updated to latest k8s version

pkg/approver/helper.go

@@ -0,0 +1,81 @@
+// Copied from https://github.com/kubernetes/kubernetes/blob/master/pkg/apis/certificates/helpers.go
+// to avoid importing k8s.io/kubernetes
+
+package approver
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// ParseCSR extracts the CSR from the bytes and decodes it.
+func ParseCSR(pemBytes []byte) (*x509.CertificateRequest, error) {
+	block, _ := pem.Decode(pemBytes)
+	if block == nil || block.Type != "CERTIFICATE REQUEST" {
+		return nil, errors.New("PEM block type must be CERTIFICATE REQUEST")
+	}
+	csr, err := x509.ParseCertificateRequest(block.Bytes)
+	if err != nil {
+		return nil, err
+	}
+	return csr, nil
+}
+
+var (
+	organizationNotSystemNodesErr = fmt.Errorf("subject organization is not system:nodes")
+	commonNameNotSystemNode       = fmt.Errorf("subject common name does not begin with system:node:")
+	dnsOrIPSANRequiredErr         = fmt.Errorf("DNS or IP subjectAltName is required")
+	emailSANNotAllowedErr         = fmt.Errorf("Email subjectAltNames are not allowed")
+	uriSANNotAllowedErr           = fmt.Errorf("URI subjectAltNames are not allowed")
+)
+
+type KeyUsage string
+
+const (
+	UsageDigitalSignature KeyUsage = "digital signature"
+	UsageKeyEncipherment  KeyUsage = "key encipherment"
+	UsageServerAuth       KeyUsage = "server auth"
+)
+
+var kubeletServingRequiredUsages = sets.NewString(
+	string(UsageDigitalSignature),
+	string(UsageKeyEncipherment),
+	string(UsageServerAuth),
+)
+
+func IsKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) bool {
+	return ValidateKubeletServingCSR(req, usages) == nil
+}
+func ValidateKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) error {
+	if !reflect.DeepEqual([]string{"system:nodes"}, req.Subject.Organization) {
+		return organizationNotSystemNodesErr
+	}
+
+	// at least one of dnsNames or ipAddresses must be specified
+	if len(req.DNSNames) == 0 && len(req.IPAddresses) == 0 {
+		return dnsOrIPSANRequiredErr
+	}
+
+	if len(req.EmailAddresses) > 0 {
+		return emailSANNotAllowedErr
+	}
+	if len(req.URIs) > 0 {
+		return uriSANNotAllowedErr
+	}
+
+	if !kubeletServingRequiredUsages.Equal(usages) {
+		return fmt.Errorf("usages did not match %v", kubeletServingRequiredUsages.List())
+	}
+
+	if !strings.HasPrefix(req.Subject.CommonName, "system:node:") {
+		return commonNameNotSystemNode
+	}
+
+	return nil
+}