docker/buildx
1
0
Fork 0
mirror of https://gitea.com/Lydanne/buildx.git synced 2025-07-24 20:28:02 +08:00
Code Issues Packages Projects Releases 1 Wiki Activity

vendor: bump k8s dependencies to v0.29.2

Browse Source 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
This commit is contained in:
CrazyMax
2024-02-24 16:41:41 +01:00
parent ae0a5e495a
commit 303e509bbf
761 changed files with 66147 additions and 29461 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
vendor/k8s.io/client-go/transport/transport.go generated vendored
View File

@@ -96,6 +96,32 @@ func TLSConfigFor(c *Config) (*tls.Config, error) {
}
if c.HasCA() {
/*
kubernetes mutual (2-way) x509 between client and apiserver:
1. apiserver sending its apiserver certificate along with its publickey to client
>2. client verifies the apiserver certificate sent against its cluster certificate authority data
3. client sending its client certificate along with its public key to the apiserver
4. apiserver verifies the client certificate sent against its cluster certificate authority data
description:
here, with this block,
cluster certificate authority data gets loaded into TLS before the handshake process
for client to later during the handshake verify the apiserver certificate
normal args related to this stage:
--certificate-authority='':
Path to a cert file for the certificate authority
(retrievable from "kubectl options" command)
(suggested by @deads2k)
see also:
- for the step 1, see: staging/src/k8s.io/apiserver/pkg/server/options/serving.go
- for the step 3, see: a few lines below in this file
- for the step 4, see: staging/src/k8s.io/apiserver/pkg/authentication/request/x509/x509.go
*/
rootCAs, err := rootCertPool(c.TLS.CAData)
if err != nil {
return nil, fmt.Errorf("unable to load root certificates: %w", err)
@@ -121,6 +147,35 @@ func TLSConfigFor(c *Config) (*tls.Config, error) {
}
if c.HasCertAuth() || c.HasCertCallback() {
/*
kubernetes mutual (2-way) x509 between client and apiserver:
1. apiserver sending its apiserver certificate along with its publickey to client
2. client verifies the apiserver certificate sent against its cluster certificate authority data
>3. client sending its client certificate along with its public key to the apiserver
4. apiserver verifies the client certificate sent against its cluster certificate authority data
description:
here, with this callback function,
client certificate and pub key get loaded into TLS during the handshake process
for apiserver to later in the step 4 verify the client certificate
normal args related to this stage:
--client-certificate='':
Path to a client certificate file for TLS
--client-key='':
Path to a client key file for TLS
(retrievable from "kubectl options" command)
(suggested by @deads2k)
see also:
- for the step 1, see: staging/src/k8s.io/apiserver/pkg/server/options/serving.go
- for the step 2, see: a few lines above in this file
- for the step 4, see: staging/src/k8s.io/apiserver/pkg/authentication/request/x509/x509.go
*/
tlsConfig.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
// Note: static key/cert data always take precedence over cert
// callback.