MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-04-22 03:24:38 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: reading multiple TLS certificates when deployed in K8S (#10601)

Browse Source 
Ignore all regular files, CAs directory and any 
directory that starts with `..` inside the
`.minio/certs` folder
This commit is contained in:
Lenin Alevski 2020-09-30 08:21:30 -07:00 committed by GitHub
parent 2b4eb87d77
commit bea87a5a20
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
cmd/common-main.go
View File

@ -334,14 +334,23 @@ func getTLSConfig() (x509Certs []*x509.Certificate, manager *certs.Manager, secu
return nil, nil, false, err return nil, nil, false, err
} }
for _, file := range files { for _, file := range files {
// We exclude any regular file and the "CAs/" directory. // Ignore all
// The "CAs/" directory contains (root) CA certificates // - regular files
// that MinIO adds to its list of trusted roots (tls.Config.RootCAs). // - "CAs" directory
// Therefore, "CAs/" does not contain X.509 certificates that // - any directory which starts with ".."
// are meant to be served by MinIO. if file.Mode().IsRegular() || file.Name() == "CAs" || strings.HasPrefix(file.Name(), "..") {
if !file.IsDir() || file.Name() == "CAs" {
continue continue
} }
if file.Mode()&os.ModeSymlink == os.ModeSymlink {
file, err = os.Stat(filepath.Join(root.Name(), file.Name()))
if err != nil {
// not accessible ignore
continue
}
if !file.IsDir() {
continue
}
}
var ( var (
certFile = filepath.Join(root.Name(), file.Name(), publicCertFile) certFile = filepath.Join(root.Name(), file.Name(), publicCertFile)
@ -350,8 +359,8 @@ func getTLSConfig() (x509Certs []*x509.Certificate, manager *certs.Manager, secu
if !isFile(certFile) || !isFile(keyFile) { if !isFile(certFile) || !isFile(keyFile) {
continue continue
} }
if err := manager.AddCertificate(certFile, keyFile); err != nil { if err = manager.AddCertificate(certFile, keyFile); err != nil {
err = fmt.Errorf("Failed to load TLS certificate '%s': %v", certFile, err) err = fmt.Errorf("Unable to load TLS certificate '%s,%s': %w", certFile, keyFile, err)
logger.LogIf(GlobalContext, err, logger.Minio) logger.LogIf(GlobalContext, err, logger.Minio)
} }
} }