Never approve CSR if --bypass-dns-resolution is specified

[kariya-mitsuru]

After updating to 1.2.0, the following error message appeared and CSRs were not approved.

Denying kubelet-serving CSR. DNS checks failed. Reason:One of the SAN IP addresses, xxx.xxx.xxx.xxx, is not contained in the set of resolved IP addresses, denying the CSR.

In my environment, the node name cannot be resolved by DNS, so I specify --bypass-dns-resolution.

I checked the source, and the IP addresses of the SAN are checked against resolvedIPSet here, however
resolvedIPSet contains only the IP addresses resolved here by DNS.

So, I think the check will always fail if --bypass-dns-resolution is specified.

[sherif-fanous]

Ran into the same issue now

[alan113696]

Same

[clementnuss]

hi!

really sorry for the bug introduced while resolving #250 🤦🏼

I've now made the code simpler, with a proper early exit when bypassDNSResolution is true.

I've also added a testcase covering this issue.

can someone try the following image and report on whether the fix works on their side ?

docker.io/postfinance/kubelet-csr-approver:dns-check-fix
ghcr.io/postfinance/kubelet-csr-approver:dns-check-fix

[kariya-mitsuru]

Thanks for the quick fix!

I checked it with helm chart 1.2.0 by setting image.tag to dns-check-fix, and it is approved without any problem!

[clementnuss]

release v1.2.1 with the fix is out.

sorry for the inconvenience, and hoping everything settles down 🙃