{"action":"created","comment":{"url":"https://api.github.com/repos/istio/istio/pulls/comments/360594316","pull_request_review_id":335549245,"id":360594316,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDM2MDU5NDMxNg==","diff_hunk":"@@ -567,12 +602,107 @@ func (sc *SecretCache) generateGatewaySecret(token string, connKey ConnKey, t ti\n \t}, nil\n }\n \n+// If there is existing root certificates under a well known path, return true.\n+// Otherwise, return false.\n+func (sc *SecretCache) rootCertificateExists() bool {\n+\tb, err := ioutil.ReadFile(existingRootCertFile)\n+\tif err != nil || len(b) == 0 {\n+\t\treturn false\n+\t}\n+\treturn true\n+}\n+\n+// If there is an existing private key and certificate under a well known path, return true.\n+// Otherwise, return false.\n+func (sc *SecretCache) keyCertificateExists() bool {\n+\tb, err := ioutil.ReadFile(existingCertChainFile)\n+\tif err != nil || len(b) == 0 {\n+\t\treturn false\n+\t}\n+\tb, err = ioutil.ReadFile(existingKeyFile)\n+\tif err != nil || len(b) == 0 {\n+\t\treturn false\n+\t}\n+\n+\treturn true\n+}\n+\n+// Generate a root certificate item from the existing root certificate file\n+// under a well known path.\n+func (sc *SecretCache) generateRootCertFromExistingFile(token string, connKey ConnKey) (*model.SecretItem, error) {\n+\trootCert, err := ioutil.ReadFile(existingRootCertFile)\n+\tif err != nil {\n+\t\treturn nil, err\n+\t}\n+\n+\tt := time.Now()\n+\tvar certExpireTime time.Time\n+\tif certExpireTime, err = nodeagentutil.ParseCertAndGetExpiryTimestamp(rootCert); err != nil {\n+\t\tcacheLog.Errorf(\"failed to extract expire time from the root certificate: %v\", err)\n+\t\treturn nil, fmt.Errorf(\"failed to extract expire time from the root certificate: %v\", err)\n+\t}\n+\n+\t// Set the rootCert\n+\tsc.rootCertMutex.Lock()\n+\tsc.rootCert = rootCert\n+\tsc.rootCertMutex.Unlock()\n+\n+\treturn &model.SecretItem{\n+\t\tResourceName: connKey.ResourceName,\n+\t\tRootCert:     rootCert,\n+\t\tExpireTime:   certExpireTime,\n+\t\tToken:        token,\n+\t\tCreatedTime:  t,\n+\t\tVersion:      t.String(),\n+\t}, nil\n+}\n+\n+// Generate a key and certificate item from the existing key certificate files\n+// under a well known path.\n+func (sc *SecretCache) generateKeyCertFromExistingFiles(token string, connKey ConnKey) (*model.SecretItem, error) {\n+\tcertChain, err := ioutil.ReadFile(existingCertChainFile)\n+\tif err != nil {\n+\t\treturn nil, err\n+\t}\n+\tkeyPEM, err := ioutil.ReadFile(existingKeyFile)\n+\tif err != nil {\n+\t\treturn nil, err\n+\t}\n+\trootCertPEM, err := ioutil.ReadFile(existingRootCertFile)\n+\tif err != nil {\n+\t\treturn nil, err\n+\t}\n+\n+\tt := time.Now()\n+\tvar certExpireTime time.Time\n+\tif certExpireTime, err = nodeagentutil.ParseCertAndGetExpiryTimestamp(certChain); err != nil {\n+\t\tcacheLog.Errorf(\"failed to extract expire time from the certificate: %v\", err)\n+\t\treturn nil, fmt.Errorf(\"failed to extract expire time from the certificate: %v\", err)","path":"security/pkg/nodeagent/cache/secretcache.go","position":null,"original_position":144,"commit_id":"cf18d0ed98528798764a635367e59c3241e64f1c","original_commit_id":"f05e8c13ba372f45298c5a2f915947a232ea561d","user":{"login":"lei-tang","id":32078630,"node_id":"MDQ6VXNlcjMyMDc4NjMw","avatar_url":"https://avatars1.githubusercontent.com/u/32078630?v=4","gravatar_id":"","url":"https://api.github.com/users/lei-tang","html_url":"https://github.com/lei-tang","followers_url":"https://api.github.com/users/lei-tang/followers","following_url":"https://api.github.com/users/lei-tang/following{/other_user}","gists_url":"https://api.github.com/users/lei-tang/gists{/gist_id}","starred_url":"https://api.github.com/users/lei-tang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lei-tang/subscriptions","organizations_url":"https://api.github.com/users/lei-tang/orgs","repos_url":"https://api.github.com/users/lei-tang/repos","events_url":"https://api.github.com/users/lei-tang/events{/privacy}","received_events_url":"https://api.github.com/users/lei-tang/received_events","type":"User","site_admin":false},"body":"Done.","created_at":"2019-12-20T22:20:52Z","updated_at":"2019-12-20T22:20:52Z","html_url":"https://