Skip to content

Commit 0006cd1

Browse files
stealthyboxstealthybox
committed
Initialize cosign TrustRoot only once, on-demand
Signed-off-by: leigh capili <leigh@null.net>
1 parent 9b2d3af commit 0006cd1

6 files changed

Lines changed: 173 additions & 98 deletions

File tree

‎internal/controller/helmchart_controller.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -131,9 +131,10 @@ type HelmChartReconciler struct {
131131
kuberecorder.EventRecorder
132132
helper.Metrics
133133

134-
Storage *storage.Storage
135-
Getters helmgetter.Providers
136-
ControllerName string
134+
Storage *storage.Storage
135+
Getters helmgetter.Providers
136+
ControllerName string
137+
CosignVerifierFactory *scosign.CosignVerifierFactory
137138

138139
Cache *cache.Cache
139140
TTL time.Duration
@@ -1330,7 +1331,7 @@ func (r *HelmChartReconciler) makeVerifiers(ctx context.Context, obj *sourcev1.H
13301331
for k, data := range pubSecret.Data {
13311332
// search for public keys in the secret
13321333
if strings.HasSuffix(k, ".pub") {
1333-
verifier, err := scosign.NewCosignVerifier(ctx, append(defaultCosignOciOpts, scosign.WithPublicKey(data))...)
1334+
verifier, err := r.CosignVerifierFactory.NewCosignVerifier(ctx, append(defaultCosignOciOpts, scosign.WithPublicKey(data))...)
13341335
if err != nil {
13351336
return nil, err
13361337
}
@@ -1354,7 +1355,7 @@ func (r *HelmChartReconciler) makeVerifiers(ctx context.Context, obj *sourcev1.H
13541355
}
13551356
defaultCosignOciOpts = append(defaultCosignOciOpts, scosign.WithIdentities(identities))
13561357

1357-
verifier, err := scosign.NewCosignVerifier(ctx, defaultCosignOciOpts...)
1358+
verifier, err := r.CosignVerifierFactory.NewCosignVerifier(ctx, defaultCosignOciOpts...)
13581359
if err != nil {
13591360
return nil, err
13601361
}

‎internal/controller/helmchart_controller_test.go‎

Lines changed: 48 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -111,9 +111,10 @@ func TestHelmChartReconciler_deleteBeforeFinalizer(t *testing.T) {
111111
g.Expect(k8sClient.Delete(ctx, helmchart)).NotTo(HaveOccurred())
112112

113113
r := &HelmChartReconciler{
114-
Client: k8sClient,
115-
EventRecorder: record.NewFakeRecorder(32),
116-
Storage: testStorage,
114+
Client: k8sClient,
115+
EventRecorder: record.NewFakeRecorder(32),
116+
Storage: testStorage,
117+
CosignVerifierFactory: testCosignVerifierFactory,
117118
}
118119
// NOTE: Only a real API server responds with an error in this scenario.
119120
_, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: client.ObjectKeyFromObject(helmchart)})
@@ -792,10 +793,11 @@ func TestHelmChartReconciler_reconcileSource(t *testing.T) {
792793
}
793794

794795
r := &HelmChartReconciler{
795-
Client: clientBuilder.Build(),
796-
EventRecorder: record.NewFakeRecorder(32),
797-
Storage: st,
798-
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
796+
Client: clientBuilder.Build(),
797+
EventRecorder: record.NewFakeRecorder(32),
798+
Storage: st,
799+
CosignVerifierFactory: testCosignVerifierFactory,
800+
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
799801
}
800802

801803
obj := sourcev1.HelmChart{
@@ -1128,11 +1130,12 @@ func TestHelmChartReconciler_buildFromHelmRepository(t *testing.T) {
11281130
g.Expect(err).ToNot(HaveOccurred())
11291131

11301132
r := &HelmChartReconciler{
1131-
Client: clientBuilder.Build(),
1132-
EventRecorder: record.NewFakeRecorder(32),
1133-
Getters: testGetters,
1134-
Storage: testStorage,
1135-
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
1133+
Client: clientBuilder.Build(),
1134+
EventRecorder: record.NewFakeRecorder(32),
1135+
Getters: testGetters,
1136+
Storage: testStorage,
1137+
CosignVerifierFactory: testCosignVerifierFactory,
1138+
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
11361139
}
11371140

11381141
repository := &sourcev1.HelmRepository{
@@ -1380,11 +1383,12 @@ func TestHelmChartReconciler_buildFromOCIHelmRepository(t *testing.T) {
13801383
}
13811384

