// To check the addon agent csr, we check
// 1. if the signer name in csr request is valid.
// 2. if organization field and commonName field in csr request is valid.
// 3. if user name in csr is the same as commonName field in csr request.
To check the addon agent csr, we check
1. if the signer name in csr request is valid.
2. if organization field and commonName field in csr request is valid.
3. if user name in csr is the same as commonName field in csr request.
// To check the addon agent csr we check // 1 . if the signer name in csr request is valid . // 2 . if organization field and commonName field in csr request is valid . // 3 . if user name in csr is the same as commonName field in csr request .
func (a *addOnAgent) csrApproveCheck(cluster *clusterv1.ManagedCluster, addon *addonapiv1alpha1.ManagedClusterAddOn,
	csr *certificatesv1.CertificateSigningRequest) bool {
	if csr.Spec.SignerName != certificatesv1.KubeAPIServerClientSignerName {
		return false
	}
	block, _ := pem.Decode(csr.Spec.Request)
	if block == nil || block.Type != "CERTIFICATE REQUEST" {
		klog.V(4).Infof("csr %q was not recognized: PEM block type is not CERTIFICATE REQUEST", csr.Name)
		return false
	}
	x509cr, err := x509.ParseCertificateRequest(block.Bytes)
	if err != nil {
		klog.V(4).Infof("csr %q was not recognized: %v", csr.Name, err)
		return false
	}
	requestingOrgs := sets.NewString(x509cr.Subject.Organization...)
	if requestingOrgs.Len() != 3 {
		return false
	}
	if !requestingOrgs.Has(authenticatedGroup) {
		return false
	}
	if !requestingOrgs.Has(addOnGroup) {
		return false
	}
	if !requestingOrgs.Has(fmt.Sprintf(clusterAddOnGroup, cluster.Name)) {
		return false
	}
	return fmt.Sprintf(agentUserName, cluster.Name) == x509cr.Subject.CommonName
}
func ( a * addOnAgent ) csrApproveCheck ( cluster * clusterv1 . ManagedCluster , addon * addonapiv1alpha1 . ManagedClusterAddOn , csr * certificatesv1 . CertificateSigningRequest ) bool { if csr . Spec . SignerName != certificatesv1 . KubeAPIServerClientSignerName { return false } block , _ := pem . Decode ( csr . Spec . Request ) if block == nil || block . Type != " " { klog . V ( 4 ) . Infof ( " " , csr . Name ) return false } x509cr , err := x509 . ParseCertificateRequest ( block . Bytes ) if err != nil { klog . V ( 4 ) . Infof ( " " , csr . Name , err ) return false } requestingOrgs := sets . NewString ( x509cr . Subject . Organization ... ) if requestingOrgs . Len ( ) != 3 { return false } if ! requestingOrgs . Has ( authenticatedGroup ) { return false } if ! requestingOrgs . Has ( addOnGroup ) { return false } if ! requestingOrgs . Has ( fmt . Sprintf ( clusterAddOnGroup , cluster . Name ) ) { return false } return fmt . Sprintf ( agentUserName , cluster . Name ) == x509cr . Subject . CommonName }
To check the addon agent csr, we check
1. if the signer name in csr request is valid.
To check the addon agent csr we check 1 . if the signer name in csr request is valid .