From f0acf165642c1b5e8c0a47d5602ec2edd14a8e74 Mon Sep 17 00:00:00 2001 From: Serge Bazanski Date: Sat, 3 Oct 2020 16:49:51 +0200 Subject: [PATCH] prodvider: use SANs in service certificates This fixes compatibility with prodaccess tools built with Go 1.15, which introduced 'X.509 CommonName deprecation' [1]. [1] - https://golang.org/doc/go1.15#commonname Change-Id: I228cde3e5651a3e36f527783f2ccb4a2f6b7a8e3 --- cluster/kube/lib/prodvider.libsonnet | 2 +- cluster/prodvider/certs.go | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/cluster/kube/lib/prodvider.libsonnet b/cluster/kube/lib/prodvider.libsonnet index 8eaa8347..a4cb4382 100644 --- a/cluster/kube/lib/prodvider.libsonnet +++ b/cluster/kube/lib/prodvider.libsonnet @@ -9,7 +9,7 @@ local kube = import "../../../kube/kube.libsonnet"; cfg:: { namespace: "prodvider", - image: "registry.k0.hswaw.net/q3k/prodvider:1596298570-f3312ef77ed0db94e20944efc6395750072f54d5", + image: "registry.k0.hswaw.net/q3k/prodvider:1601735780-d6c072a90e70b467a77039daebe602c77b4a84a1", apiEndpoint: error "API endpoint must be set", diff --git a/cluster/prodvider/certs.go b/cluster/prodvider/certs.go index bed0e48b..309af1f7 100644 --- a/cluster/prodvider/certs.go +++ b/cluster/prodvider/certs.go @@ -57,6 +57,7 @@ func (p *prodvider) makeSelfCSR() ([]byte, []byte, error) { OU: signerCert.Subject.OrganizationalUnit[0], }, }, + Hosts: []string{flagProdviderCN}, } g := &csr.Generator{ @@ -68,7 +69,7 @@ func (p *prodvider) makeSelfCSR() ([]byte, []byte, error) { func (p *prodvider) makeSelfCertificate(csr []byte) ([]byte, error) { req := signer.SignRequest{ - Hosts: []string{}, + Hosts: []string{flagProdviderCN}, Request: string(csr), Profile: "server", }