awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 11:27:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(dynamic-secrets/k8s): fix for SSL when not using gateway

Browse Source
This commit is contained in:
Daniel Hougaard
2025-06-23 21:18:15 +04:00
parent 4c8063c532
commit 90588bc3c9
1 changed files with 38 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/dynamic-secret/providers/kubernetes.ts
+38 -23
View File
@@ -52,9 +52,8 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
gatewayId: string; gatewayId: string;
targetHost: string; targetHost: string;
targetPort: number; targetPort: number;
caCert?: string; httpsAgent?: https.Agent;
reviewTokenThroughGateway: boolean; reviewTokenThroughGateway: boolean;
enableSsl: boolean;
}, },
gatewayCallback: (host: string, port: number, httpsAgent?: https.Agent) => Promise<T> gatewayCallback: (host: string, port: number, httpsAgent?: https.Agent) => Promise<T>
): Promise<T> => { ): Promise<T> => {
@@ -85,10 +84,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
key: relayDetails.privateKey.toString() key: relayDetails.privateKey.toString()
}, },
// we always pass this, because its needed for both tcp and http protocol // we always pass this, because its needed for both tcp and http protocol
httpsAgent: new https.Agent({ httpsAgent: inputs.httpsAgent
ca: inputs.caCert,
rejectUnauthorized: inputs.enableSsl
})
} }
); );
@@ -311,6 +307,14 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
const k8sHost = `${url.protocol}//${url.hostname}`; const k8sHost = `${url.protocol}//${url.hostname}`;
try { try {
const httpsAgent =
providerInputs.ca && providerInputs.sslEnabled
? new https.Agent({
ca: providerInputs.ca,
rejectUnauthorized: true
})
: undefined;
if (providerInputs.gatewayId) { if (providerInputs.gatewayId) {
if (providerInputs.authMethod === KubernetesAuthMethod.Gateway) { if (providerInputs.authMethod === KubernetesAuthMethod.Gateway) {
await $gatewayProxyWrapper( await $gatewayProxyWrapper(
@@ -318,8 +322,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
gatewayId: providerInputs.gatewayId, gatewayId: providerInputs.gatewayId,
targetHost: k8sHost, targetHost: k8sHost,
targetPort: k8sPort, targetPort: k8sPort,
enableSsl: providerInputs.sslEnabled, httpsAgent,
caCert: providerInputs.ca,
reviewTokenThroughGateway: true reviewTokenThroughGateway: true
}, },
providerInputs.credentialType === KubernetesCredentialType.Static providerInputs.credentialType === KubernetesCredentialType.Static
@@ -332,8 +335,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
gatewayId: providerInputs.gatewayId, gatewayId: providerInputs.gatewayId,
targetHost: k8sGatewayHost, targetHost: k8sGatewayHost,
targetPort: k8sPort, targetPort: k8sPort,
enableSsl: providerInputs.sslEnabled, httpsAgent,
caCert: providerInputs.ca,
reviewTokenThroughGateway: false reviewTokenThroughGateway: false
}, },
providerInputs.credentialType === KubernetesCredentialType.Static providerInputs.credentialType === KubernetesCredentialType.Static
@@ -342,9 +344,9 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
); );
} }
} else if (providerInputs.credentialType === KubernetesCredentialType.Static) { } else if (providerInputs.credentialType === KubernetesCredentialType.Static) {
await serviceAccountStaticCallback(k8sHost, k8sPort); await serviceAccountStaticCallback(k8sHost, k8sPort, httpsAgent);
} else { } else {
await serviceAccountDynamicCallback(k8sHost, k8sPort); await serviceAccountDynamicCallback(k8sHost, k8sPort, httpsAgent);
} }
return true; return true;
@@ -546,6 +548,15 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
try { try {
let tokenData; let tokenData;
const httpsAgent =