github.com/istio/istio/pull/19687#discussion_r360594316","pull_request_url":"https://api.github.com/repos/istio/istio/pulls/19687","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/istio/istio/pulls/comments/360594316"},"html":{"href":"https://github.com/istio/istio/pull/19687#discussion_r360594316"},"pull_request":{"href":"https://api.github.com/repos/istio/istio/pulls/19687"}},"in_reply_to_id":360566449},"pull_request":{"url":"https://api.github.com/repos/istio/istio/pulls/19687","id":354889796,"node_id":"MDExOlB1bGxSZXF1ZXN0MzU0ODg5Nzk2","html_url":"https://github.com/istio/istio/pull/19687","diff_url":"https://github.com/istio/istio/pull/19687.diff","patch_url":"https://github.com/istio/istio/pull/19687.patch","issue_url":"https://api.github.com/repos/istio/istio/issues/19687","number":19687,"state":"open","locked":false,"title":"Support SDS flow that gets root CA certificates or a workload certificate from existing files","user":{"login":"lei-tang","id":32078630,"node_id":"MDQ6VXNlcjMyMDc4NjMw","avatar_url":"https://avatars1.githubusercontent.com/u/32078630?v=4","gravatar_id":"","url":"https://api.github.com/users/lei-tang","html_url":"https://github.com/lei-tang","followers_url":"https://api.github.com/users/lei-tang/followers","following_url":"https://api.github.com/users/lei-tang/following{/other_user}","gists_url":"https://api.github.com/users/lei-tang/gists{/gist_id}","starred_url":"https://api.github.com/users/lei-tang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lei-tang/subscriptions","organizations_url":"https://api.github.com/users/lei-tang/orgs","repos_url":"https://api.github.com/users/lei-tang/repos","events_url":"https://api.github.com/users/lei-tang/events{/privacy}","received_events_url":"https://api.github.com/users/lei-tang/received_events","type":"User","site_admin":false},"body":"Please provide a description for what this PR is for: https://github.com/istio/istio/issues/19686\n\n\n[ ] Configuration Infrastructure\n[ ] Docs\n[ ] Installation\n[X ] Networking\n[ ] Performance and Scalability\n[ ] Policies and Telemetry\n[X ] Security\n[ ] Test and Release\n[ ] User Experience\n[ ] Developer Infrastructure","created_at":"2019-12-19T00:57:57Z","updated_at":"2019-12-20T22:20:52Z","closed_at":null,"merged_at":null,"merge_commit_sha":"18751843c66f5aab64b5a32358caa10d750dba17","assignee":null,"assignees":[],"requested_reviewers":[{"login":"howardjohn","id":623453,"node_id":"MDQ6VXNlcjYyMzQ1Mw==","avatar_url":"https://avatars1.githubusercontent.com/u/623453?v=4","gravatar_id":"","url":"https://api.github.com/users/howardjohn","html_url":"https://github.com/howardjohn","followers_url":"https://api.github.com/users/howardjohn/followers","following_url":"https://api.github.com/users/howardjohn/following{/other_user}","gists_url":"https://api.github.com/users/howardjohn/gists{/gist_id}","starred_url":"https://api.github.com/users/howardjohn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/howardjohn/subscriptions","organizations_url":"https://api.github.com/users/howardjohn/orgs","repos_url":"https://api.github.com/users/howardjohn/repos","events_url":"https://api.github.com/users/howardjohn/events{/privacy}","received_events_url":"https://api.github.com/users/howardjohn/received_events","type":"User","site_admin":false},{"login":"JimmyCYJ","id":28548492,"node_id":"MDQ6VXNlcjI4NTQ4NDky","avatar_url":"https://avatars0.githubusercontent.com/u/28548492?v=4","gravatar_id":"","url":"https://api.github.com/users/JimmyCYJ","html_url":"https://github.com/JimmyCYJ","followers_url":"https://api.github.com/users/JimmyCYJ/followers","following_url":"https://api.github.com/users/JimmyCYJ/following{/other_user}","gists_url":"https://api.github.com/users/JimmyCYJ/gists{/gist_id}","starred_url":"https://api.github.com/users/JimmyCYJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JimmyCYJ/subscriptions","organizations_url":"https://api.github.com/users/JimmyCYJ/orgs","repos_url":"https://api.github.com/users/JimmyCYJ/repos","events_url":"https://api.github.com/users/JimmyCYJ/events{/privacy}","received_events_url":"https://api.github.com/users/JimmyCYJ/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[{"id":735781806,"node_id":"MDU6TGFiZWw3MzU3ODE4MDY=","url":"https://api.github.com/repos/istio/istio/labels/area/networking","name":"area/networking","color":"0e8a16","default":false,"description":null},{"id":744786716,"node_id":"MDU6TGFiZWw3NDQ3ODY3MTY=","url":"https://api.github.com/repos/istio/istio/labels/area/security","name":"area/security","color":"0e8a16","default":false,"description":null},{"id":1475126481,"node_id":"MDU6TGFiZWwxNDc1MTI2NDgx","url":"https://api.github.com/repos/istio/istio/labels/cla:%20yes","name":"cla: yes","color":"bfdadc","default":false,"description":"Set by the Google CLA bot to indicate the author of a PR has signed the Google CLA."},{"id":1448953239,"node_id":"MDU6TGFiZWwxNDQ4OTUzMjM5","url":"https://api.github.com/repos/istio/istio/labels/size/L","name":"size/L","color":"77bb00","default":false,"description":"Denotes a PR that changes 100-499 lines, ignoring generated files."}],"milestone":null,"commits_url":"https://api.github.com/repos/istio/istio/pulls/19687/commits","review_comments_url":"https://api.github.com/repos/istio/istio/pulls/19687/comments","review_comment_url":"https://api.github.com/repos/istio/istio/pulls/comments{/number}","comments_url":"https://api.github.com/repos/istio/istio/issues/19687/comments","statuses_url":"https://api.github.com/repos/istio/istio/statuses/cf18d0ed98528798764a635367e59c3241e64f1c","head":{"label":"lei-tang:sds-from-cert","ref":"sds-from-cert","sha":"cf18d0ed98528798764a635367e59c3241e64f1c","user":{"login":"lei-tang","id":32078630,"node_id":"MDQ6VXNlcjMyMDc4NjMw","avatar_url":"https://avatars1.githubusercontent.com/u/32078630?v=4","gravatar_id":"","url":"https://api.github.com/users/lei-tang","html_url":"https://github.com/lei-tang","followers_url":"https://api.github.com/users/lei-tang/followers","following_url":"https://api.github.com/users/lei-tang/following{/other_user}","gists_url":"https://api.github.com/users/lei-tang/gists{/gist_id}","starred_url":"https://api.github.com/users/lei-tang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lei-tang/subscriptions","organizations_url":"https://api.github.com/users/lei-tang/orgs","repos_url":"https://api.github.com/users/lei-tang/repos","events_url":"https://api.github.com/users/lei-tang/events{/privacy}","received_events_url":"https://api.github.com/users/lei-tang/received_events","type":"User","site_admin":false},"repo":{"id":112253097,"node_id":"MDEwOlJlcG9zaXRvcnkxMTIyNTMwOTc=","name":"istio","full_name":"lei-tang/istio","private":false,"owner":{"login":"lei-tang","id":32078630,"node_id":"MDQ6VXNlcjMyMDc4NjMw","avatar_url":"https://avatars1.githubusercontent.com/u/32078630?v=4","gravatar_id":"","url":"https://api.github.com/users/lei-tang","html_url":"https://github.com/lei-tang","followers_url":"https://api.github.com/users/lei-tang/followers","following_url":"https://api.github.com/users/lei-tang/following{/other_user}","gists_url":"https://api.github.com/users/lei-tang/gists{/gist_id}","starred_url":"https://api.github.com/users/lei-tang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lei-tang/subscriptions","organizations_url":"https://api.github.com/users/lei-tang/orgs","repos_url":"https://api.github.com/users/lei-tang/repos","events_url":"https://api.github.com/users/lei-tang/events{/privacy}","received_events_url":"https://api.github.com/users/lei-tang/received_events","type":"User","site_admin":false},"html_url":"https://github.com/lei-tang/istio","description":"An open platform to connect, manage, and secure microservices.","fork":true,"url":"https://api.github.com/repos/lei-tang/istio","forks_url":"https://api.github.com/repos/lei-tang/istio/forks","keys_url":"https://api.github.com/repos/lei-tang/istio/keys{/key_id}","collaborators_url":"https://api.github.com/repos/lei-tang/istio/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/lei-tang/istio/teams","hooks_url":"https://api.github.com/repos/lei-tang/istio/hooks","issue_events_url":"https://api.github.com/repos/lei-tang/istio/issues/events{/number}","events_url":"https://api.github.com/repos/lei-tang/istio/events","assignees_url":"https://api.github.com/repos/lei-tang/istio/assignees{/user}","branches_url":"https://api.github.com/repos/lei-tang/istio/branches{/branch}","tags_url":"https://api.github.com/repos/lei-tang/istio/tags","blobs_url":"https://api.github.com/repos/lei-tang/istio/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/lei-tang/istio/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/lei-tang/istio/git/refs{/sha}","trees_url":"https://api.github.com/repos/lei-tang/istio/git/trees{/sha}","statuses_url":"https://api.github.com/repos/lei-tang/istio/statuses/{sha}","languages_url":"https://api.github.com/repos/lei-tang/istio/languages","stargazers_url":"https://api.github.com/repos/lei-tang/istio/stargazers","contributors_url":"https://api.github.com/repos/lei-tang/istio/contributors","subscribers_url":"https://api.github.com/repos/lei-tang/istio/subscribers","subscription_url":"https://api.github.com/repos/lei-tang/istio/subscription","commits_url":"https://api.github.com/repos/lei-tang/istio/commits{/sha}","git_commits_url":"https://api.github.com/repos/lei-tang/istio/git/commits{/sha}","comments_url":"https://api.github.com/repos/lei-tang/istio/comments{/number}","issue_comment_url":"https://api.github.com/repos/lei-tang/istio/issues/comments{/number}","contents_url":"https://api.github.com/repos/lei-tang/istio/contents/{+path}","compare_url":"https://api.github.com/repos/lei-tang/istio/compare/{base}...{head}","merges_url":"https://api.github.com/repos/lei-tang/istio/merges","archive_url":"https://api.github.com/repos/lei-tang/istio/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/lei-tang/istio/downloads","issues_url":"https://api.github.com/repos/lei-tang/istio/issues{/number}","pulls_url":"https://api.github.com/repos/lei-tang/istio/pulls{/number}","milestones_url":"https://api.github.com/repos/lei-tang/istio/milestones{/number}","notifications_url":"https://api.github.com/repos/lei-tang/istio/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/lei-tang/istio/labels{/name}","releases_url":"https://api.github.com/repos/lei-tang/istio/releases{/id}","deployments_url":"https://api.github.com/repos/lei-tang/istio/deployments","created_at":"2017-11-27T21:55:09Z","updated_at":"2019-10-17T18:04:39Z","pushed_at":"2019-12-20T22:19:57Z","git_url":"git://github.com/lei-tang/istio.git","ssh_url":"git@github.com:lei-tang/istio.git","clone_url":"https://github.com/lei-tang/istio.git","svn_url":"https://github.com/lei-tang/istio","homepage":"https://istio.io","size":112051,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"istio:master","ref":"master","sha":"79871b3e5b86d87c6f9d648131afdc251f8ead79","user":{"login":"istio","id":23534644,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIzNTM0NjQ0","avatar_url":"https://avatars1.githubusercontent.com/u/23534644?v=4","gravatar_id":"","url":"https://api.github.com/users/istio","html_url":"https://github.com/istio","followers_url":"https://api.github.com/users/istio/followers","following_url":"https://api.github.com/users/istio/following{/other_user}","gists_url":"https://api.github.com/users/istio/gists{/gist_id}","starred_url":"https://api.github.com/users/istio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/istio/subscriptions","organizations_url":"https://api.github.com/users/istio/orgs","repos_url":"https://api.github.com/users/istio/repos","events_url":"https://api.github.com/users/istio/events{/privacy}","received_events_url":"https://api.github.com/users/istio/received_events","type":"Organization","site_admin":false},"repo":{"id":74175805,"node_id":"MDEwOlJlcG9zaXRvcnk3NDE3NTgwNQ==","name":"istio","full_name":"istio/istio","private":false,"owner":{"login":"istio","id":23534644,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIzNTM0NjQ0","avatar_url":"https://avatars1.githubusercontent.com/u/23534644?v=4","gravatar_id":"","url":"https://api.github.com/users/istio","html_url":"https://github.com/istio","followers_url":"https://api.github.com/users/istio/followers","following_url":"https://api.github.com/users/istio/following{/other_user}","gists_url":"https://api.github.com/users/istio/gists{/gist_id}","starred_url":"https://api.github.com/users/istio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/istio/subscriptions","organizations_url":"https://api.github.com/users/istio/orgs","repos_url":"https://api.github.com/users/istio/repos","events_url":"https://api.github.com/users/istio/events{/privacy}","received_events_url":"https://api.github.com/users/istio/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/istio/istio","description":"Connect, secure, control, and