13821385
r := &HelmChartReconciler{
1383-
Client: clientBuilder.Build(),
1384-
EventRecorder: record.NewFakeRecorder(32),
1385-
Getters: testGetters,
1386-
Storage: st,
1387-
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
1386+
Client: clientBuilder.Build(),
1387+
EventRecorder: record.NewFakeRecorder(32),
1388+
Getters: testGetters,
1389+
Storage: st,
1390+
CosignVerifierFactory: testCosignVerifierFactory,
1391+
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
13881392
}
13891393

13901394
repository := &sourcev1.HelmRepository{
@@ -1907,8 +1911,9 @@ func TestHelmChartReconciler_getSource(t *testing.T) {
19071911
WithObjects(mocks...)
19081912

19091913
r := &HelmChartReconciler{
1910-
Client: clientBuilder.Build(),
1911-
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
1914+
Client: clientBuilder.Build(),
1915+
CosignVerifierFactory: testCosignVerifierFactory,
1916+
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
19121917
}
19131918

19141919
tests := []struct {
@@ -2023,9 +2028,10 @@ func TestHelmChartReconciler_reconcileDelete(t *testing.T) {
20232028
g := NewWithT(t)
20242029

20252030
r := &HelmChartReconciler{
2026-
EventRecorder: record.NewFakeRecorder(32),
2027-
Storage: testStorage,
2028-
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
2031+
EventRecorder: record.NewFakeRecorder(32),
2032+
Storage: testStorage,
2033+
CosignVerifierFactory: testCosignVerifierFactory,
2034+
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
20292035
}
20302036

20312037
obj := &sourcev1.HelmChart{
@@ -2163,7 +2169,8 @@ func TestHelmChartReconciler_reconcileSubRecs(t *testing.T) {
21632169
WithScheme(testEnv.GetScheme()).
21642170
WithStatusSubresource(&sourcev1.HelmChart{}).
21652171
Build(),
2166-
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
2172+
CosignVerifierFactory: testCosignVerifierFactory,
2173+
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
21672174
}
21682175
obj := &sourcev1.HelmChart{
21692176
ObjectMeta: metav1.ObjectMeta{
@@ -2877,11 +2884,12 @@ func TestHelmChartRepository_reconcileSource_verifyOCISourceSignature_keyless(t
28772884
clientBuilder.WithObjects(repository)
28782885

28792886
r := &HelmChartReconciler{
2880-
Client: clientBuilder.Build(),
2881-
EventRecorder: record.NewFakeRecorder(32),
2882-
Getters: testGetters,
2883-
Storage: testStorage,
2884-
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
2887+
Client: clientBuilder.Build(),
2888+
EventRecorder: record.NewFakeRecorder(32),
2889+
Getters: testGetters,
2890+
Storage: testStorage,
2891+
CosignVerifierFactory: testCosignVerifierFactory,
2892+
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
28852893
}
28862894

28872895
obj := &sourcev1.HelmChart{
@@ -3182,11 +3190,12 @@ func TestHelmChartReconciler_reconcileSourceFromOCI_verifySignatureNotation(t *t
31823190
clientBuilder.WithObjects(repository, secret, caSecret)
31833191

31843192
r := &HelmChartReconciler{
3185-
Client: clientBuilder.Build(),
3186-
EventRecorder: record.NewFakeRecorder(32),
3187-
Getters: testGetters,
3188-
Storage: st,
3189-
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
3193+
Client: clientBuilder.Build(),
3194+
EventRecorder: record.NewFakeRecorder(32),
3195+
Getters: testGetters,
3196+
Storage: testStorage,
3197+
CosignVerifierFactory: testCosignVerifierFactory,
3198+
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
31903199
}
31913200

31923201
obj := &sourcev1.HelmChart{
@@ -3433,11 +3442,12 @@ func TestHelmChartReconciler_reconcileSourceFromOCI_verifySignatureCosign(t *tes
34333442
clientBuilder.WithObjects(repository, secret)
34343443

34353444
r := &HelmChartReconciler{
3436-
Client: clientBuilder.Build(),
3437-
EventRecorder: record.NewFakeRecorder(32),
3438-
Getters: testGetters,
3439-
Storage: st,
3440-
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
3445+
Client: clientBuilder.Build(),
3446+
EventRecorder: record.NewFakeRecorder(32),
3447+
Getters: testGetters,
3448+
Storage: st,
3449+
CosignVerifierFactory: testCosignVerifierFactory,
3450+
patchOptions: getPatchOptions(helmChartReadyCondition.Owned, "sc"),
34413451
}
34423452

