You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by zh...@apache.org on 2023/08/02 04:22:23 UTC
[apisix-ingress-controller] branch master updated: ci: auto certs and upgrade APISIX to 3.4.1 version (#1911)
This is an automated email from the ASF dual-hosted git repository.
zhangjintao pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix-ingress-controller.git
The following commit(s) were added to refs/heads/master by this push:
new 3f45ca99 ci: auto certs and upgrade APISIX to 3.4.1 version (#1911)
3f45ca99 is described below
commit 3f45ca99db6d354e381679c39f776064ebd69c55
Author: Jintao Zhang <zh...@gmail.com>
AuthorDate: Wed Aug 2 12:22:18 2023 +0800
ci: auto certs and upgrade APISIX to 3.4.1 version (#1911)
* ci: auto certs
* chore: upgrade APISIX to 3.4.1 version
* ci: fix case should be able to use backends and upstreams together
---------
Signed-off-by: Jintao Zhang <zh...@gmail.com>
---
Makefile | 2 +-
test/e2e/scaffold/ssl.go | 96 ++++++++-
test/e2e/suite-features/external-service.go | 3 +-
.../suite-ingress/suite-ingress-resource/ssl.go | 221 +--------------------
4 files changed, 105 insertions(+), 217 deletions(-)
diff --git a/Makefile b/Makefile
index 118531f5..fe9f05da 100644
--- a/Makefile
+++ b/Makefile
@@ -19,7 +19,7 @@ default: help
VERSION ?= 1.6.0
-TARGET_APISIX_VERSION ?= "3.1.0-centos"
+TARGET_APISIX_VERSION ?= "3.4.1-centos"
APISIX_ADMIN_API_VERSION ?= "v3"
ifeq ($(APISIX_ADMIN_API_VERSION),"v2")
diff --git a/test/e2e/scaffold/ssl.go b/test/e2e/scaffold/ssl.go
index 6dd12f43..00b484d0 100644
--- a/test/e2e/scaffold/ssl.go
+++ b/test/e2e/scaffold/ssl.go
@@ -168,7 +168,7 @@ func (s *Scaffold) GenerateCert(t ginkgo.GinkgoTInterface, dnsNames []string) (c
Organization: []string{"Acme Co"},
},
NotBefore: time.Now(),
- NotAfter: time.Now().Add(time.Hour),
+ NotAfter: time.Now().Add(24 * time.Hour),
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
@@ -189,3 +189,97 @@ func (s *Scaffold) GenerateCert(t ginkgo.GinkgoTInterface, dnsNames []string) (c
return
}
+
+// GenerateMACert used for generate MutualAuthCerts
+func (s *Scaffold) GenerateMACert(t ginkgo.GinkgoTInterface, dnsNames []string) (caCertBytes, serverCertBytes, serverKeyBytes, clientCertBytes, clientKeyBytes bytes.Buffer) {
+ // CA cert
+ caKey, err := rsa.GenerateKey(rand.Reader, 2048)
+ assert.NoError(t, err)
+ caPub := caKey.Public()
+
+ serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+ serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
+ assert.NoError(t, err)
+
+ caTemplate := x509.Certificate{
+ SerialNumber: serialNumber,
+ Subject: pkix.Name{
+ CommonName: dnsNames[0] + "-ca",
