Updated CertificateValidationCallBack to build the CaCert bundle with respect to the rootChain certs to verify that they are correct.

[KLazarov]

Implemented fix proposed at: #859

Problem:

Currently the cert verification works only if there is no multi level CA chain that it needs to verify on. If the chain is too long, it will mark isTrusted as false.

Suggestion

Instead of trying to directly compare the certs, we actually build the cert with the help of the chain and verify that it's correct. If the cert or the chain are broken, then isTrusted will be false. If the chain and cert is correct, then isTrusted will be true.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: KLazarov (a3b6236, 40a2ec5)

[k8s-ci-robot]

Welcome @KLazarov!

It looks like this is your first PR to kubernetes-client/csharp 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-client/csharp has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[tg123]

could please sign cla and add testcases?

[KLazarov]

I have now added the tests for the issue that my code fixes. They are at the bottom of CertificateValidationTests.cs.

I'm still waiting from my company to completly fill out the EasyCLA as we got a bit stuck on it during the weekend.

[KLazarov]

The EasyCLA has now been accepted.

[tg123]

I looked into the code and seems your #859 code

chain.ChainPolicy.CustomTrustStore.Add(ca)

makes more sense

here the code is verifying if each ca cert on the cert's chain
should that be verifying cert's chain on a trusted ca?

what is your idea?

[KLazarov]

The issue that I stumbled upon and I'm trying to fix here is if there is a chain that is multiple steps long in a single file provided by the Service Account.

As we are running a managed Kubernetes cluster, we get our Certificates generated by the provider, and in our case there are multiple certificates in the same file, and they describe the full chain. From my understanding running chain.Build(cert) verifies that the cert that it tries to connect with is actually correctly generated from the Chain.

From what I see
chain.ChainPolicy.CustomTrustStore.Add(ca)
will not work, as it still needs to verify that the certificate, and it's easiest to do that using chain.Build(cert).

Do correct me if it's wrong/incorrect.

[tg123]

ok could you please also remove var rootCert = chain.ChainElements[chain.ChainElements.Count - 1].Certificate; since it is no longer used.

then /LTGM

[KLazarov]

Done.

[k8s-ci-robot]

@KLazarov: you cannot LGTM your own PR.

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[KLazarov]

Btw just read in the guide lines about squashing and commit message length: https://github.com/kubernetes/community/blob/master/contributors/guide/pull-requests.md#squashing

I will squash it into one commit tomorrow.

[tg123]

/LTGM

[tg123]

/

Btw just read in the guide lines about squashing and commit message length: https://github.com/kubernetes/community/blob/master/contributors/guide/pull-requests.md#squashing

I will squash it into one commit tomorrow.

you do not have to, it is automatic

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: KLazarov, tg123

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [tg123]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tg123]

/LGTM