fix: merge global agent CA certificates with cluster-specific ones#2816
fix: merge global agent CA certificates with cluster-specific ones#2816cyphercodes wants to merge 1 commit intokubernetes-client:mainfrom
Conversation
When system certificates are configured through the global https.agent, they were being ignored by the kubernetes-client because it provides its own dispatcher to undici. This fix merges the global agent's CA certificates with any cluster-specific CA certificates, ensuring that custom CAs configured via the global agent are respected. Fixes kubernetes-client#2546
k8s-ci-robot
added
the
do-not-merge/invalid-commit-message
|
Keywords which can automatically close issues and hashtag(#) mentions are not allowed in commit messages. The list of commits with invalid commit messages:
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: cyphercodes The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
cncf-cla: no
|
Welcome @cyphercodes! |
k8s-ci-robot
added
the
size/M
| // Merge global agent CA certificates with cluster-specific ones | ||
| const globalCA = (https.globalAgent as https.Agent).options?.ca; | ||
| if (globalCA !== undefined) { | ||
| tlsOptions.ca = globalCA; |
There was a problem hiding this comment.
What is the behavior if tlsOptions.ca is null/undefined? Wouldn't it fall back on the global CA anyway? Why is this necessary?
| if (agentOptions.ca !== undefined) { | ||
| // If both global and cluster CA exist, concatenate them | ||
| if (tlsOptions.ca !== undefined) { | ||
| const globalCAs = Array.isArray(tlsOptions.ca) ? tlsOptions.ca : [tlsOptions.ca]; |
There was a problem hiding this comment.
What is the use case for this? If there is a CA in the kubeconfig, that should be the CA for the server, the global CAs shouldn't be necessary.
3 participants
Description
When system certificates are configured through the global https.agent, they were being ignored by the kubernetes-client because it provides its own dispatcher to undici. This PR merges the global agent's CA certificates with any cluster-specific CA certificates, ensuring that custom CAs configured via the global agent are respected.
Changes
createDispatcherOptionsinsrc/config.tsto:https.globalAgent.options.caTesting
Added two new test cases:
should merge global agent CA with cluster CA- verifies that when both global and cluster CAs are present, they are concatenatedshould use global CA when no cluster CA is provided- verifies that global CA is used when no cluster CA is specifiedRelated Issue
Fixes #2546