+ Organization: []string{"Acme Co"},
+ },
+ NotBefore: time.Now(),
+ NotAfter: time.Now().Add(24 * time.Hour),
+
+ KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+ ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+ BasicConstraintsValid: true,
+ }
+
+ caTemplate.IsCA = true
+ caTemplate.KeyUsage |= x509.KeyUsageCertSign
+
+ caBytes, err := x509.CreateCertificate(rand.Reader, &caTemplate, &caTemplate, caPub, caKey)
+ assert.NoError(t, err)
+ err = pem.Encode(&caCertBytes, &pem.Block{Type: "CERTIFICATE", Bytes: caBytes})
+ assert.NoError(t, err)
+
+ // Server cert
+ serverKey, err := rsa.GenerateKey(rand.Reader, 2048)
+ assert.NoError(t, err)
+
+ serialNumber, err = rand.Int(rand.Reader, serialNumberLimit)
+ assert.NoError(t, err)
+
+ serverTemplate := x509.Certificate{
+ SerialNumber: serialNumber,
+ Subject: pkix.Name{
+ CommonName: dnsNames[0],
+ Organization: []string{"Acme Co"},
+ },
+ NotBefore: time.Now(),
+ NotAfter: time.Now().Add(24 * time.Hour),
+
+ KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageCertSign,
+ ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+ BasicConstraintsValid: true,
+ }
+
+ serverBytes, err := x509.CreateCertificate(rand.Reader, &serverTemplate, &caTemplate, &serverKey.PublicKey, caKey)
+ assert.NoError(t, err)
+ err = pem.Encode(&serverCertBytes, &pem.Block{Type: "CERTIFICATE", Bytes: serverBytes})
+ assert.NoError(t, err)
+ serverKeyBytesD, err := x509.MarshalPKCS8PrivateKey(serverKey)
+ assert.NoError(t, err)
+ err = pem.Encode(&serverKeyBytes, &pem.Block{Type: "PRIVATE KEY", Bytes: serverKeyBytesD})
+
+ // Client cert
+ clientKey, err := rsa.GenerateKey(rand.Reader, 2048)
+ assert.NoError(t, err)
+
+ serialNumber, err = rand.Int(rand.Reader, serialNumberLimit)
+ assert.NoError(t, err)
+
+ clientTemplate := x509.Certificate{
+ SerialNumber: serialNumber,
+ Subject: pkix.Name{
+ CommonName: dnsNames[0] + "-client",
+ Organization: []string{"Acme Co"},
+ },
+ NotBefore: time.Now(),
+ NotAfter: time.Now().Add(24 * time.Hour),
+
+ KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+ ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+ BasicConstraintsValid: true,
+ }
+
+ clientBytes, err := x509.CreateCertificate(rand.Reader, &clientTemplate, &caTemplate, &clientKey.PublicKey, caKey)
+ assert.NoError(t, err)
+ err = pem.Encode(&clientCertBytes, &pem.Block{Type: "CERTIFICATE", Bytes: clientBytes})
+ assert.NoError(t, err)
+ clientKeyBytesD, err := x509.MarshalPKCS8PrivateKey(clientKey)
+ assert.NoError(t, err)
+ err = pem.Encode(&clientKeyBytes, &pem.Block{Type: "PRIVATE KEY", Bytes: clientKeyBytesD})
+
+ return
+}
