awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into feat/allow-k8-dynamic-secret-multi-namespace-and-others

Browse Source
This commit is contained in:
Sheen Capadngan
2025-06-11 14:28:15 +08:00
parent b2fbec740f 0c1f761a9a
commit 78fd852588
7 changed files with 58 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
cli/packages/gateway/connection.go
View File

@@ -108,19 +108,17 @@ func handleStream(stream quic.Stream, quicConn quic.Connection) {
return
case "FORWARD-HTTP":
targetURL := ""
argParts := bytes.Split(args, []byte(" "))
if len(argParts) == 0 {
log.Error().Msg("FORWARD-HTTP requires target URL")
return
}
targetURL := string(argParts[0])
// ? note(daniel): special case: if the target URL is "/:0", we don't validate it.
// ? the reason for this is because we want to be able to send requests to the gateway without knowing the actual target URL, and instead let the gateway construct the target URL.
if targetURL != "/:0" && !isValidURL(targetURL) {
log.Error().Msgf("Invalid target URL: %s", targetURL)
return
if len(argParts) == 0 || len(argParts[0]) == 0 {
log.Warn().Msg("FORWARD-HTTP used without a target URL.")
} else {
targetURL = string(argParts[0])
if !isValidURL(targetURL) {
log.Error().Msgf("Invalid target URL: %s", targetURL)
return
}
}
// Parse optional parameters
@@ -208,8 +206,7 @@ func handleHTTPProxy(stream quic.Stream, reader *bufio.Reader, targetURL string,
}
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", string(token)))
log.Info().Msgf("Injected gateway k8s SA auth token in request to %s", targetURL)
} else if actionHeader == HttpProxyActionUseGatewayK8sServiceAccount {
} else if actionHeader == HttpProxyActionUseGatewayK8sServiceAccount { // will work without a target URL set
// set the ca cert to the pod's k8s service account ca cert:
caCert, err := os.ReadFile(KUBERNETES_SERVICE_ACCOUNT_CA_CERT_PATH)
if err != nil {
@@ -218,9 +215,7 @@ func handleHTTPProxy(stream quic.Stream, reader *bufio.Reader, targetURL string,
}
caCertPool := x509.NewCertPool()
appendSuccess := caCertPool.AppendCertsFromPEM(caCert)
if !appendSuccess {
if ok := caCertPool.AppendCertsFromPEM(caCert); !ok {
stream.Write([]byte(buildHttpInternalServerError("failed to parse k8s sa ca cert")))
continue
}