Embed cluster CA in kubeconfig in necessary by matejvasek · Pull Request #37 · functions-dev/ocp-console-plugin

matejvasek · 2026-06-10T21:17:15Z

Summary

Replace insecure-skip-tls-verify: true in generated kubeconfigs with proper CA certificate handling
New backend endpoint GET /api/cluster/ca uses a two-probe approach: first tries system roots (public CA), then the service account CA bundle (private CA)
Only embeds the CA when the cluster uses a private CA; publicly trusted certs rely on the runner's system trust store
Copy RHEL CA trust bundle into ubi9-micro runtime image (it ships with no CA infrastructure at all)

Changes

Backend (backend/main.go, backend/main_test.go)

clusterCAHandler struct with injectable SystemTLS for testability
--kube-root-ca-path CLI flag to override the default SA CA path for local dev
8 tests covering all handler paths: missing param, non-HTTPS, missing file, public CA, private CA, bundle mismatch, empty file, malformed file

Frontend (OcpClusterService.ts, OcpClusterService.test.ts)

#fetchClusterCA calls the backend via the console proxy
#buildKubeconfig conditionally sets certificate-authority-data instead of insecure-skip-tls-verify
Tests for both CA-present (private) and CA-null (public) cases

Dev environment (init.sh)

extract_cluster_ca extracts the CA from kube-root-ca.crt ConfigMap via oc
Passes --kube-root-ca-path to the backend on startup and on file-watch restart

Container image (Dockerfile)

Copy /etc/pki/tls/certs/ca-bundle.crt from go-toolset build stage into ubi9-micro

Test plan

go test -v ./... (8 tests pass)
yarn ci (lint + 14 suites / 127 tests + build)
In-cluster: publicly trusted API server (Let's Encrypt) returns {ca: null}
In-cluster: private CA cluster returns {ca: "<base64>"}
Create a function on a private CA cluster, verify KUBECONFIG GitHub secret contains certificate-authority-data

🤖 Generated with Claude Code

The kubeconfig for GitHub Actions previously hardcoded insecure-skip-tls-verify, skipping TLS verification entirely. A new backend endpoint (GET /api/cluster/ca) reads the service account CA bundle, probes the API server's TLS certificate, and returns the CA only when the bundle actually verifies the handshake. If the bundle does not work (e.g. a mismatched intermediate after a Let's Encrypt rotation), it is omitted and the runner's system trust store handles verification instead. Signed-off-by: Matej Vašek <matejvasek@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com>

Add a system roots probe before the SA bundle probe. If the API server's cert is already publicly trusted, the CA is not embedded in the kubeconfig. This avoids shipping public CAs that may break after intermediate rotation (e.g. Let's Encrypt) while still embedding private ones that a GitHub Actions runner would not otherwise trust. Signed-off-by: Matej Vašek <matejvasek@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com> fixup: correct JSDoc on generateKubeconfig function Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Matej Vašek <matejvasek@gmail.com> fix: copy CA trust bundle into ubi9-micro runtime image ubi9-micro ships with no CA certificates, so the system roots TLS probe always failed and every cluster appeared to use a private CA. Copy the RHEL CA bundle from the go-toolset build stage so probe 1 can correctly identify publicly trusted certs. Signed-off-by: Matej Vašek <matejvasek@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com>

Replace the global saCAPath variable and systemTLSConfig function with a clusterCAHandler struct that holds CAPath and SystemTLS as fields. Tests construct their own handler instances instead of mutating and restoring globals. Signed-off-by: Matej Vašek <matejvasek@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com>

A missing service account CA file now returns an error instead of silently returning null. The MissingCAFile test is fixed to use a local TLS server so probe 1 always fails, ensuring the test actually exercises the file-read path. Signed-off-by: Matej Vašek <matejvasek@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com>

Add a CLI flag to override the default CA path so init.sh can extract the cluster CA via oc and pass it to the backend. This lets the /api/cluster/ca endpoint work outside a pod where the service account mount is not available. Signed-off-by: Matej Vašek <matejvasek@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Matej Vašek <matejvasek@gmail.com>

Cover the two previously untested error paths in clusterCAHandler: an empty CA file with no PEM blocks, and a CA file with a valid PEM envelope but corrupt DER content. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Matej Vašek <matejvasek@gmail.com>