diff --git a/test/e2e/suite-features/external-service.go b/test/e2e/suite-features/external-service.go
index 6eefa318..8836f654 100644
--- a/test/e2e/suite-features/external-service.go
+++ b/test/e2e/suite-features/external-service.go
@@ -21,6 +21,7 @@ import (
"fmt"
"net/http"
"reflect"
+ "strings"
"time"
"github.com/apache/apisix-ingress-controller/pkg/id"
@@ -385,7 +386,7 @@ spec:
for _, header := range value {
switch vv := header.(type) {
case string:
- if vv == "httpbun" {
+ if strings.HasPrefix(vv, "httpbun") {
hasPoweredBy = true
break forloop
}
diff --git a/test/e2e/suite-ingress/suite-ingress-resource/ssl.go b/test/e2e/suite-ingress/suite-ingress-resource/ssl.go
index 3252e409..c472ab57 100644
--- a/test/e2e/suite-ingress/suite-ingress-resource/ssl.go
+++ b/test/e2e/suite-ingress/suite-ingress-resource/ssl.go
@@ -246,230 +246,23 @@ var _ = ginkgo.Describe("suite-ingress-resource: ApisixTls mTLS Test", func() {
// RootCA -> UserCert
// These certs come from mTLS practice
- rootCA := `-----BEGIN CERTIFICATE-----
-MIIF7DCCA9SgAwIBAgIUAhSL3pkpTz4F9pNyis+TD6HUQOAwDQYJKoZIhvcNAQEL
-BQAwgZExCzAJBgNVBAYTAkNOMREwDwYDVQQIDAhaaGVqaWFuZzERMA8GA1UEBwwI
-SGFuZ3pob3UxETAPBgNVBAoMCE9SR19OQU1FMQ0wCwYDVQQLDARURVNUMRQwEgYD
-VQQDDAtBUElTSVguUk9PVDEkMCIGCSqGSIb3DQEJARYVZGV2QGFwaXNpeC5hcGFj
-aGUub3JnMB4XDTIyMDcyMjE3MTUxMloXDTIzMDcyMjE3MTUxMlowgZExCzAJBgNV
-BAYTAkNOMREwDwYDVQQIDAhaaGVqaWFuZzERMA8GA1UEBwwISGFuZ3pob3UxETAP
-BgNVBAoMCE9SR19OQU1FMQ0wCwYDVQQLDARURVNUMRQwEgYDVQQDDAtBUElTSVgu
-Uk9PVDEkMCIGCSqGSIb3DQEJARYVZGV2QGFwaXNpeC5hcGFjaGUub3JnMIICIjAN
-BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAlVZJ55bAbbWJWsrfrKS96DbtAV1n
-qHEFdca0MF9HVGjkDmxht03hnml9xT/v+AQAq8Xy9pghJHgt2XLCISbHmm8UjEK7
-L/PMsu0w+Yiy7IzfCwzrxWyFEgdtCEZQQw38QkNFdHvmfyAox88qOTEJJfBBM+Vq
-8QQvsUCUcJOlHRbNIcQo2N2/CjipHE+Myp1ygWagaxuVMhsNRLuab5gopySRqZaz
-qrr5f2ZLNXRCitIysvhSBt94u3IbysGMQOxubegb+D72jjR7u+5oGCAG8S75bszj
-zVLM92gp2V4L9ccL3PDAKvUuY3G8/458X9yfJ37r3dj2s83tEKfIZQAEAAB7ru43
-TtnEUJPzVb4l/3rHdqL/vQ6oUzJHrtpgRCMdb1tewZ5zZIbHCP0P1ADt8xXsBBZL
-YmVabmaV9en3kjwKJBDYkIvDJKv8BTRM2cZKKszc03EQXmu3cRQVSbjo7NWv0Cy7
-cerLgHR31Ao63/32/O7adI7Kqm03vT/rHt5iiD+qDm8DYGuyOXU1zwim76OHANNT
-4bjRS2q15J6ZMpWk826b8kyTFjfHl20h0BD5eK2ldI84ThNoov2SMB2y7073Bnun
-Vjw3oOgUkXpd/qgVDITsJgMz25qn7WfYQQUuYf7ehNB7/Bz/u5iIg7WqtjfJSyp+
-SkV5LJrOsGyIoXcCAwEAAaM6MDgwDAYDVR0TBAUwAwEB/zAoBgNVHREEITAfghJt
-dGxzLmh0dHBiaW4ubG9jYWyCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAgEA
-a0fIFgRpP4jEdXNE55jt0DBfuiWfaHMNmjChugKX64WHYlig+7591gKcATYkciE2
-f9bSWp65UxMex4u1sg7iGS31Muq0ayArDsD+EH+DPnhWECnXarq6R03/XYOpUGsC
-Mcqs99bBxjB6GpPFz+C/IFYjSDO9e9xt+Y5JJ88yhlOMslZj873lNOTDHpwq60YR
