Linkerd2: Tap pod should consider subjectAltNames

Created on 22 Sep 2019 · 7Comments · Source: linkerd/linkerd2

When verifying for requestheader-allowed-names in the tap apiserver consider subjectAltNames for cases when there are multiple names.

arecontroller good first issue help wanted

Source

balchua

Most helpful comment

Hi sorry didn't give a bit more info here.

For example i have othername in the SAN and i add it to the kube apiserver option requestheader-allowed-names=commonname,othername the tap pod doesn't recognize it.

Because it only checks for the allowed names in the CN.

https://github.com/linkerd/linkerd2/blob/5e51208b5deea360932bd294337683f51a4571eb/controller/tap/apiserver.go#L98

balchua on 23 Sep 2019

🚀1 👍1

All 7 comments

Could you explain a little more about the situation where there are multiple names in the SAN?

grampelberg on 23 Sep 2019

Hi sorry didn't give a bit more info here.

For example i have othername in the SAN and i add it to the kube apiserver option requestheader-allowed-names=commonname,othername the tap pod doesn't recognize it.

Because it only checks for the allowed names in the CN.

https://github.com/linkerd/linkerd2/blob/5e51208b5deea360932bd294337683f51a4571eb/controller/tap/apiserver.go#L98

balchua on 23 Sep 2019

🚀1 👍1

Hey there! Is anyone working on this? I'm interested in helping out.

drholmie on 27 Sep 2019

@drholmie I think it's all yours!

wmorgan on 28 Sep 2019

Awesome. Thanks for the go ahead!

drholmie on 1 Oct 2019

🚀1

Hope it's alright, but I noticed there hadn't been any movement on this issue for a while. Figured I could knock it out quickly, so I threw a PR together.