Skip to content

add a new collector that gets information about a server's TLS certificates #1765

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 22 commits into
base: main
Choose a base branch
from
Open

add a new collector that gets information about a server's TLS certificates #1765

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
843afb6
add a new collector that gets information about a server's TLS certif…
laverya Mar 31, 2025
d57b212
check issuer in analyzer, update test
laverya Apr 1, 2025
8475f6e
add analyzer and unit tests
laverya Apr 1, 2025
c34b425
Merge branch 'main' into laverya/sc-121804/finish-validating-failing-…
laverya Apr 1, 2025
92a599a
make schemas
laverya Apr 1, 2025
70a099a
add replicated.app analyze test
laverya Apr 1, 2025
9aba086
make generate
laverya Apr 1, 2025
e35578f
Merge branch 'main' into laverya/sc-121804/finish-validating-failing-…
laverya Apr 1, 2025
5fccca2
go mod tidy examples
laverya Apr 1, 2025
6df1106
Update pkg/analyze/host_tls.go
laverya Apr 1, 2025
e832664
include error in collect results instead of returning
laverya Apr 1, 2025
33c4487
add to struct, make generate schemas
laverya Apr 1, 2025
d10a121
collector name is required in analyzer
laverya Apr 1, 2025
d6bce85
fix unit tests
laverya Apr 1, 2025
09ff342
add this to the e2e tests
laverya Apr 1, 2025
4ee38f3
fix getting host analyzer
laverya Apr 1, 2025
d3b915f
fix collection
laverya Apr 1, 2025
e139fb5
use dorequest to collect tls info
laverya Apr 1, 2025
727d82e
support collecting certificate from behind a proxy
laverya Apr 1, 2025
b2c10c7
rename to tlsCertificate
laverya Apr 1, 2025
8eb674c
allow fetching the expected set of certs from the remote server
laverya Apr 1, 2025
6539de6
make generate schemas
laverya Apr 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions config/crds/troubleshoot.sh_analyzers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3156,6 +3156,55 @@ spec:
required:
- outcomes
type: object
tls:
properties:
annotations:
additionalProperties:
type: string
type: object
checkName:
type: string
collectorName:
type: string
exclude:
type: BoolString
outcomes:
items:
properties:
fail:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
pass:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
warn:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
type: object
type: array
strict:
type: BoolString
required:
- outcomes
type: object
udpPortStatus:
properties:
annotations:
Expand Down
49 changes: 49 additions & 0 deletions config/crds/troubleshoot.sh_hostcollectors.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1305,6 +1305,55 @@ spec:
required:
- outcomes
type: object
tls:
properties:
annotations:
additionalProperties:
type: string
type: object
checkName:
type: string
collectorName:
type: string
exclude:
type: BoolString
outcomes:
items:
properties:
fail:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
pass:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
warn:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
type: object
type: array
strict:
type: BoolString
required:
- outcomes
type: object
udpPortStatus:
properties:
annotations:
Expand Down
49 changes: 49 additions & 0 deletions config/crds/troubleshoot.sh_hostpreflights.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1305,6 +1305,55 @@ spec:
required:
- outcomes
type: object
tls:
properties:
annotations:
additionalProperties:
type: string
type: object
checkName:
type: string
collectorName:
type: string
exclude:
type: BoolString
outcomes:
items:
properties:
fail:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
pass:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
warn:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
type: object
type: array
strict:
type: BoolString
required:
- outcomes
type: object
udpPortStatus:
properties:
annotations:
Expand Down
49 changes: 49 additions & 0 deletions config/crds/troubleshoot.sh_supportbundles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20247,6 +20247,55 @@ spec:
required:
- outcomes
type: object
tls:
properties:
annotations:
additionalProperties:
type: string
type: object
checkName:
type: string
collectorName:
type: string
exclude:
type: BoolString
outcomes:
items:
properties:
fail:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
pass:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
warn:
properties:
message:
type: string
uri:
type: string
when:
type: string
type: object
type: object
type: array
strict:
type: BoolString
required:
- outcomes
type: object
udpPortStatus:
properties:
annotations:
Expand Down
2 changes: 2 additions & 0 deletions pkg/analyze/host_analyzer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,8 @@ func GetHostAnalyzer(analyzer *troubleshootv1beta2.HostAnalyze) (HostAnalyzer, b
return &AnalyzeHostNetworkNamespaceConnectivity{analyzer.NetworkNamespaceConnectivity}, true
case analyzer.Sysctl != nil:
return &AnalyzeHostSysctl{analyzer.Sysctl}, true
case analyzer.TLS != nil:
return &AnalyzeHostTLS{analyzer.TLS}, true
default:
return nil, false
}
Expand Down
7 changes: 3 additions & 4 deletions pkg/analyze/host_tls.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ func (a *AnalyzeHostTLS) Analyze(

collectorName := a.hostAnalyzer.CollectorName
if collectorName == "" {
collectorName = "result"
return nil, fmt.Errorf("collector name is required")
}

const nodeBaseDir = "host-collectors/tls"
Expand All @@ -54,7 +54,6 @@ func (a *AnalyzeHostTLS) Analyze(
}

func (a *AnalyzeHostTLS) CheckCondition(when string, data []byte) (bool, error) {

var tlsInfo types.TLSInfo
if err := json.Unmarshal(data, &tlsInfo); err != nil {
return false, fmt.Errorf("failed to unmarshal data into tlsInfo: %v", err)
Expand All @@ -64,7 +63,7 @@ func (a *AnalyzeHostTLS) CheckCondition(when string, data []byte) (bool, error)

