github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-19 04:26:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: preserve ca-bundles injected from external providers (#1948)

Browse Source 
* fix: preserve ca-bundles injected from external providers  (#1948)

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
This commit is contained in:
Oliver Bähler
2026-06-04 12:55:57 +02:00
committed by GitHub
parent a6927c5777
commit 780be87869
3 changed files with 103 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controllers/admission/mutating.go
+51 -4
View File
@@ -144,14 +144,27 @@ func (r *mutatingReconciler) reconcileConfiguration(
obj.SetAnnotations(annotations)
// Preserve existing CA Information (cert-manager)
existingCABundles := mutatingWebhookCABundlesByName(obj.Webhooks)
obj.Webhooks = desiredHooks
caCert, err := tls.FetchCurrentCaBundleForAdmission(ctx, r.client, r.configuration, cfg.Client.CABundle)
if err != nil {
return err
var caCert []byte
if r.configuration.EnableTLSConfiguration() {
caCert, err = tls.FetchCurrentCaBundleForAdmission(ctx, r.client, r.configuration)
if err != nil {
return err
}
} else {
caCert = cfg.Client.CABundle
}
preserveMutatingWebhookCABundles(obj.Webhooks, caCert)
if len(caCert) > 0 {
preserveMutatingWebhookCABundles(obj.Webhooks, caCert)
} else {
restoreMutatingWebhookCABundles(obj.Webhooks, existingCABundles)
}
return err
})
@@ -222,10 +235,44 @@ func (r *mutatingReconciler) webhooks(
return hooks, nil
}
func mutatingWebhookCABundlesByName(
hooks []admissionv1.MutatingWebhook,
) map[string][]byte {
out := make(map[string][]byte, len(hooks))
for _, hook := range hooks {
if hook.Name == "" || len(hook.ClientConfig.CABundle) == 0 {
continue
}
out[hook.Name] = append([]byte(nil), hook.ClientConfig.CABundle...)
}
return out
}
func restoreMutatingWebhookCABundles(
hooks []admissionv1.MutatingWebhook,
existingCABundles map[string][]byte,
) {
for i := range hooks {
existingCABundle := existingCABundles[hooks[i].Name]
if len(existingCABundle) == 0 {
continue
}
hooks[i].ClientConfig.CABundle = append([]byte(nil), existingCABundle...)
}
}
func preserveMutatingWebhookCABundles(
hooks []admissionv1.MutatingWebhook,
caBundle []byte,
) {
if len(caBundle) == 0 {
return
}
for i := range hooks {
hooks[i].ClientConfig.CABundle = append([]byte(nil), caBundle...)
}
internal/controllers/admission/validating.go
+51 -4
View File
@@ -146,14 +146,27 @@ func (r *validatingReconciler) reconcileValidatingConfiguration(
obj.SetAnnotations(annotations)
// Preserve existing CA Information (cert-manager)
existingCABundles := validatingWebhookCABundlesByName(obj.Webhooks)
obj.Webhooks = desiredHooks
caCert, err := tls.FetchCurrentCaBundleForAdmission(ctx, r.client, r.configuration, cfg.Client.CABundle)
if err != nil {
return err
var caCert []byte
if r.configuration.EnableTLSConfiguration() {
caCert, err = tls.FetchCurrentCaBundleForAdmission(ctx, r.client, r.configuration)
if err != nil {
return err
}
} else {
caCert = cfg.Client.CABundle
}
preserveValidatingWebhookCABundles(obj.Webhooks, caCert)
if len(caCert) > 0 {
preserveValidatingWebhookCABundles(obj.Webhooks, caCert)
} else {
restoreValidatingWebhookCABundles(obj.Webhooks, existingCABundles)
}
return err
})
@@ -224,10 +237,44 @@ func (r *validatingReconciler) validatingWebhooks(
return hooks, nil
}
func validatingWebhookCABundlesByName(
hooks []admissionv1.ValidatingWebhook,
) map[string][]byte {
out := make(map[string][]byte, len(hooks))
for _, hook := range hooks {
if hook.Name == "" || len(hook.ClientConfig.CABundle) == 0 {
continue
}
out[hook.Name] = append([]byte(nil), hook.ClientConfig.CABundle...)
}
return out
}
func restoreValidatingWebhookCABundles(
hooks []admissionv1.ValidatingWebhook,
existingCABundles map[string][]byte,
) {
for i := range hooks {
existingCABundle := existingCABundles[hooks[i].Name]
if len(existingCABundle) == 0 {
continue
}
hooks[i].ClientConfig.CABundle = append([]byte(nil), existingCABundle...)
}
}
func preserveValidatingWebhookCABundles(
hooks []admissionv1.ValidatingWebhook,
caBundle []byte,
) {
if len(caBundle) == 0 {
return
}
for i := range hooks {
hooks[i].ClientConfig.CABundle = append([]byte(nil), caBundle...)
}
internal/controllers/tls/utils.go
+1 -8
View File
@@ -141,13 +141,7 @@ func FetchCurrentCaBundleForAdmission(
ctx context.Context,
c client.Reader,
cfg configuration.Configuration,
configuredCABundle []byte,
) ([]byte, error) {
// Explicit configuration wins.
if len(configuredCABundle) > 0 {
return append([]byte(nil), configuredCABundle...), nil
}
// Internal Capsule TLS enabled: source of truth is the TLS Secret.
if cfg.EnableTLSConfiguration() {
secret := &corev1.Secret{}
@@ -175,7 +169,6 @@ func FetchCurrentCaBundleForAdmission(
return append([]byte(nil), caBundle...), nil
}
// cert-manager / external injector mode:
// return nil and preserve current webhook caBundle.
// TLS Controller not enabled
return nil, nil
}