search

cert-manager / trust-manager

trust-manager is an operator for distributing trust bundles across a Kubernetes cluster.
https://cert-manager.io/docs/projects/trust-manager/
Apache License 2.0
243 stars 65 forks source link

fix: should reconcile targets consistently #260

Closed erikgb closed 7 months ago

erikgb commented 8 months ago

When checking target keys using managed fields, we must also check binaryData field in target configmaps.

Fixes #259

inteon commented 8 months ago

@erikgb just for context, do you know why the extra reconciliations and patches keep happening? I would expect that the noop patches do not trigger new reconciliations.

erikgb commented 7 months ago

@inteon Neither the JKS nor PKCS#12 format is idempotent, so when the check for keys never match it will patch the target with changes. I really don't know why this didn't happen with JKS only. The added tests only fail on PKCS#12 without the fix...

inteon commented 7 months ago

@erikgb I think we explicitly try to make the JKS encoded value deterministic: https://github.com/cert-manager/trust-manager/blob/54e8b096c2faf5e2f11454739d2abd4f5a691f75/pkg/bundle/sync.go#L191-L193

inteon commented 7 months ago

@erikgb It looks like the pkcs#12 format is using a random salt, which makes it non-idempotent. see https://github.com/SSLMate/go-pkcs12/blob/v0.4.0/pkcs12.go#L704C5-L706

Now that I fully understand the cause of this issue and why it occurs for pkcs#12 & not for JKS, I'm more than happy to merge this. /approve /lgtm

jetstack-bot commented 7 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/cert-manager/trust-manager/blob/main/OWNERS)~~ [inteon] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
erikgb commented 7 months ago

/cherrypick release-0.7

jetstack-bot commented 7 months ago

@erikgb: new pull request created: #265

In response to [this](https://github.com/cert-manager/trust-manager/pull/260#issuecomment-1873826092): >/cherrypick release-0.7 Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.