Update certificate validation to use custom trust store for .NET 5.0+ #1653
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
k8s-ci-robot
added
approved
There was a problem hiding this comment.
Pull Request Overview
This PR updates certificate validation to use .NET 5.0+ custom trust store functionality for more secure certificate validation against Kubernetes clusters. The changes ensure that only explicitly trusted CA certificates are used for validation, rather than allowing unknown certificate authorities.
- Replaces legacy
ExtraStoreandAllowUnknownCertificateAuthoritywith modernCustomTrustStoreandCustomRootTrust - Adds platform compatibility check with explicit exception for unsupported platforms
- Introduces comprehensive test coverage for certificate validation rejection scenarios
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| src/KubernetesClient/Kubernetes.ConfigInit.cs | Updates certificate validation logic to use .NET 5.0+ custom trust store |
| tests/KubernetesClient.Tests/CertificateValidationTests.cs | Adds test to verify rejection of certificates from untrusted CAs |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| req.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.KeyEncipherment, true)); | ||
| req.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(new OidCollection { new Oid("1.3.6.1.5.5.7.3.1") }, true)); | ||
|
|
||
| return req.Create(issuerCA, DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(90), new byte[] { 1, 2, 3, 4 }); |
There was a problem hiding this comment.
The serial number byte array { 1, 2, 3, 4 } is a magic value. Consider defining it as a named constant or generating a proper serial number to make the test more maintainable.
Copilot uses AI. Check for mistakes.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: brendandburns, tg123 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
removed
the
lgtm
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
/lgtm |
k8s-ci-robot
added
the
lgtm
k8s-ci-robot
merged commit 1f8e5da
into
kubernetes-client:master
No description provided.