Skip to content

Fix a bug in certificate loading... #200

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 27, 2018
Merged

Fix a bug in certificate loading... #200

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion util/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
<dependency>
<groupId>commons-codec</groupId>
<artifactId>commons-codec</artifactId>
<version>1.10</version>
<version>1.11</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
Expand Down
18 changes: 13 additions & 5 deletions util/src/main/java/io/kubernetes/client/util/ClientBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,6 @@ public static ClientBuilder kubeconfig(KubeConfig config) throws IOException {
if (caBytes != null) {
builder.setCertificateAuthority(caBytes);
}

builder.setVerifyingSsl(config.verifySSL());

builder.setBasePath(server);
Expand Down Expand Up @@ -211,14 +210,23 @@ public ApiClient build() {

client.setVerifyingSsl(verifyingSsl);

if (caCertBytes != null) {
client.setSslCaCert(new ByteArrayInputStream(caCertBytes));
}

if (authentication != null) {
authentication.provide(client);
}

// NOTE: this ordering is important. The API Client re-evaluates the CA certificate every
// time the SSL info changes, which means that if this comes after the following call
// you will try to load a certificate with an exhausted InputStream. So setting the CA
// certificate _has_ to be the last thing that you do related to SSL.
//
// TODO: this (imho) is broken in the generate Java Swagger Client code. We should fix it
// upstream and remove this dependency.
//
// TODO: Add a test to ensure that this works correctly...
if (caCertBytes != null) {
client.setSslCaCert(new ByteArrayInputStream(caCertBytes));
}

return client;
}
}