Signed-off-by: Matej Vašek <matejvasek@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com>

matejvasek · 2026-06-10T21:17:40Z

/cc @dsimansk

dsimansk · 2026-06-11T07:39:18Z

 	mux.HandleFunc("POST /api/function/create", handleFuncCreate)
+	mux.Handle("GET /api/cluster/ca", &clusterCAHandler{CAPath: *caPath})
 	mux.Handle("/", http.FileServer(http.FS(static)))



I'm thinking if this couldn't be controller-runtime based controller with addition of static HTTP serve on top of it. But that's broader decision. Currently it make sense as it is.

Yeah, we probably move the backen to the functions operator eventually. It's not decided yet.

twoGiants

Just a few comments so far. Review is in progress.

twoGiants · 2026-06-12T11:03:59Z

+		if block.Type == "CERTIFICATE" {
+			cert, err := x509.ParseCertificate(block.Bytes)
+			if err != nil {
+				jsonError(w, "failed to parse CA certificate: "+err.Error(), http.StatusInternalServerError)
+				return
+			}
+			pool.AddCert(cert)
+			found = true
+		}


nit

Use guard pattern for less nested ifs.

Suggested change

if block.Type == "CERTIFICATE" {

cert, err := x509.ParseCertificate(block.Bytes)

if err != nil {

jsonError(w, "failed to parse CA certificate: "+err.Error(), http.StatusInternalServerError)

return

}

pool.AddCert(cert)

found = true

}

if block.Type != "CERTIFICATE" {

continue

}

cert, err := x509.ParseCertificate(block.Bytes)

if err != nil {

jsonError(w, "failed to parse CA certificate: "+err.Error(), http.StatusInternalServerError)

return

}

pool.AddCert(cert)

found = true

twoGiants · 2026-06-12T11:04:43Z

+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{"ca": nil})


Duplicated 3 times. You can extract it in a func.

twoGiants · 2026-06-12T11:06:59Z

I think we can start extracting the handlers in their own files.

The func create handler can be in a file and the ca handler in one.

You can put the common logic in common.go or leave in main.go.

twoGiants · 2026-06-12T11:09:38Z

 	mux.HandleFunc("POST /api/function/create", handleFuncCreate)
+	mux.Handle("GET /api/cluster/ca", &clusterCAHandler{CAPath: *caPath})
 	mux.Handle("/", http.FileServer(http.FS(static)))



Yeah, we probably move the backen to the functions operator eventually. It's not decided yet.

matejvasek and others added 7 commits June 10, 2026 22:00

docs: update progress log for kubeconfig CA session

db5c7a0

Signed-off-by: Matej Vašek <matejvasek@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com>

matejvasek requested a review from twoGiants June 10, 2026 21:17

matejvasek requested a review from gauron99 June 10, 2026 21:34

dsimansk reviewed Jun 11, 2026

View reviewed changes

twoGiants requested changes Jun 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Embed cluster CA in kubeconfig in necessary#37

Embed cluster CA in kubeconfig in necessary#37
matejvasek wants to merge 7 commits into
functions-dev:masterfrom
matejvasek:kubeconfig-ca

matejvasek commented Jun 10, 2026

Uh oh!

matejvasek commented Jun 10, 2026

Uh oh!

dsimansk Jun 11, 2026 •

edited

Loading

Uh oh!

twoGiants Jun 12, 2026

Uh oh!

twoGiants left a comment

Uh oh!

twoGiants Jun 12, 2026

Uh oh!

twoGiants Jun 12, 2026

Uh oh!

twoGiants Jun 12, 2026

Uh oh!

twoGiants Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		w.Header().Set("Content-Type", "application/json")
		json.NewEncoder(w).Encode(map[string]interface{}{"ca": nil})

Conversation

matejvasek commented Jun 10, 2026

Summary

Changes

Test plan

Uh oh!

matejvasek commented Jun 10, 2026

Uh oh!

dsimansk Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

twoGiants Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

twoGiants left a comment

Choose a reason for hiding this comment

Uh oh!

twoGiants Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

twoGiants Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

twoGiants Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

twoGiants Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dsimansk Jun 11, 2026 •

edited

Loading