-MU9uIG1FtTuZcaKnnEAxoO+Z/rEdYbMXUp1eukSCRFidjKX2mK45CvzxCxuTouyO
-XAp3EXcE5M6jX6gVuPIQGg2t+wL1YW2mQQuokSQhvDGHi62KPnWSRbYZ3sb5163O
-RGSQmruQRJzLuQLpck4zF6jU1zuLt3Vqz1jN28GxTdVNOnnV1x9TM/wR5stl/3zX
-tGuhKGVkSo6yja5FgYGTRWp/QxaMzXGbUxaZqH3gLp8JmuN+X3mmbQ8VEHkcINdN
-kRKIoaIQTjhu8524GO//bsmKEZg+eCJ0RqLi3A0uH/xAq513zejNw6Ij30EGH9Qu
-oVUuT4oL/s7yDtDeI5Nkolf+Ue8utKXPEIbNYlo/XUtbYQ4oChunuyKeKgCAN+HI
-onTtJIlTwQI0r79pbJ5KpUPcHzKWeX5PHQnYFe0vzFXhRCfof898AMhRT0f7Mvkc
-bAupufi5aCbmxOo/CFWHDMsWNv9RueSjwC/8R7n7z8M=
------END CERTIFICATE-----`
-
serverCertSecret := `server-secret`
- serverCert := `-----BEGIN CERTIFICATE-----
-MIIF5jCCA86gAwIBAgIUBigWd84H8JCiKERdO40wSZ1JgP0wDQYJKoZIhvcNAQEL
-BQAwgZExCzAJBgNVBAYTAkNOMREwDwYDVQQIDAhaaGVqaWFuZzERMA8GA1UEBwwI
-SGFuZ3pob3UxETAPBgNVBAoMCE9SR19OQU1FMQ0wCwYDVQQLDARURVNUMRQwEgYD
-VQQDDAtBUElTSVguUk9PVDEkMCIGCSqGSIb3DQEJARYVZGV2QGFwaXNpeC5hcGFj
-aGUub3JnMB4XDTIyMDcyMjE3MTUxMloXDTIzMDcyMjE3MTUxMlowgY4xCzAJBgNV
-BAYTAkNOMREwDwYDVQQIDAhaaGVqaWFuZzERMA8GA1UEBwwISGFuZ3pob3UxETAP
-BgNVBAoMCE9SR19OQU1FMQ0wCwYDVQQLDARURVNUMREwDwYDVQQDDAhBUElTSVgu
-VTEkMCIGCSqGSIb3DQEJARYVZGV2QGFwaXNpeC5hcGFjaGUub3JnMIICIjANBgkq
-hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAv6korMaGhJUZ46YuCXuZ13s+AQC/Y2ut
-w/T1/qwQRNzQO/RQ6hFSNTunws2AvYzKzxWyKMK+5rHrkbQ2s9UCtpDd1LLpA0W8
-t4dmwe3geDtlwW31tfeR1b0Cikg2YSiDpyS3M/lQPhaKa1mnM66ntJ3QggI3HDZI
-lbQslG8L6/Fw6ozPUQTIo+p5elDRpla0srO68+mQzhXTEoIzkDaiUb3RJkoM8g34
-H4BXikh73u527iDxKxdHoSrSMMQSkn4KNmJ+lSll2UiAbL87fJhLlhqJ4hn3xzOd
-RCxYIC7JgXwBIMHEShsxafvH1p3mZJp33n8K/af7SVr7ge3a50xbNQuiXg3xR1pU
-y7BwYK37KMuHGebPS415m4E71X6bN/0pL2M5dqu+Vj4dwSNjPVIHEzPDZL8gibRG
-+eBCr3gC3JW+l1AcngltY+GEcbEgTacSRzrHKA+f/WVYBsAkAIvtiBhD8+MB5MLX
-lnrXISPIwMTZSYJ8ng2XO1WMt2PudCDRdSOgQ6c1xCNUO6QfAtBIzU7G24iE1WxZ
-bBahJiH2JFK6OWPxj+0yv4AQiY9Ng/MQ811qTrXs/M9cEXyu+xft5NPFcIhvwgFH
-br5b8ABj+viSDan9MdYdT6OlE0DrCJQZPaCwO8OEpl1+hV9vz63peWK+lJVYGcjA
-6gupXLj5rOUCAwEAAaM3MDUwCQYDVR0TBAIwADAoBgNVHREEITAfghJtdGxzLmh0
-dHBiaW4ubG9jYWyCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAgEAR2a0tkG0
-vjVa1jdF20o/vnp31eQnpPvXGJgHwFQOGaI1CW0o+fnrz3qWBo0HzzkrVCivD5uP
-qhpQAs8/d2jv/BRBpyl5LZp3CiwkCjjxEja31jfuRzdTcceH0CS7Hudhp86nx8pg
-nN30TEOqFw9gIi3TqGu0je7EVTbEw4lvSDRcllXR48X4R/xSMi2M90MeL9whCvfr
-8cM0T6NngvE20YKLtj8TAQ8iuTcO2dvGHjSE7fQX0oq83AM7ulLO/mLOO3siZ/gd
-7l0gxwh01ugXzDSjuxgY7O32N24vzgoQefKWDIVUnxMvE0D7cSd8C34DweGUjmrN
-JkGU8oMHjXFXIk5etNtqTh2WKjcoyIgbz16kb1MATVg7GYkM8jRTAKYjTe5J6FTA
-zRADBSJbSeQZfSyEGES68GU8jBLfxmJkiDBObXmYWLRCPfzH3uS3wKdI+0z2jqWo
-OaN81GHwxJeXxY704VbrKVFIW3uf67ACXiKQuVVb8zSIyo5qM8ctQxr0mgzi6uEj
-536mKPeRmSd9EIG9Ebk6Xg2I8SZw+Ljfzo60bxlbNsBtBXFLS5IjxYP1y2x/cCzk