// currently this supports only checks like "issuer == foo"
func compareHostTLSResult(when string, tlsInfo *types.TLSInfo) (bool, error) {
parts := strings.Split(when, " ")
parts := strings.SplitN(when, " ", 3)
if len(parts) < 3 {
return false, fmt.Errorf("invalid when clause: %s", when)
}
Expand All @@ -74,7 +73,7 @@ func compareHostTLSResult(when string, tlsInfo *types.TLSInfo) (bool, error) {
return false, fmt.Errorf("invalid check type: %s", checkType)
}

issuer := strings.Join(parts[2:], " ")
issuer := parts[2]

for _, cert := range tlsInfo.PeerCertificates {
if cert.Issuer == issuer {
Expand Down
5 changes: 5 additions & 0 deletions pkg/analyze/host_tls_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ func TestAnalyzeHostTLS(t *testing.T) {
},
},
hostAnalyzer: &troubleshootv1beta2.TLSAnalyze{
CollectorName: "test-tls",
Outcomes: []*troubleshootv1beta2.Outcome{
{
Fail: &troubleshootv1beta2.SingleOutcome{
Expand Down Expand Up @@ -68,6 +69,7 @@ func TestAnalyzeHostTLS(t *testing.T) {
},
},
hostAnalyzer: &troubleshootv1beta2.TLSAnalyze{
CollectorName: "test-tls",
Outcomes: []*troubleshootv1beta2.Outcome{
{
Fail: &troubleshootv1beta2.SingleOutcome{
Expand All @@ -88,6 +90,7 @@ func TestAnalyzeHostTLS(t *testing.T) {
},
},
hostAnalyzer: &troubleshootv1beta2.TLSAnalyze{
CollectorName: "test-tls",
Outcomes: []*troubleshootv1beta2.Outcome{
{
Pass: &troubleshootv1beta2.SingleOutcome{
Expand Down Expand Up @@ -124,6 +127,7 @@ func TestAnalyzeHostTLS(t *testing.T) {
},
},
hostAnalyzer: &troubleshootv1beta2.TLSAnalyze{
CollectorName: "test-tls",
Outcomes: []*troubleshootv1beta2.Outcome{
{
Pass: &troubleshootv1beta2.SingleOutcome{
Expand Down Expand Up @@ -171,6 +175,7 @@ func TestAnalyzeHostTLS(t *testing.T) {
},
},
hostAnalyzer: &troubleshootv1beta2.TLSAnalyze{
CollectorName: "test-tls",
Outcomes: []*troubleshootv1beta2.Outcome{
{
Pass: &troubleshootv1beta2.SingleOutcome{
Expand Down
1 change: 1 addition & 0 deletions pkg/analyze/types/tls_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,4 +12,5 @@ type CertInfo struct {

type TLSInfo struct {
PeerCertificates []CertInfo `json:"peer_certificates"`
Error string `json:"error"`
}
1 change: 1 addition & 0 deletions pkg/apis/troubleshoot/v1beta2/hostanalyzer_shared.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,4 +182,5 @@ type HostAnalyze struct {
JsonCompare *JsonCompare `json:"jsonCompare,omitempty" yaml:"jsonCompare,omitempty"`
NetworkNamespaceConnectivity *NetworkNamespaceConnectivityAnalyze `json:"networkNamespaceConnectivity,omitempty" yaml:"networkNamespaceConnectivity,omitempty"`
Sysctl *HostSysctlAnalyze `json:"sysctl,omitempty" yaml:"sysctl,omitempty"`
TLS *TLSAnalyze `json:"tls,omitempty" yaml:"tls,omitempty"`
}
5 changes: 5 additions & 0 deletions pkg/apis/troubleshoot/v1beta2/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions pkg/collect/host_collector.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,8 @@ func GetHostCollector(collector *troubleshootv1beta2.HostCollect, bundlePath str
return &CollectHostNetworkNamespaceConnectivity{collector.NetworkNamespaceConnectivity, bundlePath}, true
case collector.HostSysctl != nil:
return &CollectHostSysctl{collector.HostSysctl, bundlePath}, true
case collector.HostTLS != nil:
return &CollectHostTLS{collector.HostTLS, bundlePath}, true
default:
return nil, false
}
Expand Down
Loading
Loading