irsa-manager/internal/selfhosted/webhook/certificate_test.go

package webhook

import (
	"crypto/rsa"
	"crypto/x509"
	"encoding/pem"
	"testing"

	"k8s.io/apimachinery/pkg/types"
)

func TestCreateTlsCredentials(t *testing.T) {
	creds, err := CreateTlsCredential(types.NamespacedName{
		Name:      "pod-identity-webhook",
		Namespace: "kube-system",
	})
	if err != nil {
		t.Fatalf("Failed to create TLS credentials: %v", err)
	}

	certBlock, _ := pem.Decode(creds.certificate)
	var cert *x509.Certificate
	if certBlock == nil {
		t.Fatal("Failed to decode PEM block containing the certificate")
	} else {
		cert, err = x509.ParseCertificate(certBlock.Bytes)
		if err != nil {
			t.Fatalf("Failed to parse certificate: %v", err)
		}
	}
	var key *rsa.PrivateKey
	keyBlock, _ := pem.Decode(creds.privateKey)
	if keyBlock == nil {
		t.Fatal("Failed to decode PEM block containing the private key")
	} else {
		key, err = x509.ParsePKCS1PrivateKey(keyBlock.Bytes)
		if err != nil {
			t.Fatalf("Failed to parse private key: %v", err)
		}

	}

	// Verify public keys are equivalent
	if !publicKeysEqual(cert.PublicKey, &key.PublicKey) {
		t.Fatal("Public key in certificate does not match public key in private key")
	}
}

// Helper function to compare public keys
func publicKeysEqual(pub1, pub2 interface{}) bool {
	rsaPub1, ok1 := pub1.(*rsa.PublicKey)
	rsaPub2, ok2 := pub2.(*rsa.PublicKey)

	if !ok1 || !ok2 {
		return false
	}
	return rsaPub1.N.Cmp(rsaPub2.N) == 0 && rsaPub1.E == rsaPub2.E
}