-AVy9rgsNPVkPSfH0Jy9ZrDJkV4c/yIvelBj/tHL9mL+8kZEmfhffR+PwtRUfonYl
-+KFB4CWLG1UPFpkLB22o8CWMnFdn2fji3jk=
------END CERTIFICATE-----`
-
- serverKey := `-----BEGIN RSA PRIVATE KEY-----
-MIIJJwIBAAKCAgEAv6korMaGhJUZ46YuCXuZ13s+AQC/Y2utw/T1/qwQRNzQO/RQ
-6hFSNTunws2AvYzKzxWyKMK+5rHrkbQ2s9UCtpDd1LLpA0W8t4dmwe3geDtlwW31
-tfeR1b0Cikg2YSiDpyS3M/lQPhaKa1mnM66ntJ3QggI3HDZIlbQslG8L6/Fw6ozP
-UQTIo+p5elDRpla0srO68+mQzhXTEoIzkDaiUb3RJkoM8g34H4BXikh73u527iDx
-KxdHoSrSMMQSkn4KNmJ+lSll2UiAbL87fJhLlhqJ4hn3xzOdRCxYIC7JgXwBIMHE
-ShsxafvH1p3mZJp33n8K/af7SVr7ge3a50xbNQuiXg3xR1pUy7BwYK37KMuHGebP
-S415m4E71X6bN/0pL2M5dqu+Vj4dwSNjPVIHEzPDZL8gibRG+eBCr3gC3JW+l1Ac
-ngltY+GEcbEgTacSRzrHKA+f/WVYBsAkAIvtiBhD8+MB5MLXlnrXISPIwMTZSYJ8
-ng2XO1WMt2PudCDRdSOgQ6c1xCNUO6QfAtBIzU7G24iE1WxZbBahJiH2JFK6OWPx
-j+0yv4AQiY9Ng/MQ811qTrXs/M9cEXyu+xft5NPFcIhvwgFHbr5b8ABj+viSDan9
-MdYdT6OlE0DrCJQZPaCwO8OEpl1+hV9vz63peWK+lJVYGcjA6gupXLj5rOUCAwEA
-AQKCAgBHkItOkEZ0RRRIq6lvAwb7rdoGF9he8DsO+23LLUZZ4DWk3WJFNDiFBgRr
-Ob7DiEnGL2y5yZXsoCy82BTA6126+7bJEBDvlt+Ti+xzpzX0zwD8y+k+i/WZYJ0N
-M0+S0cTu6Ue7EXHD7Ti8Qtqq8qFOUMslcFxRnXdW5tLqjdhevmWSPwe+UdH1Wr0H
-ThwqRx/rxi6dmu3l9cI9m/5S8AOGECGDcY0J6OtoH80QJmaSZGpmGkjS9Tta05lu
-ehgRORzpF7f6TF3qVycU9AbrTBaVMs2fbmDVsdEcPo6dXbsCLWJib9eycBrwXwJM
-geMgV4lAvCFHe6zZxC47YqwlR56aNkzGdsq0RLW8gA0rVCKCTBUCqv8yOuwGneNp
-9sxbxYgEKj/MjKOgbclytYZWrGpMMiHqMgNkVEIbGmZ61jKslioAfse+wp9eQto4
-eerJDOtjJQTQPAqQpc/ES429IfYlrC58taxERslnYV1HjBAmEvICljQObLxB94mK
-90Fm3Uaxtg/H0b4sVnr2XGEIRnOXY3rRuBAGKqdGsE+4Sf0SlbUFCLVHZTg7CJ2R
-TJnzQ0yq0OkDsRwc/BYdCIFn1JBbt2tR3IUkpvY3KOvnEo2chA6blJpTSiu3sxBu
-LdLLj7GSn3IamtSljsC8we1ZBUWYRn2HAPUscsbcwy6BAjfr1QKCAQEA+t84bB3H
-aeaJA5ouYFYGF5dZRaZyo1cR0OSvy5MSUCbDNe5nTFdMHKNyTcxekgC0GUC3rzeG
-p1FFy00bWpDIU+y09uYr/sEkGt7gc0CmQ/zK1V1y3e3aeZIN15QwQGqWyF3j2hAR
-is01EZv/1985FvUL2qN24gn47XhrK4z1XGRLuSxxbMiAJmcjDOAokgRQjRE+Sm5M
-1CnjSEVFlRZELFuNTAv83VxPDJjG9hebO/oiMZcJtUXeff69J4qC/j2nEVgg75dh
-qMb8NQRrTbcuOFZN9yuxplL3TluwocIkEHU+/EHDEAOcWcLgqNxOqC+WesBI+IW0
-tKotb7tNZ2I+3wKCAQEAw5QYIYwUVEt5ZpeUzecvH/Jm3Enhxi0xPSkWYbZYBF0y
-8KYo4iLkv3zK5VqnBmYWKZWI0HS1mS3ol7Wy8rH1Xcw/wqEal2B33hM9p2pkjW/5
-3Y/mSnMUHT2jgk01ncwyaOOjAUQoEgmq2iznTjzie5+z8KcRYZvl4MGYbEPuHGaP
-kCkWI06qTcIJ659sypj+8pUukrEWXBn4Tr82Q2aMljoSFYIgrr08NWeb06/eeI1F
-Fmb07hNRvmmsLj4V469WsPTFrRaBLCBDrbnQOWZU00hBAltp+4PQ3wpfuKTVt3xX
-wzDX07jwyb4Ys6q1NSbIjZv2vrRQbaKEDfS7cUJAuwKCAQBnJNms0f2IE+mnWn/Q
-ye2NS4O/uDSP5Z+ElFGW0GwKGjXOeats3sODTswTIoCLZNCnRU2AM8MgDbE1agli
-Df7fSoYIsQ/LmRtAFPyRRjZV45x9ZwNwLXfS3fLk/J9uDKTb0oZ4xHyB5eb4y3vA
-BJ4TS0LJbMXXH6SB9i2R5U2H5BCiHJyxzimqIGNvysXDaxS3OyyyK3FZFbPFpf16
-04HJ/wY0CwW2+Vni4vmCeqgvW6MtYlzyc7yLbu3UUQWUhEKpReOcvk+/tbhCEAQS
