cyberark / conjur-authn-k8s-client

Authentication sidecar for Conjur Kubernetes integration.
https://www.conjur.org
Apache License 2.0
11 stars 14 forks source link

Update get-conjur-cert script to ask user to trust the certificate #297

Closed izgeri closed 3 years ago

izgeri commented 3 years ago

In order to avoid possible MitM attacks, our get-conjur-cert.sh script should show the fingerprint to the user and ask if they'd like to trust the certificate. The logic can follow what the Python CLI does here: https://github.com/cyberark/conjur-api-python3/blob/a847bf6a9e3bf89d843543f1781c00dbdb5456b5/conjur/controller/init_controller.py#L116-L122

If the user opts NOT to trust the certificate, the script will need to error and print a message alerting the user that the valid Conjur PEM-encoded x509 CA certificate chain will need to be retrieved in order to continue.

AC:

rpothier commented 3 years ago

Closing now that both issues are in.