@@ -120,34 +120,41 @@ func generateRSACert(hosts []string, keyOut, certOut io.Writer) error {
120120 return nil
121121}
122122
123- // MustCreateCASignedCertSecret will create a secret using a CA Certificate, and public and private key for that certificate.
124- func MustCreateCASignedCertSecret (t * testing.T , namespace , secretName string , hosts []string ) * corev1.Secret {
123+ // MustCreateCASignedCertConfigMap will create a ConfigMap containing a CA Certificate, given a TLS Secret
124+ // for that CA certificate.
125+ func MustCreateCASignedCertConfigMap (t * testing.T , namespace , configMapName string , hosts []string ) * corev1.ConfigMap {
125126 require .NotEmpty (t , hosts , "require a non-empty hosts for Subject Alternate Name values" )
126127
127- var serverKey , serverCert bytes.Buffer
128-
129- require .NoError (t , generateCACert (hosts , & serverKey , & serverCert ), "failed to generate CA certificate" )
128+ caBytes , err := generateCACert (hosts )
129+ if err != nil {
130+ t .Errorf ("failed to generate CA certificate: %v" , err )
131+ return nil
132+ }
130133
131- data := map [string ][]byte {
132- corev1 .TLSCertKey : serverCert .Bytes (),
133- corev1 .TLSPrivateKeyKey : serverKey .Bytes (),
134+ var certData bytes.Buffer
135+ if err := pem .Encode (& certData , & pem.Block {Type : "CERTIFICATE" , Bytes : caBytes }); err != nil {
136+ t .Errorf ("failed creating cert: %w" , err )
137+ return nil
134138 }
135139
136- newSecret := & corev1.Secret {
140+ // Store the certificate in a ConfigMap.
141+ caConfigMap := & corev1.ConfigMap {
137142 ObjectMeta : metav1.ObjectMeta {
138143 Namespace : namespace ,
139- Name : secretName ,
144+ Name : configMapName ,
145+ },
146+ Data : map [string ]string {
147+ "ca.crt" : certData .String (),
140148 },
141- Type : corev1 .SecretTypeTLS ,
142- Data : data ,
143149 }
144-
145- return newSecret
150+ return caConfigMap
146151}
147152
148- // generateCACert generates a CA Certificate signed certificate valid for a year.
149- func generateCACert (hosts []string , keyOut , certOut io.Writer ) error {
150- // Create the CA certificate.
153+ // generateCACert generates a ConfigMap containing a CA Certificate signed certificate valid for a year.
154+ func generateCACert (hosts []string ) ([]byte , error ) {
155+ var caBytes []byte
156+
157+ // Create the CA certificate template.
151158 ca := & x509.Certificate {
152159 SerialNumber : big .NewInt (2024 ),
153160 Subject : pkix.Name {
@@ -162,7 +169,7 @@ func generateCACert(hosts []string, keyOut, certOut io.Writer) error {
162169 NotAfter : time .Now ().AddDate (1 , 0 , 0 ),
163170 IsCA : true , // Indicates this is a CA Certificate.
164171 ExtKeyUsage : []x509.ExtKeyUsage {x509 .ExtKeyUsageClientAuth , x509 .ExtKeyUsageServerAuth },
165- KeyUsage : x509 .KeyUsageDigitalSignature | x509 .KeyUsageCertSign ,
172+ KeyUsage : x509 .KeyUsageDigitalSignature | x509 .KeyUsageCertSign | x509 . KeyUsageKeyEncipherment ,
166173 BasicConstraintsValid : true ,
167174 }
168175
@@ -175,26 +182,19 @@ func generateCACert(hosts []string, keyOut, certOut io.Writer) error {
175182 }
176183 }
177184
178- // Generate the private key.
185+ // Generate the private key to sign certificates .
179186 caPrivKey , err := rsa .GenerateKey (rand .Reader , rsaBits )
180187 if err != nil {
181- return err
188+ return caBytes , fmt . Errorf ( "error generating key for CA: %v" , err )
182189 }
183190
184- // Generate the certificate using the CA certificate.
185- caBytes , err : =x509 .CreateCertificate (rand .Reader , ca , ca , & caPrivKey .PublicKey , caPrivKey )
191+ // Create the self-signed certificate using the CA certificate.
192+ caBytes , err = x509 .CreateCertificate (rand .Reader , ca , ca , & caPrivKey .PublicKey , caPrivKey )
186193 if err != nil {
187- return err
188- }
189-
190- if err := pem .Encode (certOut , & pem.Block {Type : "CERTIFICATE" , Bytes : caBytes }); err != nil {
191- return fmt .Errorf ("failed creating cert: %w" , err )
194+ return caBytes , fmt .Errorf ("error creating CA: %v" , err )
192195 }
193196
194- if err := pem .Encode (keyOut , & pem.Block {Type : "RSA PRIVATE KEY" , Bytes : x509 .MarshalPKCS1PrivateKey (caPrivKey )}); err != nil {
195- return fmt .Errorf ("failed creating key: %w" , err )
196- }
197- return nil
197+ return caBytes , nil
198198}
199199
200200// validateHost ensures that the host name length is no more than 253 characters.
0 commit comments