-GstdDFbX1dYffSMCy33us8RiI+J2ko8hiWqCGTaHFrUcPxyOcXpO+6IVWZZ+xrKH
-XARfAoIBAAGBzaHMi4eOwVO6DUp84o8TdhlydEvrozp+a467Mfhuo2rZTO1ZKXwU
-QRf9V9YjyT3uygwZKiERCn7IxqU6G9LqNP+R8DuEYcgTS+FTX4z7dOhxKGwgcOI8
-zFq/r48UuLq4LlRfKxPggTGHMQ0YSQJ8240aLHcdFWti8oK7D0WmwKpytpn1DDjn
-Kt5m7xaskSJbZe15cdup05D/xjJEwwaRUfxacVgHW0RqFPhPnZ4+MG8YwgBno7Sc
-6de9YLvNaRSZ/j/0MXCemwbmrKUUlci/AMk83Rc0D9L4KH6qvn7YdXCqmq8l+K0F
-SvlvclADiX4V2pPjnc8KdowI+7zGrusCggEAQZ8TlrcRZ3RnGUuQ9pVgi1+JFehN
-qLmIXu89grekMAdHs+wsJ9L5XSEyI2LQDTo0Kmw396WFOiMHXO+hd4hu55j6KIC4
-9kqt8bX1PthAlwuZmThQQ29HJUX+YHZ0G98Zu7FSoHDokHj+E1dnjF/QO6w6nvB9
-r2LfnMEchQOHG+fVedkkxy+jckBqA9Qf2tsDYG+KYUj/nVsBQzfRiC4bp/04x16b
-j+0ntnGGA9b4ZaWhybh4UKEY9YwUOAvq/Y3gHqwaWDZscd/5s8MHZwKNfKriateP
-6tz2gipPdAsLQNaCS1d1OXHgh960gKziQNZM/wNgJQO/7ZeGvMkk6ml+0w==
------END RSA PRIVATE KEY-----`
-
clientCASecret := `client-ca-secret`
- clientCert := `-----BEGIN CERTIFICATE-----
-MIIF5jCCA86gAwIBAgIUBigWd84H8JCiKERdO40wSZ1JgP4wDQYJKoZIhvcNAQEL
-BQAwgZExCzAJBgNVBAYTAkNOMREwDwYDVQQIDAhaaGVqaWFuZzERMA8GA1UEBwwI
-SGFuZ3pob3UxETAPBgNVBAoMCE9SR19OQU1FMQ0wCwYDVQQLDARURVNUMRQwEgYD
-VQQDDAtBUElTSVguUk9PVDEkMCIGCSqGSIb3DQEJARYVZGV2QGFwaXNpeC5hcGFj
-aGUub3JnMB4XDTIyMDcyMjE3MTUxM1oXDTIzMDcyMjE3MTUxM1owgY4xCzAJBgNV
-BAYTAkNOMREwDwYDVQQIDAhaaGVqaWFuZzERMA8GA1UEBwwISGFuZ3pob3UxETAP
-BgNVBAoMCE9SR19OQU1FMQ0wCwYDVQQLDARURVNUMREwDwYDVQQDDAhBUElTSVgu
-VTEkMCIGCSqGSIb3DQEJARYVZGV2QGFwaXNpeC5hcGFjaGUub3JnMIICIjANBgkq
-hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAyo9HShACWpGwzpXbzfhic7jtmnJKT2yw
-qKA5p4THMbGpDAkzLrt5Ki3eSWPfn8DafcA2guPAhmHhXM1rKrOPbGaS/p37kN9V
-XVuLVQgpkvdBJA1+nPcukwv7HIoyETcs8/UXwfPaACBOBbMnXjbZ5r6y6MdnhCKc
-VBLe3G0cPNXcwNuE1Su9zodjwXDUh9Eqpb0viX5FGZNwWwHmrUhfGxrvmej7Ooyw
-iZKgiGRZ3XF4NPIeUbNilI9NY5x/HMavkTUOM0gb7LOTItCfk0w5JwKsDWbMWs7N
-ytypLMtymK6W03i8KDoztav4wiMUve5uZmkrxC88reSAvTENrendS6/AxwvfcZ3k
-fuicaEw/c+jXm9Tf7z4tOUaMzHyXWHq9N/JAUHdJRXk/jHFyN/Kq+Nz+kusNprMi
-MvqAcF4ryb1wC4glYCNCeMuY/JCSit7QJik+lLbhqVnrtBcuhsHoZz3KOErhGMOY
-6fKIiJrj8OnzY+ZD29Ntcnfu1grHGB0r2qmCGANURsNan0V2Af4yJ5FWCoIsOCXi
-Jo/SLOYW/c5XkU0jS6dqqqigt0hmzJ3e9ErL2y+MDDvUMdr695knFW8n4DHCgOoQ
-C7VAKP/xsLKn4jqW5tVp1bTeTozBfuop/Aspjf4j3Mo3YFPIBpErcuTo11LgTH13
-GPrFvxU7ss0CAwEAAaM3MDUwCQYDVR0TBAIwADAoBgNVHREEITAfghJtdGxzLmh0
-dHBiaW4ubG9jYWyCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAgEASCoay2YL
-UXXQHpVK81H2XbX3xZl6S61i3IEM4CjVzjVMc6OvknF2yg2qoW7qQ04Rsv1rQOoh
-LQkscpSJFmwy0ZyGu2KPOF0xj4WzMw4MuRCr1EHaefYp550OSbHvQxpVVR36C7yB
-1slD5s6jM9dCjJXd1usAr8ToBih3j7ruU+k2S82rpvViGjaod3VeQX8IRPZpmrX7
-Em9tA3oNAxLBcIm5DWwEvOZteYj7QjeVSTUuBFZpvNCb1OyUmP3EWcwQ4stTUb15
