Relax constraint on CA mandatory presence to comply with expected beh…

…avior in K8s (#256) resolves #255
infinyon · Aug 14, 2023 · fdda349 · fdda349
1 parent 9e669f2
commit fdda349
Show file tree

Hide file tree

Showing 4 changed files with 23 additions and 25 deletions.
diff --git a/src/k8-client/Cargo.toml b/src/k8-client/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 edition = "2021"
 name = "k8-client"
-version = "10.0.1"
+version = "10.0.2"
 authors = ["Fluvio Contributors <team@fluvio.io>"]
 description = "Core Kubernetes metadata traits"
 repository = "https://github.com/infinyon/k8-api"

diff --git a/src/k8-client/src/cert.rs b/src/k8-client/src/cert.rs
@@ -163,20 +163,14 @@ where
             builder.load_ca_cert_with_data(pem_bytes)?
         } else {
             // let not inline, then must must ref to file
-            let ca_certificate_path = current_cluster
-                .cluster
-                .certificate_authority
-                .as_ref()
-                .ok_or_else(|| {
-                    IoError::new(
-                        ErrorKind::InvalidInput,
-                        "current cluster must have CA crt path".to_owned(),
-                    )
-                })?;
-
-            debug!("loading cluster CA from: {:#?}", ca_certificate_path);
-
-            builder.load_ca_certificate(ca_certificate_path)?
+            if let Some(ca_certificate_path) =
+                current_cluster.cluster.certificate_authority.as_ref()
+            {
+                debug!("loading cluster CA from: {:#?}", ca_certificate_path);
+                builder.load_ca_certificate(ca_certificate_path)?
+            } else {
+                return Ok((builder, None));
+            }
         };
 
         // load client certs

diff --git a/src/k8-client/src/client/config_native.rs b/src/k8-client/src/client/config_native.rs
@@ -154,16 +154,17 @@ impl ConfigBuilder for HyperClientBuilder {
     }
 
     fn build(self) -> Result<Self::Client, ClientError> {
-        let ca_cert = match self.ca_cert {
-            Some(cert) => cert,
-            None => return Err(ClientError::Other("no ca cert".to_string())),
-        };
+        let ca_cert = self.ca_cert;
 
-        let connector_builder = match self.client_identity {
-            Some(builder) => ConnectorBuilder::identity(builder)?.add_root_certificate(ca_cert)?,
-            None => ConnectorBuilder::anonymous().add_root_certificate(ca_cert)?,
+        let mut connector_builder = match self.client_identity {
+            Some(builder) => ConnectorBuilder::identity(builder)?,
+            None => ConnectorBuilder::anonymous(),
         };
 
+        if let Some(ca_cert) = ca_cert {
+            connector_builder = connector_builder.add_root_certificate(ca_cert)?
+        }
+
         let connector = connector_builder.build();
         Ok(Client::builder()
             .executor(FluvioHyperExecutor)

diff --git a/src/k8-client/src/client/config_openssl.rs b/src/k8-client/src/client/config_openssl.rs
@@ -158,15 +158,18 @@ impl ConfigBuilder for HyperClientBuilder {
 
     fn build(self) -> Result<Self::Client, ClientError> {
         let ca_cert = match self.ca_cert {
-            Some(cert) => cert.build()?,
-            None => return Err(ClientError::Other("no ca cert".to_string())),
+            Some(cert) => cert.build().ok(),
+            None => None,
         };
         let mut connector_builder = TlsConnector::builder()?;
 
         if let Some(builder) = self.client_identity {
             connector_builder = connector_builder.with_identity(builder)?;
         }
-        let connector_builder = connector_builder.add_root_certificate(ca_cert)?;
+
+        if let Some(ca_cert) = ca_cert {
+            connector_builder = connector_builder.add_root_certificate(ca_cert)?;
+        }
 
         let connector = connector_builder.build();
         Ok(Client::builder()