observe services.","fork":false,"url":"https://api.github.com/repos/istio/istio","forks_url":"https://api.github.com/repos/istio/istio/forks","keys_url":"https://api.github.com/repos/istio/istio/keys{/key_id}","collaborators_url":"https://api.github.com/repos/istio/istio/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/istio/istio/teams","hooks_url":"https://api.github.com/repos/istio/istio/hooks","issue_events_url":"https://api.github.com/repos/istio/istio/issues/events{/number}","events_url":"https://api.github.com/repos/istio/istio/events","assignees_url":"https://api.github.com/repos/istio/istio/assignees{/user}","branches_url":"https://api.github.com/repos/istio/istio/branches{/branch}","tags_url":"https://api.github.com/repos/istio/istio/tags","blobs_url":"https://api.github.com/repos/istio/istio/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/istio/istio/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/istio/istio/git/refs{/sha}","trees_url":"https://api.github.com/repos/istio/istio/git/trees{/sha}","statuses_url":"https://api.github.com/repos/istio/istio/statuses/{sha}","languages_url":"https://api.github.com/repos/istio/istio/languages","stargazers_url":"https://api.github.com/repos/istio/istio/stargazers","contributors_url":"https://api.github.com/repos/istio/istio/contributors","subscribers_url":"https://api.github.com/repos/istio/istio/subscribers","subscription_url":"https://api.github.com/repos/istio/istio/subscription","commits_url":"https://api.github.com/repos/istio/istio/commits{/sha}","git_commits_url":"https://api.github.com/repos/istio/istio/git/commits{/sha}","comments_url":"https://api.github.com/repos/istio/istio/comments{/number}","issue_comment_url":"https://api.github.com/repos/istio/istio/issues/comments{/number}","contents_url":"https://api.github.com/repos/istio/istio/contents/{+path}","compare_url":"https://api.github.com/repos/istio/istio/compare/{base}...{head}","merges_url":"https://api.github.com/repos/istio/istio/merges","archive_url":"https://api.github.com/repos/istio/istio/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/istio/istio/downloads","issues_url":"https://api.github.com/repos/istio/istio/issues{/number}","pulls_url":"https://api.github.com/repos/istio/istio/pulls{/number}","milestones_url":"https://api.github.com/repos/istio/istio/milestones{/number}","notifications_url":"https://api.github.com/repos/istio/istio/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/istio/istio/labels{/name}","releases_url":"https://api.github.com/repos/istio/istio/releases{/id}","deployments_url":"https://api.github.com/repos/istio/istio/deployments","created_at":"2016-11-18T23:57:21Z","updated_at":"2019-12-20T20:52:10Z","pushed_at":"2019-12-20T22:20:00Z","git_url":"git://github.com/istio/istio.git","ssh_url":"git@github.com:istio/istio.git","clone_url":"https://github.com/istio/istio.git","svn_url":"https://github.com/istio/istio","homepage":"https://istio.io","size":109746,"stargazers_count":20938,"watchers_count":20938,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3781,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":1068,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":3781,"open_issues":1068,"watchers":20938,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/istio/istio/pulls/19687"},"html":{"href":"https://github.com/istio/istio/pull/19687"},"issue":{"href":"https://api.github.com/repos/istio/istio/issues/19687"},"comments":{"href":"https://api.github.com/repos/istio/istio/issues/19687/comments"},"review_comments":{"href":"https://api.github.com/repos/istio/istio/pulls/19687/comments"},"review_comment":{"href":"https://api.github.com/repos/istio/istio/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/istio/istio/pulls/19687/commits"},"statuses":{"href":"https://api.github.com/repos/istio/istio/statuses/cf18d0ed98528798764a635367e59c3241e64f1c"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"lei-tang"}}