-tNnR5lmeeBFteExgcuVzZgEGJqyMpGd07662gpu2tDmjSGSo00vZUebnFg6N7MYj
-IDdvOZCnGop0o4Sjr3llBCrzuc4JmQusBh/dSN8UTbsuAnnp8icrzHij7IrgJzft
-CNCTHAEdeLyDThpr3u3/xb7YiLrQ7JmKnp7pCOIM3mQVD8CcDd1I98dYwgXowW5Z
-ng6CE/96m4HIMjvpxSlLiGKNyjuwxPhfZLpwPGLHu5ZDS689QL3EZR5La3ilXO7B
-Kwy0m3Ku3d+8Kb+WDWUvzu+HQGzIwFqHVoyp1nCg/w9Jc6Hl30nM0bA59G4IcRnI
-qP64MCb6dqPgEBgR5cEZOs75XNgI8f1thE7S5DQQC2z5vOGPI9FD0sDJNTKnHusX
-PLApoDRtuZpYJBY4acuPqyBLs+xn0fZ5pmM=
------END CERTIFICATE-----`
-
- clientKey := `-----BEGIN RSA PRIVATE KEY-----
-MIIJKAIBAAKCAgEAyo9HShACWpGwzpXbzfhic7jtmnJKT2ywqKA5p4THMbGpDAkz
-Lrt5Ki3eSWPfn8DafcA2guPAhmHhXM1rKrOPbGaS/p37kN9VXVuLVQgpkvdBJA1+
-nPcukwv7HIoyETcs8/UXwfPaACBOBbMnXjbZ5r6y6MdnhCKcVBLe3G0cPNXcwNuE
-1Su9zodjwXDUh9Eqpb0viX5FGZNwWwHmrUhfGxrvmej7OoywiZKgiGRZ3XF4NPIe
-UbNilI9NY5x/HMavkTUOM0gb7LOTItCfk0w5JwKsDWbMWs7NytypLMtymK6W03i8
-KDoztav4wiMUve5uZmkrxC88reSAvTENrendS6/AxwvfcZ3kfuicaEw/c+jXm9Tf
-7z4tOUaMzHyXWHq9N/JAUHdJRXk/jHFyN/Kq+Nz+kusNprMiMvqAcF4ryb1wC4gl
-YCNCeMuY/JCSit7QJik+lLbhqVnrtBcuhsHoZz3KOErhGMOY6fKIiJrj8OnzY+ZD
-29Ntcnfu1grHGB0r2qmCGANURsNan0V2Af4yJ5FWCoIsOCXiJo/SLOYW/c5XkU0j
-S6dqqqigt0hmzJ3e9ErL2y+MDDvUMdr695knFW8n4DHCgOoQC7VAKP/xsLKn4jqW
-5tVp1bTeTozBfuop/Aspjf4j3Mo3YFPIBpErcuTo11LgTH13GPrFvxU7ss0CAwEA
-AQKCAgALFV/vO4UFc6dbBnQqhwbMEjheFRbf1bCs6Wd+NRO5MmFvmSlFy1hL6Iqb
-NW3NDf5mlxfkfZXRRJXSQCM3CPA2HD660+Yp/S5sl0++bV3o/sJ/uIVPDW9s+GDb
-JOysaHp7NtP/9tnc2+epBC6JRzMRHyom9pJBdqtbJlUvdoDvCzyzCM/x4hzWqi3Z
-LdVTQSy2OO3a9h/N0HV7ZVU78hPSJd0qbMciYwRd4roJ/IO2TDkpnH3wNoKUYmr3
-ol6KMoz0wxRt1epBP2ozo3q30pnl+o1zhkZ0SZCVIxHWs6Mnm5YBKEATa2vc6vYH
-mWfPJLbBv8t3RqZpVXF96Ks48uz62EwDPDbMNh0IyG1/S3iScpgJ5anAtp3zDwYG
-AthOdRkqLylDTz1MbSLDQ633qSiXMfzBvAPzd7hYR25xh+egLF7J7qxaYGLlaIyX
-9hRexhD3CgtXB8oiymvVX7ZScmdLt1Bw2ghM3PrCnf58mD6luWnQOdX9QRH80Qt6
-7tIC75VxbzdYtDYtrlcLg0RTwaA9I1FqHns9dd+HLdw2kEquDiZm76Lqmwk6quFi
-iqu2Ppj6IeiN1quIdmM+BYRquZFpbmIzBRw0+75RzlohBWxZha+lksW3f2aFKGib
-OLni+tV8F/t8QrBzVxcYIOpGPrGHUehoJY7n/D84ibGOdpW2+QKCAQEA6I3A0asf
-w/tOynyhRa0nAodsJoxPrKZrNC8f3oRlWHs4gQbJe4VzEUz5iYD3eCSbWeNm6O/B
-3ZPA33RqJkFSwkZFptIzKmCFPqA1LyBRBDq2/maXffQDeVoy9vNV5EZt+Nr3mNK/
-DRxxFOQSDbYnUOyXAFbWxhcm01ufOPwe/ul6QGjZkcIyHDUCzr4AXcU11Es+Dghv
-N4zj+GW0QL4BsCcwWuEueLZzn3Wcm+N4DcpL0ZA8+gbkS8MfCgiaIU8ko44bslbO
-IWAFE/DgMwBJxu7yjzL33+7jdMtQ7ZLmvYYeDqIF18uX3HzZOJi3Qt4nvML1Sh59
-PkJwxVD/BangNwKCAQEA3vtf4BwEZpm9XO0cevHTBvl8OyFWub4VP4yS/5GAGQEV
-1ceOqFboE8RJDvm5C5Gek9CE50wMQ6a3zAoZd/C9zIyNqgy2IOmIgdXDDJzbBLjD
-npvyJdsLo0W0Rc2rUSh2J/CGn2mqAVQYS1wIavdkOK9NtV28cgyhYOCZ4rdJh+M2
-0LMFXTu1PZUhgpSq0kFXtpPnu0npHoVxm+So3l6r0VeQoZl5/b47Bpg6OUYDcXBp
-cguFIrfnaHL9WGlIDXbsYkHb9mjWDbLp4kcw2I2IeI9w2moyRSYYu+ELhNTzgCG7
-C0P7ErvIdZ8rlc1IGQ/l98QTlJqUDgEO8Xy8DY7bGwKCAQEA0a8e8O5vUfLC9Giz
