Skip to content

Fixes for Kubernetes Ingress Controller #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+3 −4
Open

Fixes for Kubernetes Ingress Controller #3

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ff3abb0
:bug: Use wget instead of curl and remove openssl.pkey
tigerxy Oct 11, 2021
6e6b34f
:rotating_light: Make this variable local
tigerxy Oct 11, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions kong/plugins/jwt-firebase/handler.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
local constants = require "kong.constants"
local local_constants = require "kong.plugins.jwt-firebase.constants"
local jwt_decoder = require "kong.plugins.jwt.jwt_parser"
local openssl_pkey = require "openssl.pkey"


local shm = "/dev/shm/kong.jwt-firebase.pubkey"
Expand Down Expand Up @@ -29,7 +28,7 @@ local function grab_public_key_bykid(t_kid)
kong.log.debug("### Grabbing pubkey from google ..")
local google_url = "https://www.googleapis.com/robot/v1/metadata/x509/[email protected]"
local magic = " | cut -d \"\\\"\" -f4- | sed 's/\\\\n/\\n/g\' | sed 's/\"//g' | openssl x509 -pubkey -noout"
local cmd = "curl -s " .. google_url .. " | grep -i " .. t_kid .. magic
local cmd = "wget -qO - " .. google_url .. " | grep -i " .. t_kid .. magic
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure this? :/


kong.log.debug("### cmd: " .. cmd)
local cmd_handle = io.popen(cmd)
Expand Down Expand Up @@ -64,7 +63,7 @@ local function get_public_key_from_file(dir)
return nil
end
io.input(file)
content = io.read("*a")
local content = io.read("*a")
io.close(file)
return content
end
Expand Down Expand Up @@ -211,7 +210,7 @@ local function do_authentication(conf)
-- -- -- -- assign this key to public_key
local public_key = get_public_key_from_file(shm)
kong.log.debug(public_key)
if not pcall(openssl_pkey.new, public_key) or public_key == nil then
if public_key == nil then
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do believe this step is needed, do you think we should we the base distroless image instead?
https://github.com/GoogleContainerTools/distroless/blob/main/base/README.md

kong.log.info("Public key in a file is empty or invalid")
--local t_public_key = grab_1st_public_key()
local t_public_key = grab_public_key_bykid(kid)
Expand Down