Merge branch 'main' into fix-crash-loop

README.md

@@ -55,19 +55,11 @@ make docker-buildx
 # load the image into kind
 make kind-load-image
 
-# Choose one of the following ways to deploy the external data provider:
-
-# 1. client and server auth enabled (recommended)
-helm install attest-provider charts/external-data-provider \
+# deploy attest provider
+helm install attest-provider charts/attest-provider \
     --set provider.tls.caBundle="$(cat certs/ca.crt | base64 | tr -d '\n\r')" \
+    --set image="docker/attest-provider:dev" \
     --namespace "${NAMESPACE:-gatekeeper-system}"
-
-# 2. client auth disabled and server auth enabled
-helm install attest-provider charts/external-data-provider \
-    --set clientCAFile="" \
-    --set provider.tls.caBundle="$(cat certs/ca.crt | base64 | tr -d '\n\r')" \
-    --namespace "${NAMESPACE:-gatekeeper-system}" \
-    --create-namespace
 ```
 
 4. Install constraint template and constraint.

charts/attest-provider/templates/attest-provider-deployment.yaml

@@ -68,6 +68,11 @@ spec:
           mountPath: {{ .Values.certDir }}
           readOnly: true
         {{- end }}
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: {{ .Values.port }}
+            scheme: HTTPS
       restartPolicy: Always
       nodeSelector:
         kubernetes.io/os: linux

go.mod

@@ -3,7 +3,7 @@ module github.com/docker/attest-provider
 go 1.22.5
 
 require (
-	github.com/docker/attest v0.1.10
+	github.com/docker/attest v0.1.11
 	github.com/google/go-containerregistry v0.20.1
 	github.com/in-toto/in-toto-golang v0.9.0
 	github.com/open-policy-agent/frameworks/constraint v0.0.0-20221214024800-b745745c4118

go.sum

@@ -212,8 +212,8 @@ github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/attest v0.1.10 h1:KPp8V7VpTLFpXLC1LBVyaIvhkoXJCFRAzYsXLeJWK6A=
-github.com/docker/attest v0.1.10/go.mod h1:ymA2Qv8YP9qRUXXC8VlaKP5AfhldFkHskM3HyNOMxgw=
+github.com/docker/attest v0.1.11 h1:Nh7RmQXPdPOoM6eP9qvPXtUGPVuOJPCBcbvMIihoQrQ=
+github.com/docker/attest v0.1.11/go.mod h1:B3aMIZ1ONEbUYWROpoOpXPTaUP5Ee6i7MscsXbaNCfw=
 github.com/docker/cli v26.1.3+incompatible h1:bUpXT/N0kDE3VUHI2r5VMsYQgi38kYuoC0oL9yt3lqc=
 github.com/docker/cli v26.1.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=

main.go

@@ -17,7 +17,6 @@ import (
 )
 
 const (
-	handlerTimeout    = 15 * time.Second
 	readHeaderTimeout = 1 * time.Second
 )
 
@@ -29,9 +28,10 @@ const (
 )
 
 var (
-	certDir      string
-	clientCAFile string
-	port         int
+	certDir               string
+	clientCAFile          string
+	port                  int
+	handlerTimeoutSeconds int
 
 	tufRoot       string
 	tufoutputPath string
@@ -62,6 +62,7 @@ func init() {
 	flag.StringVar(&certDir, "cert-dir", "", "path to directory containing TLS certificates")
 	flag.StringVar(&clientCAFile, "client-ca-file", "", "path to client CA certificate")
 	flag.IntVar(&port, "port", defaultPort, "Port for the server to listen on")
+	flag.IntVar(&handlerTimeoutSeconds, "handler-timeout", 25, "timeout for handler in seconds")
 
 	flag.StringVar(&tufRoot, "tuf-root", "prod", "specify embedded tuf root [dev, staging, prod], default [prod]")
 	flag.StringVar(&metadataURL, "tuf-metadata-source", defaultMetadataURL, "source (URL or repo) for TUF metadata")
@@ -79,6 +80,7 @@ func init() {
 
 func main() {
 	mux := http.NewServeMux()
+	handlerTimeout := time.Duration(handlerTimeoutSeconds) * time.Second
 
 	validateHandler, err := handler.NewValidateHandler(&handler.ValidateHandlerOptions{
 		TUFRoot:          tufRoot,
@@ -103,6 +105,9 @@ func main() {
 
 	mux.Handle("POST /validate", http.TimeoutHandler(validateHandler, handlerTimeout, timeoutError))
 	mux.Handle("POST /mutate", http.TimeoutHandler(mutateHandler, handlerTimeout, timeoutError))
+	mux.Handle("GET /ready", http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
 
 	server := &http.Server{
 		Addr:              fmt.Sprintf(":%d", port),
@@ -125,7 +130,7 @@ func main() {
 		clientCAs.AppendCertsFromPEM(caCert)
 
 		config.ClientCAs = clientCAs
-		config.ClientAuth = tls.RequireAndVerifyClientCert
+		config.ClientAuth = tls.VerifyClientCertIfGiven
 		server.TLSConfig = config
 	}