-sXOS/QDGT2usW2witYbYIXcXOlTAefZ4rVuCiVLynT0f5cB8Iuyb2eR01SloexMo
-sx2rVWivXN+jKs6k1fb2fWuSIVIftfsjFXpzt3PRCEIYbB/lAMHPBojfox7GB6Qt
-cxePE7R/4tpqBWrSozi1tFgASrCSfokLxBVpwW06/tbq1aIAC09cwKJyRZBP7aUm
-hknMk9yCCS+JC2bXkiwl7ZmIokaJXofDs12Lc5SX5CAleWs3ChIUfxUt/4HokjZa
-sSHNZAYHx36ZadyoUqMQcWZHjxPi/iaxRgZZA4G/Cv0IIM7W3aicKxyaqQyXShLi
-H2UwuQKCAQA2Cx71plS6uVBYEW/xrGLFMfqWKkJmyldEC8IlBxLQ/J5aLf+5dTbS
-c6RxaL0cvLJ+iO9tT9U5IFMztM7vbv3Rcc90A5iw6WkYbsLTb8D1qAJhktJhsnFj
-pSVINczr4q6gh39Za7a0k7k/qpKvuj4kLvjamFlwGveSD128wUelE8DZXEpUioAm
-6NoyV+3+/69OpRJpJkTGDPm4GveCzdc+6cY4JIaYpV6Q/pw9/WYgPGqSJZCjFYeU
-nSoiH4JDISuxtNynIEmhEFf3a+G+2q7U6Y8koNCGSfF8t9Ke4y4RRBudY2Ca7cBs
-IaPirtpmmJ/YKUHFpqFzs3X3uY+qiZE5AoIBAE7PevOHRncpX9jJrLcOdv5QmuI7
-zZoWkJKPT+Ih8sBtwHZ89IHpQvhzPAaLJ6zev52QvSyxHW0TQnNWIGh5zdBdeGqX
-gCVY/RmHFeDouuVDtesvCi0bfYgDGZsYeV1v83gOmcF+/+QjGT57ifmtnsIvnq5v
-A9bsKwgSLrjTJswy2s1oXeoGk5WvZEzbNr9yui9j2DpS9YZX2cpw6B8umIAB4s2M
-6pjGUQy6XsCOY8z1rzemk/EiEWN7+CdnaAm9hcOxDNWCBDNiyW3LUSpS0DRi+lKL
-jzit3pB5lp13YaVOoUil5Nvrp42M6MgJiVnu4a8s2d4fSoPfBzsKcstIQPU=
------END RSA PRIVATE KEY-----
-`
suites := func(scaffoldFunc func() *scaffold.Scaffold) {
s := scaffoldFunc()
ginkgo.It("create a SSL with client CA", func() {
// create secrets
- err := s.NewSecret(serverCertSecret, serverCert, serverKey)
+ host := "mtls.httpbin.local"
+ rootCA, serverCert, serverKey, clientCert, clientKey := s.GenerateMACert(ginkgo.GinkgoT(), []string{host})
+
+ err := s.NewSecret(serverCertSecret, serverCert.String(), serverKey.String())
assert.Nil(ginkgo.GinkgoT(), err, "create server cert secret error")
- err = s.NewClientCASecret(clientCASecret, rootCA, "")
+ err = s.NewClientCASecret(clientCASecret, rootCA.String(), "")
assert.Nil(ginkgo.GinkgoT(), err, "create client CA cert secret error")
// create ApisixTls resource
tlsName := "tls-with-client-ca"
- host := "mtls.httpbin.local"
err = s.NewApisixTlsWithClientCA(tlsName, host, serverCertSecret, clientCASecret)
assert.Nil(ginkgo.GinkgoT(), err, "create ApisixTls with client CA error")
// check ssl in APISIX
@@ -504,10 +297,10 @@ spec:
// With client cert
caCertPool := x509.NewCertPool()
- ok := caCertPool.AppendCertsFromPEM([]byte(rootCA))
+ ok := caCertPool.AppendCertsFromPEM([]byte(rootCA.String()))
assert.True(ginkgo.GinkgoT(), ok, "Append cert to CA pool")
- cert, err := tls.X509KeyPair([]byte(clientCert), []byte(clientKey))
+ cert, err := tls.X509KeyPair([]byte(clientCert.String()), []byte(clientKey.String()))
assert.Nil(ginkgo.GinkgoT(), err, "generate cert")
s.NewAPISIXHttpsClientWithCertificates(host, true, caCertPool, []tls.Certificate{cert}).