34433453
obj := &sourcev1.HelmChart{

‎internal/controller/ocirepository_controller.go‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -140,10 +140,11 @@ type OCIRepositoryReconciler struct {
140140
helper.Metrics
141141
kuberecorder.EventRecorder
142142

143-
Storage *storage.Storage
144-
ControllerName string
145-
TokenCache *cache.TokenCache
146-
requeueDependency time.Duration
143+
Storage *storage.Storage
144+
ControllerName string
145+
TokenCache *cache.TokenCache
146+
CosignVerifierFactory *scosign.CosignVerifierFactory
147+
requeueDependency time.Duration
147148

148149
patchOptions []patch.Option
149150
}
@@ -696,7 +697,7 @@ func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *sour
696697
for k, data := range pubSecret.Data {
697698
// search for public keys in the secret
698699
if strings.HasSuffix(k, ".pub") {
699-
verifier, err := scosign.NewCosignVerifier(ctxTimeout, append(defaultCosignOciOpts, scosign.WithPublicKey(data))...)
700+
verifier, err := r.CosignVerifierFactory.NewCosignVerifier(ctxTimeout, append(defaultCosignOciOpts, scosign.WithPublicKey(data))...)
700701
if err != nil {
701702
return soci.VerificationResultFailed, err
702703
}
@@ -732,7 +733,7 @@ func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *sour
732733
}
733734
defaultCosignOciOpts = append(defaultCosignOciOpts, scosign.WithIdentities(identities))
734735

735-
verifier, err := scosign.NewCosignVerifier(ctxTimeout, defaultCosignOciOpts...)
736+
verifier, err := r.CosignVerifierFactory.NewCosignVerifier(ctxTimeout, defaultCosignOciOpts...)
736737
if err != nil {
737738
return soci.VerificationResultFailed, err
738739
}

‎internal/controller/ocirepository_controller_test.go‎

Lines changed: 43 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -72,11 +72,16 @@ import (
7272

7373
sourcev1 "github.com/fluxcd/source-controller/api/v1"
7474
serror "github.com/fluxcd/source-controller/internal/error"
75+
scosign "github.com/fluxcd/source-controller/internal/oci/cosign"
7576
snotation "github.com/fluxcd/source-controller/internal/oci/notation"
7677
sreconcile "github.com/fluxcd/source-controller/internal/reconcile"
7778
testproxy "github.com/fluxcd/source-controller/tests/proxy"
7879
)
7980

81+
var (
82+
testCosignVerifierFactory = scosign.NewCosignVerifierFactory()
83+
)
84+
8085
func TestOCIRepositoryReconciler_deleteBeforeFinalizer(t *testing.T) {
8186
g := NewWithT(t)
8287

@@ -103,9 +108,10 @@ func TestOCIRepositoryReconciler_deleteBeforeFinalizer(t *testing.T) {
103108
g.Expect(k8sClient.Delete(ctx, ocirepo)).NotTo(HaveOccurred())
104109

105110
r := &OCIRepositoryReconciler{
106-
Client: k8sClient,
107-
EventRecorder: record.NewFakeRecorder(32),
108-
Storage: testStorage,
111+
Client: k8sClient,
112+
EventRecorder: record.NewFakeRecorder(32),
113+
Storage: testStorage,
114+
CosignVerifierFactory: testCosignVerifierFactory,
109115
}
110116
// NOTE: Only a real API server responds with an error in this scenario.
111117
_, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: client.ObjectKeyFromObject(ocirepo)})
@@ -798,10 +804,11 @@ func TestOCIRepository_reconcileSource_authStrategy(t *testing.T) {
798804
}
799805

800806
r := &OCIRepositoryReconciler{
801-
Client: clientBuilder.Build(),
802-
EventRecorder: record.NewFakeRecorder(32),
803-
Storage: testStorage,
804-
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
807+
Client: clientBuilder.Build(),
808+
EventRecorder: record.NewFakeRecorder(32),
809+
Storage: testStorage,
810+
CosignVerifierFactory: testCosignVerifierFactory,
811+
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
805812
}
806813

807814
opts := makeRemoteOptions(ctx, makeTransport(tt.insecure), authn.DefaultKeychain, nil)
@@ -1257,10 +1264,11 @@ func TestOCIRepository_reconcileSource_remoteReference(t *testing.T) {
12571264
WithStatusSubresource(&sourcev1.OCIRepository{})
12581265

