diff options
Diffstat (limited to 'certServiceK8sExternalProvider/src/cmpv2provisioner')
4 files changed, 74 insertions, 13 deletions
diff --git a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner.go b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner.go index ee65b3cb..dc2824ce 100644 --- a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner.go +++ b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner.go @@ -3,7 +3,7 @@ * oom-certservice-k8s-external-provider * ================================================================================ * Copyright (c) 2019 Smallstep Labs, Inc. - * Modifications copyright (C) 2020 Nokia. All rights reserved. + * Copyright (C) 2020-2021 Nokia. All rights reserved. * ================================================================================ * This source code was copied from the following git repository: * https://github.com/smallstep/step-issuer @@ -29,13 +29,13 @@ import ( "context" "sync" - certmanager "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1" "k8s.io/apimachinery/pkg/types" "onap.org/oom-certservice/k8s-external-provider/src/certserviceclient" "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner/csr" "onap.org/oom-certservice/k8s-external-provider/src/leveledlogger" + "onap.org/oom-certservice/k8s-external-provider/src/model" ) var collection = new(sync.Map) @@ -86,10 +86,17 @@ func Store(namespacedName types.NamespacedName, provisioner *CertServiceCA) { func (ca *CertServiceCA) Sign( ctx context.Context, - certificateRequest *certmanager.CertificateRequest, - privateKeyBytes []byte, + signCertificateModel model.SignCertificateModel, ) (signedCertificateChain []byte, trustedCertificates []byte, err error) { log := leveledlogger.GetLoggerWithName("certservice-provisioner") + + if signCertificateModel.IsUpdateRevision { + log.Debug("Certificate will be updated.", "old-certificate", signCertificateModel.OldCertificate, + "old-private-key", signCertificateModel.OldPrivateKey) + } + + certificateRequest := signCertificateModel.CertificateRequest + privateKeyBytes := signCertificateModel.PrivateKeyBytes log.Info("Signing certificate: ", "cert-name", certificateRequest.Name) log.Info("CA: ", "name", ca.name, "url", ca.url) @@ -103,9 +110,19 @@ func (ca *CertServiceCA) Sign( } log.Debug("Filtered out CSR PEM: ", "bytes", filteredCsrBytes) - response, err := ca.certServiceClient.GetCertificates(filteredCsrBytes, privateKeyBytes) - if err != nil { - return nil, nil, err + var response *certserviceclient.CertificatesResponse + var errAPI error + + if signCertificateModel.IsUpdateRevision { + log.Info("Attempt to send certificate update request") + response, errAPI = ca.certServiceClient.UpdateCertificate(filteredCsrBytes, privateKeyBytes, signCertificateModel) + } else { + log.Info("Attempt to send certificate request") + response, errAPI = ca.certServiceClient.GetCertificates(filteredCsrBytes, privateKeyBytes) + } + + if errAPI != nil { + return nil, nil, errAPI } log.Info("Successfully received response from CertService API") log.Debug("Certificate Chain", "cert-chain", response.CertificateChain) diff --git a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory.go b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory.go index cf55266c..ee06be33 100644 --- a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory.go +++ b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory.go @@ -2,7 +2,7 @@ * ============LICENSE_START======================================================= * oom-certservice-k8s-external-provider * ================================================================================ - * Copyright (C) 2020 Nokia. All rights reserved. + * Copyright (C) 2020-2021 Nokia. All rights reserved. * ================================================================================ * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -51,7 +51,7 @@ func (f *ProvisionerFactoryImpl) CreateProvisioner(issuer *cmpv2api.CMPv2Issuer, return nil, err } - certServiceClient, err := certserviceclient.CreateCertServiceClient(issuer.Spec.URL, issuer.Spec.HealthEndpoint, issuer.Spec.CertEndpoint, + certServiceClient, err := certserviceclient.CreateCertServiceClient(issuer.Spec.URL, issuer.Spec.HealthEndpoint, issuer.Spec.CertEndpoint, issuer.Spec.UpdateEndpoint, issuer.Spec.CaName, keyBase64, certBase64, cacertBase64) if err != nil { return nil, err diff --git a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory_mock.go b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory_mock.go index f2ffa860..cb3b8c63 100644 --- a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory_mock.go +++ b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory_mock.go @@ -2,7 +2,7 @@ * ============LICENSE_START======================================================= * oom-certservice-k8s-external-provider * ================================================================================ - * Copyright (C) 2020 Nokia. All rights reserved. + * Copyright (C) 2020-2021 Nokia. All rights reserved. * ================================================================================ * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -26,6 +26,7 @@ import ( "onap.org/oom-certservice/k8s-external-provider/src/certserviceclient" "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner/testdata" + "onap.org/oom-certservice/k8s-external-provider/src/model" ) type ProvisionerFactoryMock struct { @@ -37,6 +38,9 @@ func (f *ProvisionerFactoryMock) CreateProvisioner(issuer *cmpv2api.CMPv2Issuer, GetCertificatesFunc: func(csr []byte, pk []byte) (response *certserviceclient.CertificatesResponse, e error) { return &testdata.SampleCertServiceResponse, nil }, + UpdateCertificateFunc: func(csr []byte, key []byte, signCertificateModel model.SignCertificateModel) (*certserviceclient.CertificatesResponse, error) { + return &testdata.SampleCertServiceResponse, nil + }, }) return provisioner, err diff --git a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_test.go b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_test.go index cfafe959..1a066657 100644 --- a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_test.go +++ b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_test.go @@ -2,7 +2,7 @@ * ============LICENSE_START======================================================= * oom-certservice-k8s-external-provider * ================================================================================ - * Copyright (C) 2020 Nokia. All rights reserved. + * Copyright (C) 2020-2021 Nokia. All rights reserved. * ================================================================================ * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -32,6 +32,7 @@ import ( "onap.org/oom-certservice/k8s-external-provider/src/certserviceclient" "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" + "onap.org/oom-certservice/k8s-external-provider/src/model" "onap.org/oom-certservice/k8s-external-provider/src/testdata" ) @@ -64,7 +65,7 @@ func Test_shouldSuccessfullyLoadPreviouslyStoredProvisioner(t *testing.T) { assert.Equal(t, provisioner.url, issuer.Spec.URL, "Unexpected provisioner url.") } -func Test_shouldReturnCorrectSignedPemsWhenParametersAreCorrect(t *testing.T) { +func Test_shouldReturnCorrectSignedPemsWhenParametersAreCorrectForCertificateRequest(t *testing.T) { issuer := createIssuerAndCerts(ISSUER_NAME, ISSUER_URL) provisionerFactory := ProvisionerFactoryMock{} provisioner, err := provisionerFactory.CreateProvisioner(&issuer, apiv1.Secret{}) @@ -80,7 +81,46 @@ func Test_shouldReturnCorrectSignedPemsWhenParametersAreCorrect(t *testing.T) { request := createCertificateRequest() privateKeyBytes := getPrivateKeyBytes() - signedPEM, trustedCAs, err := provisioner.Sign(ctx, request, privateKeyBytes) + signCertificateModel := model.SignCertificateModel{ + CertificateRequest: request, + PrivateKeyBytes: privateKeyBytes, + IsUpdateRevision: false, + OldCertificate: "", + OldPrivateKey: "", + } + + signedPEM, trustedCAs, err := provisioner.Sign(ctx, signCertificateModel) + + assert.Nil(t, err) + + testdata.VerifyCertsAreEqualToExpected(t, signedPEM, trustedCAs) +} + +func Test_shouldReturnCorrectSignedPemsWhenParametersAreCorrectForUpdateCertificateRequest(t *testing.T) { + issuer := createIssuerAndCerts(ISSUER_NAME, ISSUER_URL) + provisionerFactory := ProvisionerFactoryMock{} + provisioner, err := provisionerFactory.CreateProvisioner(&issuer, apiv1.Secret{}) + + issuerNamespaceName := testdata.CreateIssuerNamespaceName(ISSUER_NAMESPACE, ISSUER_NAME) + Store(issuerNamespaceName, provisioner) + + provisioner, ok := Load(issuerNamespaceName) + + testdata.VerifyThatConditionIsTrue(ok, "Provisioner could not be loaded", t) + + ctx := context.Background() + request := createCertificateRequest() + privateKeyBytes := getPrivateKeyBytes() + + signCertificateModel := model.SignCertificateModel{ + CertificateRequest: request, + PrivateKeyBytes: privateKeyBytes, + IsUpdateRevision: true, + OldCertificate: testdata.OldCertificateEncoded, + OldPrivateKey: testdata.OldPrivateKeyEncoded, + } + + signedPEM, trustedCAs, err := provisioner.Sign(ctx, signCertificateModel) assert.Nil(t, err) |