Giters

cyberark / conjur

CyberArk Conjur automatically secures secrets used by privileged users and machine identities

Home Page:https://conjur.org

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Kubernetes Authenticator Websocket Client doesn't support Server Name Indication (SNI)

micahlee opened this issue · comments

commented

The Kubernetes authenticator makes two separate connection types to the k8s API:

  • Request/response HTTP API connections using kubeclient (for pod metadata).
  • Websocket connection using an internal client (for auth certificate injection).

Server Name Indication (SNI) is a TLS extension that allows a web server to serve content securely for multiple domain names by including the intended hostname in the TLS handshake.

Currently, our kubeclient connection does support SNI, but the websocket connection does not. This means each of these connection phases can receive a different server certificate. This can lead to certificate verification errors unless the CA certificates for both SNI and non-SNI connections are configured in the kubernetes/ca-cert authentication webservice annotation.

Acceptance Criteria:

  • A regression test exists that verifies SNI behavior for the websocket client
  • The websocket client supports SNI when establishing the connection