12591266
r := &OCIRepositoryReconciler{
1260-
Client: clientBuilder.Build(),
1261-
EventRecorder: record.NewFakeRecorder(32),
1262-
Storage: testStorage,
1263-
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
1267+
Client: clientBuilder.Build(),
1268+
EventRecorder: record.NewFakeRecorder(32),
1269+
Storage: testStorage,
1270+
CosignVerifierFactory: testCosignVerifierFactory,
1271+
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
12641272
}
12651273

12661274
for _, tt := range tests {
@@ -1459,10 +1467,11 @@ func TestOCIRepository_reconcileSource_verifyOCISourceSignatureNotation(t *testi
14591467
WithStatusSubresource(&sourcev1.OCIRepository{})
14601468

14611469
r := &OCIRepositoryReconciler{
1462-
Client: clientBuilder.Build(),
1463-
EventRecorder: record.NewFakeRecorder(32),
1464-
Storage: testStorage,
1465-
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
1470+
Client: clientBuilder.Build(),
1471+
EventRecorder: record.NewFakeRecorder(32),
1472+
Storage: testStorage,
1473+
CosignVerifierFactory: testCosignVerifierFactory,
1474+
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
14661475
}
14671476

14681477
certTuple := testhelper.GetRSASelfSignedSigningCertTuple("notation self-signed certs for testing")
@@ -1822,10 +1831,11 @@ func TestOCIRepository_reconcileSource_verifyOCISourceTrustPolicyNotation(t *tes
18221831
WithStatusSubresource(&sourcev1.OCIRepository{})
18231832

18241833
r := &OCIRepositoryReconciler{
1825-
Client: clientBuilder.Build(),
1826-
EventRecorder: record.NewFakeRecorder(32),
1827-
Storage: testStorage,
1828-
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
1834+
Client: clientBuilder.Build(),
1835+
EventRecorder: record.NewFakeRecorder(32),
1836+
Storage: testStorage,
1837+
CosignVerifierFactory: testCosignVerifierFactory,
1838+
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
18291839
}
18301840

18311841
certTuple := testhelper.GetRSASelfSignedSigningCertTuple("notation self-signed certs for testing")
@@ -2118,10 +2128,11 @@ func TestOCIRepository_reconcileSource_verifyOCISourceSignatureCosign(t *testing
21182128
WithStatusSubresource(&sourcev1.OCIRepository{})
21192129

21202130
r := &OCIRepositoryReconciler{
2121-
Client: clientBuilder.Build(),
2122-
EventRecorder: record.NewFakeRecorder(32),
2123-
Storage: testStorage,
2124-
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
2131+
Client: clientBuilder.Build(),
2132+
EventRecorder: record.NewFakeRecorder(32),
2133+
Storage: testStorage,
2134+
CosignVerifierFactory: testCosignVerifierFactory,
2135+
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
21252136
}
21262137

21272138
pf := func(b bool) ([]byte, error) {
@@ -2384,10 +2395,11 @@ func TestOCIRepository_reconcileSource_verifyOCISourceSignature_keyless(t *testi
23842395
WithStatusSubresource(&sourcev1.OCIRepository{})
23852396

23862397
r := &OCIRepositoryReconciler{
2387-
Client: clientBuilder.Build(),
2388-
EventRecorder: record.NewFakeRecorder(32),
2389-
Storage: testStorage,
2390-
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
2398+
Client: clientBuilder.Build(),
2399+
EventRecorder: record.NewFakeRecorder(32),
2400+
Storage: testStorage,
2401+
CosignVerifierFactory: testCosignVerifierFactory,
2402+
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
23912403
}
23922404

23932405
for _, tt := range tests {
@@ -3344,9 +3356,10 @@ func TestOCIRepository_ReconcileDelete(t *testing.T) {
33443356
g := NewWithT(t)
33453357

33463358
r := &OCIRepositoryReconciler{
3347-
EventRecorder: record.NewFakeRecorder(32),
3348-
Storage: testStorage,
3349-
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
3359+
EventRecorder: record.NewFakeRecorder(32),
3360+
Storage: testStorage,
3361+
CosignVerifierFactory: testCosignVerifierFactory,
3362+
patchOptions: getPatchOptions(ociRepositoryReadyCondition.Owned, "sc"),
33503363
}
33513364

33523365
obj := &sourcev1.OCIRepository{

0 commit comments

Comments
 (0)