller/test" internalvault "github.com/jetstack/cert-manager/pkg/internal/vault" fakevault "github.com/jetstack/cert-manager/pkg/internal/vault/fake" + "github.com/jetstack/cert-manager/pkg/util/pki" "github.com/jetstack/cert-manager/test/unit/gen" ) +func generateCSR(t *testing.T, secretKey crypto.Signer) []byte { + asn1Subj, _ := asn1.Marshal(pkix.Name{ + CommonName: "test", + }.ToRDNSequence()) + template := x509.CertificateRequest{ + RawSubject: asn1Subj, + SignatureAlgorithm: x509.SHA256WithRSA, + } + + csrBytes, err := x509.CreateCertificateRequest(rand.Reader, &template, secretKey) + if err != nil { + t.Error(err) + t.FailNow() + } + + csr := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrBytes}) + + return csr +} + func TestSign(t *testing.T) { - rsaPK := testcr.GenerateRSAPrivateKey(t) - caCSR := testcr.GenerateCSR(t, rsaPK) + rsaSK, err := pki.GenerateRSAPrivateKey(2048) + if err != nil { + t.Error(err) + t.FailNow() + } + + csrPEM := generateCSR(t, rsaSK) + + baseIssuer := gen.Issuer("vault-issuer", + gen.SetIssuerVault(v1alpha1.VaultIssuer{}), + ) testCR := gen.CertificateRequest("test-cr", - gen.SetCertificateRequestCSR(caCSR), gen.SetCertificateRequestIsCA(true), + gen.SetCertificateRequestCSR(csrPEM), gen.SetCertificateRequestDuration(&metav1.Duration{Duration: time.Hour * 24 * 60}), gen.SetCertificateRequestIssuer(v1alpha1.ObjectReference{ - Name: "vault-issuer", + Name: baseIssuer.Name, Group: certmanager.GroupName, - Kind: "Issuer", + Kind: baseIssuer.Kind, }), ) - _, rsaPEMCert := testcr.GenerateSelfSignedCertFromCR(t, testCR, rsaPK, time.Hour*24*60) + _, rsaPEMCert, err := pki.GenerateSelfSignedCertFromCR(testCR, rsaSK, time.Hour*24*60) + if err != nil { + t.Error(err) + t.FailNow() + } tokenSecret := &corev1.Secret{ ObjectMeta: metav1.ObjectMeta{ @@ -73,25 +113,8 @@ func TestSign(t *testing.T) { } tests := map[string]testT{ - "a badly formed CSR should report failure": { - issuer: gen.Issuer("vault-issuer"), - certificateRequest: gen.CertificateRequestFrom(testCR, - gen.SetCertificateRequestCSR([]byte("a bad csr")), - ), - builder: &testpkg.Builder{ - KubeObjects: []runtime.Object{}, - CertManagerObjects: []runtime.Object{}, - ExpectedEvents: []string{ - `Warning ErrorParsingCSR Failed to decode CSR in spec: error decoding certificate request PEM block`, - }, - CheckFn: testcr.MustNoResponse, - }, - expectedErr: false, - }, "no token or app role secret reference should report pending": { - issuer: gen.Issuer("vault-issuer", - gen.SetIssuerVault(v1alpha1.VaultIssuer{}), - ), + issuer: gen.IssuerFrom(baseIssuer), certificateRequest: testCR, builder: &testpkg.Builder{ KubeObjects: []runtime.Object{}, @@ -101,10 +124,10 @@ func TestSign(t *testing.T) { }, CheckFn: testcr.MustNoResponse, }, - expectedErr: false, + expectedErr: true, }, "a client with a token secret referenced that doesn't exist should report pending": { - issuer: gen.Issuer("vault-issuer", + issuer: gen.IssuerFrom(baseIssuer, gen.SetIssuerVault(v1alpha1.VaultIssuer{ Auth: v1alpha1.VaultAuth{ TokenSecretRef: v1alpha1.SecretKeySelector{ @@ -128,7 +151,7 @@ func TestSign(t *testing.T) { expectedErr: false, }, "a client with a app role secret referenced that doesn't exist should report pending": { - issuer: gen.Issuer("vault-issuer", + issuer: gen.IssuerFrom(baseIssuer, gen.SetIssuerVault(v1alpha1.VaultIssuer{ Auth: v1alpha1.VaultAuth{ AppRole: v1alpha1.VaultAppRole{ @@ -155,7 +178,7 @@ func TestSign(t *testing.T) { expectedErr: false, }, "a client with a token secret referenced with token but failed to sign should report fail": { - issuer: gen.Issuer("vault-issuer", + issuer: gen.IssuerFrom(baseIssuer, gen.SetIssuerVault(v1alpha1.VaultIssuer{ Auth: v1alpha1.VaultAuth{ TokenSecretRef: v1alpha1.SecretKeySelector{ @@ -180,7 +203,7 @@ func TestSign(t *testing.T) { expectedErr: false, }, "a client with a app role secret referenced with role but failed to sign should report fail": { - issuer: gen.Issuer("vault-issuer", + issuer: gen.IssuerFrom(baseIssuer, gen.SetIssuerVault(v1alpha1.VaultIssuer{ Auth: v1alpha1.VaultAuth{ AppRole: v1alpha1.VaultAppRole{ @@ -208,7 +231,7 @@ func TestSign(t *testing.T) { expectedErr: false, }, "a client with a token secret referenced with token and signs should return certificate": { - issuer: gen.Issuer("vault-issuer", + issuer: gen.IssuerFrom(baseIssuer, gen.SetIssuerVault(v1alpha1.VaultIssuer{ Auth: v1alpha1.VaultAuth{ TokenSecretRef: v1alpha1.SecretKeySelector{ @@ -231,7 +254,7 @@ func TestSign(t *testing.T) { expectedErr: false, }, "a client with a app role secret referenced with role should return certificate": { - issuer: gen.Issuer("vault-issuer", + issuer: gen.IssuerFrom(baseIssuer, gen.SetIssuerVault(v1alpha1.VaultIssuer{ Auth: v1alpha1.VaultAuth{ AppRole: v1alpha1.VaultAppRole{ @@ -283,7 +306,7 @@ func runTest(t *testing.T, test testT) { v := NewVault(test.builder.Context) if test.fakeVault != nil { - v.vaultFactory = test.fakeVault.New + v.vaultClientBuilder = test.fakeVault.New } test.builder.Sync() diff --git a/pkg/controller/test/BUILD.bazel b/pkg/controller/test/BUILD.bazel index 99618eaa5..0ff8b28b0 100644 --- a/pkg/controller/test/BUILD.bazel +++ b/pkg/controller/test/BUILD.bazel @@ -40,10 +40,7 @@ filegroup( filegroup( name = "all-srcs", - srcs = [ - ":package-srcs", - "//pkg/controller/test/fake:all-srcs", - ], + srcs = [":package-srcs"], tags = ["automanaged"], visibility = ["//visibility:public"], ) diff --git a/pkg/controller/test/fake/BUILD.bazel b/pkg/controller/test/fake/BUILD.bazel deleted file mode 100644 index f78bfa4d3..000000000 --- a/pkg/controller/test/fake/BUILD.bazel +++ /dev/null @@ -1,27 +0,0 @@ -load("@io_bazel_rules_go//go:def.bzl", "go_library") - -go_library( - name = "go_default_library", - srcs = ["lister.go"], - importpath = "github.com/jetstack/cert-manager/pkg/controller/test/fake", - visibility = ["//visibility:public"], - deps = [ - "//vendor/k8s.io/api/core/v1:go_default_library", - "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library", - "//vendor/k8s.io/client-go/listers/core/v1:go_default_library", - ], -) - -filegroup( - name = "package-srcs", - srcs = glob(["**"]), - tags = ["automanaged"], - visibility = ["//visibility:private"], -) - -filegroup( - name = "all-srcs", - srcs = [":package-srcs"], - tags = ["automanaged"], - visibility = ["//visibility:public"], -) diff --git a/pkg/controller/test/fake/lister.go b/pkg/controller/test/fake/lister.go deleted file mode 100644 index d8a6c41a0..000000000 --- a/pkg/controller/test/fake/lister.go +++ /dev/null @@ -1,75 +0,0 @@ -/* -Copyright 2019 The Jetstack cert-manager contributors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package fake - -import ( - corev1 "k8s.io/api/core/v1" - "k8s.io/apimachinery/pkg/labels" - clientcorev1 "k8s.io/client-go/listers/core/v1" -) - -var _ clientcorev1.SecretLister = &FakeSecretLister{} -var _ clientcorev1.SecretNamespaceLister = &FakeSecretNamespaceLister{} - -type FakeSecretLister struct { - ListFn func(selector labels.Selector) (ret []*corev1.Secret, err error) - SecretsFn func(namespace string) clientcorev1.SecretNamespaceLister -} - -type FakeSecretNamespaceLister struct { - ListFn func(selector labels.Selector) (ret []*corev1.Secret, err error) - GetFn func(name string) (ret *corev1.Secret, err error) -} - -func NewFakeSecretLister() *FakeSecretLister { - return &FakeSecretLister{ - ListFn: func(selector labels.Selector) (ret []*corev1.Secret, err error) { - return nil, nil - }, - - SecretsFn: func(namespace string) clientcorev1.SecretNamespaceLister { - return nil - }, - } -} - -func NewFakeSecretNamespaceLister() *FakeSecretNamespaceLister { - return &FakeSecretNamespaceLister{ - ListFn: func(selector labels.Selector) (ret []*corev1.Secret, err error) { - return nil, nil - }, - GetFn: func(name string) (ret *corev1.Secret, err error) { - return nil, nil - }, - } -} - -func (f *FakeSecretLister) List(selector labels.Selector) (ret []*corev1.Secret, err error) { - return f.ListFn(selector) -} - -func (f *FakeSecretLister) Secrets(namespace string) clientcorev1.SecretNamespaceLister { - return f.SecretsFn(namespace) -} - -func (f *FakeSecretNamespaceLister) List(selector labels.Selector) (ret []*corev1.Secret, err error) { - return f.ListFn(selector) -} - -func (f *FakeSecretNamespaceLister) Get(name string) (*corev1.Secret, error) { - return f.GetFn(name) -} diff --git a/pkg/internal/internal.go b/pkg/internal/internal.go index f85f8c9cc..0750a13ea 100644 --- a/pkg/internal/internal.go +++ b/pkg/internal/internal.go @@ -25,7 +25,7 @@ import ( "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha1" ) -type VaultFactory func(string, corelisters.SecretLister, v1alpha1.GenericIssuer) (Vault, error) +type VaultClientBuilder func(string, corelisters.SecretLister, v1alpha1.GenericIssuer) (Vault, error) type Vault interface { Sign(csrPEM []byte, duration time.Duration) (certPEM []byte, caPEM []byte, err error) diff --git a/pkg/internal/vault/BUILD.bazel b/pkg/internal/vault/BUILD.bazel index c5f574be8..da16a3ecd 100644 --- a/pkg/internal/vault/BUILD.bazel +++ b/pkg/internal/vault/BUILD.bazel @@ -21,7 +21,6 @@ go_test( embed = [":go_default_library"], deps = [ "//pkg/apis/certmanager/v1alpha1:go_default_library", - "//pkg/controller/test/fake:go_default_library", "//pkg/internal:go_default_library", "//pkg/internal/vault/fake:go_default_library", "//pkg/util/pki:go_default_library", @@ -29,6 +28,7 @@ go_test( "//vendor/github.com/hashicorp/vault/api:go_default_library", "//vendor/github.com/hashicorp/vault/helper/certutil:go_default_library", "//vendor/github.com/hashicorp/vault/helper/jsonutil:go_default_library", + "//vendor/github.com/jetstack/cert-manager/pkg/controller/test/fake:go_default_library", "//vendor/k8s.io/api/core/v1:go_default_library", ], ) diff --git a/pkg/internal/vault/fake/vault.go b/pkg/internal/vault/fake/vault.go index 9c4695e5e..48ce4d6bb 100644 --- a/pkg/internal/vault/fake/vault.go +++ b/pkg/internal/vault/fake/vault.go @@ -29,7 +29,7 @@ import ( var _ internal.Vault = &Vault{} type Vault struct { - NewFn internal.VaultFactory + NewFn internal.VaultClientBuilder SignFn func([]byte, time.Duration) ([]byte, []byte, error) } @@ -58,7 +58,7 @@ func (v *Vault) WithSign(certPEM, caPEM []byte, err error) *Vault { return v } -func (v *Vault) WithNew(f internal.VaultFactory) *Vault { +func (v *Vault) WithNew(f internal.VaultClientBuilder) *Vault { v.NewFn = f return v } diff --git a/pkg/util/pki/csr.go b/pkg/util/pki/csr.go index 3823f9046..2f66630a6 100644 --- a/pkg/util/pki/csr.go +++ b/pkg/util/pki/csr.go @@ -389,3 +389,24 @@ func SignatureAlgorithm(crt *v1alpha1.Certificate) (x509.PublicKeyAlgorithm, x50 } return pubKeyAlgo, sigAlgo, nil } + +func GenerateSelfSignedCertFromCR(cr *v1alpha1.CertificateRequest, key crypto.Signer, + duration time.Duration) (derBytes, pemBytes []byte, err error) { + template, err := GenerateTemplateFromCertificateRequest(cr) + if err != nil { + return nil, nil, fmt.Errorf("error generating template: %v", err) + } + + derBytes, err = x509.CreateCertificate(rand.Reader, template, template, key.Public(), key) + if err != nil { + return nil, nil, fmt.Errorf("error signing cert: %v", err) + } + + pemByteBuffer := bytes.NewBuffer([]byte{}) + err = pem.Encode(pemByteBuffer, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}) + if err != nil { + return nil, nil, fmt.Errorf("failed to encode cert: %v", err) + } + + return derBytes, pemByteBuffer.Bytes(), nil +} diff --git a/test/unit/gen/BUILD.bazel b/test/unit/gen/BUILD.bazel index 11e19f6ae..f7a5fec23 100644 --- a/test/unit/gen/BUILD.bazel +++ b/test/unit/gen/BUILD.bazel @@ -8,7 +8,6 @@ go_library( "challenge.go", "doc.go", "issuer.go", - "lister.go", "objectmeta.go", "order.go", ], @@ -16,10 +15,7 @@ go_library( visibility = ["//visibility:public"], deps = [ "//pkg/apis/certmanager/v1alpha1:go_default_library", - "//pkg/controller/test/fake:go_default_library", - "//vendor/k8s.io/api/core/v1:go_default_library", "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library", - "//vendor/k8s.io/client-go/listers/core/v1:go_default_library", ], ) diff --git a/test/unit/gen/lister.go b/test/unit/gen/lister.go deleted file mode 100644 index f91f72c76..000000000 --- a/test/unit/gen/lister.go +++ /dev/null @@ -1,68 +0,0 @@ -/* -Copyright 2019 The Jetstack cert-manager contributors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package gen - -import ( - corev1 "k8s.io/api/core/v1" - clientcorev1 "k8s.io/client-go/listers/core/v1" - - "github.com/jetstack/cert-manager/pkg/controller/test/fake" -) - -type FakeSecretListerModifier func(*fake.FakeSecretLister) -type FakeSecretNamespaceListerModifier func(*fake.FakeSecretNamespaceLister) - -func FakeSecretLister(mods ...FakeSecretListerModifier) *fake.FakeSecretLister { - s := fake.NewFakeSecretLister() - for _, mod := range mods { - mod(s) - } - return s -} - -func FakeSecretListerFrom(s *fake.FakeSecretLister, mods ...FakeSecretListerModifier) *fake.FakeSecretLister { - for _, mod := range mods { - mod(s) - } - return s -} - -func FakeSecretNamespaceLister(mods ...FakeSecretNamespaceListerModifier) *fake.FakeSecretNamespaceLister { - s := fake.NewFakeSecretNamespaceLister() - for _, mod := range mods { - mod(s) - } - return s -} - -func SetFakeSecretListerSecret(s func(namespace string) clientcorev1.SecretNamespaceLister) FakeSecretListerModifier { - return func(f *fake.FakeSecretLister) { - f.SecretsFn = s - } -} - -func SetFakeSecretNamespaceListerGet(sec *corev1.Secret, err error) FakeSecretListerModifier { - return func(f *fake.FakeSecretLister) { - f.SecretsFn = func(namespace string) clientcorev1.SecretNamespaceLister { - return &fake.FakeSecretNamespaceLister{ - GetFn: func(name string) (*corev1.Secret, error) { - return sec, err - }, - } - } - } -}