Comments (2)
I tested this a bit locally and I think what's happening is simply that keytool can't parse the file. Still worth a fix, but we're not making an empty p12 - we're just making one that keytool can't read.
Our tests do check that a passwordless file can be read - but obviously they're using our pkcs12 library which can read passwordless files.
The library says this:
Passwordless encodes PKCS#12 files without any encryption or MACs. A lot of software has trouble reading such files, so it's probably only useful for creating Java trust stores using Encoder.EncodeTrustStore or Encoder.EncodeTrustStoreEntries.
I've confirmed that the following patch creates a passwordless PKCS#12 file that keytool can read:
diff --git a/pkg/bundle/sync.go b/pkg/bundle/sync.go
index 1966af0..ea36eaf 100644
--- a/pkg/bundle/sync.go
+++ b/pkg/bundle/sync.go
@@ -320,7 +320,13 @@ func (e pkcs12Encoder) encode(trustBundle string) ([]byte, error) {
})
}
- return pkcs12.LegacyRC2.EncodeTrustStoreEntries(entries, e.password)
+ encoder := pkcs12.LegacyRC2
+
+ if e.password == "" {
+ encoder = pkcs12.Passwordless
+ }
+
+ return encoder.EncodeTrustStoreEntries(entries, e.password)
}
// syncConfigMapTarget syncs the given data to the target ConfigMap in the given namespace.
And I've also confirmed that the resulting file is readable by our tests. I'd like to check with the team if we're happy to make that change in general.
from trust-manager.
Thanks for the investigation, @SgtCoDFish! I submitted the PR adding PKCS#12 support, and I should have tested the truststore with keytool
. Java applications probably represent the far majority of consumers of PKCS#12 truststores in trust-manager, and it would be a pity if the Java keytool
cannot read it. I am highly positive about your suggested change! 👍
from trust-manager.
Related Issues (20)
- No flag to set structured logging format, e.g. JSON? HOT 2
- Using `trust-manager` for generating keystores HOT 5
- Evaluate trust namespace value as template
- Init Container cert-manager-package-debian Helm Chart should allow resource requests and limits HOT 1
- Allow all resources to be namespaced
- trust-manager deduplication doesnt work HOT 15
- Add support to s390x arch HOT 9
- Add support for kubectl installation HOT 4
- Add matchExpressions to Bundle's spec.target.namespaceSelector HOT 5
- Avoid multiple decode/encode of certificates HOT 12
- Provide deterministic bundle HOT 12
- Wrong labels in topologySpreadConstraints example in the Helm chart values
- Chart is not allowing to pass Certificate Issuer name through value.yaml
- Document a policy around immutable image tags HOT 1
- Support RSA Keys HOT 6
- Helm chart support dual stack clusters
- Allow to specify admission webhooks CA from Bundle HOT 3
- Empty Target field in kubectl get bundle HOT 3
- Additional formats won't generate HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from trust-manager.