Skip to content

authentication: show more details when cert verification fails #130137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

authentication: show more details when cert verification fails #130137

wants to merge 1 commit into from

Conversation

vrutkovs
Copy link
Contributor

What type of PR is this?

/kind bug

What this PR does / why we need it:

Alongside serial number log line should include common name and issuer so that invalid certificate would be easier to identify. Hopefully this information is not considered sensitive and it can appear in log lines and error messages

Which issue(s) this PR fixes:

Fixes #129600

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Alongside Serial Number other certificate metadata is logged - namely Common Name and Issuer's Common Name

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

@vrutkovs
authentication: show more details when cert verification fails
e6332fd 
Alongside serial number log line should include common name and issuer
so that invalid certificate would be easier to identify.
Hopefully this information is not considered sensitive and it can
appear in log lines and error messages
@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. kind/bug Categorizes issue or PR as related to a bug. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 13, 2025
@k8s-ci-robot
Copy link
Contributor

Hi @vrutkovs. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added the needs-priority Indicates a PR lacks a `priority/foo` label and requires one. label Feb 13, 2025
@k8s-ci-robot k8s-ci-robot added area/apiserver sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Feb 13, 2025
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vrutkovs
Once this PR has been reviewed and has the lgtm label, please assign smarterclayton for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot mentioned this pull request Feb 13, 2025
Closed
@BenTheElder
Copy link
Member

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 13, 2025
@BenTheElder
Copy link
Member

/cc @enj

@k8s-ci-robot k8s-ci-robot requested a review from enj February 13, 2025 21:04
@vrutkovs
Copy link
Contributor Author

/test pull-kubernetes-unit

@enj
Copy link
Member

enj commented Feb 14, 2025

/hold

This is not a bug, the CN is not logged by design.

#129666 (comment)

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 14, 2025
@vrutkovs
Copy link
Contributor Author

oh well

@vrutkovs vrutkovs closed this Feb 14, 2025
@cici37
Copy link
Contributor

cici37 commented Feb 18, 2025

/triage accepted

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Feb 18, 2025
@vrutkovs vrutkovs mentioned this pull request Mar 3, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@hashim21223445 hashim21223445 hashim21223445 approved these changes

@deads2k deads2k Awaiting requested review from deads2k

@mikedanese mikedanese Awaiting requested review from mikedanese

@enj enj Awaiting requested review from enj

Assignees
No one assigned
Labels
area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. kind/bug Categorizes issue or PR as related to a bug. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
SIG Auth
Archived in project
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Certificate info in expire logs
6 participants
@vrutkovs @k8s-ci-robot @BenTheElder @enj @cici37 @hashim21223445