providerInputs.ca && providerInputs.sslEnabled
? new https.Agent({
ca: providerInputs.ca,
rejectUnauthorized: true
})
: undefined;
if (providerInputs.gatewayId) { if (providerInputs.gatewayId) {
if (providerInputs.authMethod === KubernetesAuthMethod.Gateway) { if (providerInputs.authMethod === KubernetesAuthMethod.Gateway) {
tokenData = await $gatewayProxyWrapper( tokenData = await $gatewayProxyWrapper(
@@ -553,8 +564,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
gatewayId: providerInputs.gatewayId, gatewayId: providerInputs.gatewayId,
targetHost: k8sHost, targetHost: k8sHost,
targetPort: k8sPort, targetPort: k8sPort,
enableSsl: providerInputs.sslEnabled, httpsAgent,
caCert: providerInputs.ca,
reviewTokenThroughGateway: true reviewTokenThroughGateway: true
}, },
providerInputs.credentialType === KubernetesCredentialType.Static providerInputs.credentialType === KubernetesCredentialType.Static
@@ -567,8 +577,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
gatewayId: providerInputs.gatewayId, gatewayId: providerInputs.gatewayId,
targetHost: k8sGatewayHost, targetHost: k8sGatewayHost,
targetPort: k8sPort, targetPort: k8sPort,
enableSsl: providerInputs.sslEnabled, httpsAgent,
caCert: providerInputs.ca,
reviewTokenThroughGateway: false reviewTokenThroughGateway: false
}, },
providerInputs.credentialType === KubernetesCredentialType.Static providerInputs.credentialType === KubernetesCredentialType.Static
@@ -579,8 +588,8 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
} else { } else {
tokenData = tokenData =
providerInputs.credentialType === KubernetesCredentialType.Static providerInputs.credentialType === KubernetesCredentialType.Static
? await tokenRequestStaticCallback(k8sHost, k8sPort) ? await tokenRequestStaticCallback(k8sHost, k8sPort, httpsAgent)
: await serviceAccountDynamicCallback(k8sHost, k8sPort); : await serviceAccountDynamicCallback(k8sHost, k8sPort, httpsAgent);
} }
return { return {
@@ -684,6 +693,14 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
const k8sPort = url.port ? Number(url.port) : 443; const k8sPort = url.port ? Number(url.port) : 443;
const k8sHost = `${url.protocol}//${url.hostname}`; const k8sHost = `${url.protocol}//${url.hostname}`;
const httpsAgent =
providerInputs.ca && providerInputs.sslEnabled
? new https.Agent({
ca: providerInputs.ca,
rejectUnauthorized: true
})
: undefined;
if (providerInputs.gatewayId) { if (providerInputs.gatewayId) {
if (providerInputs.authMethod === KubernetesAuthMethod.Gateway) { if (providerInputs.authMethod === KubernetesAuthMethod.Gateway) {
await $gatewayProxyWrapper( await $gatewayProxyWrapper(
@@ -691,8 +708,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
gatewayId: providerInputs.gatewayId, gatewayId: providerInputs.gatewayId,
targetHost: k8sHost, targetHost: k8sHost,
targetPort: k8sPort, targetPort: k8sPort,
enableSsl: providerInputs.sslEnabled, httpsAgent,
caCert: providerInputs.ca,
reviewTokenThroughGateway: true reviewTokenThroughGateway: true
}, },
serviceAccountDynamicCallback serviceAccountDynamicCallback
@@ -703,15 +719,14 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
gatewayId: providerInputs.gatewayId, gatewayId: providerInputs.gatewayId,
targetHost: k8sGatewayHost, targetHost: k8sGatewayHost,
targetPort: k8sPort, targetPort: k8sPort,
enableSsl: providerInputs.sslEnabled, httpsAgent,
caCert: providerInputs.ca,
reviewTokenThroughGateway: false reviewTokenThroughGateway: false
}, },
serviceAccountDynamicCallback serviceAccountDynamicCallback
); );
} }
} else { } else {
await serviceAccountDynamicCallback(k8sHost, k8sPort); await serviceAccountDynamicCallback(k8sHost, k8sPort, httpsAgent);
} }
} }