sia: support san email addresses in service certificate CSRs - #3452
Open
havetisyan wants to merge 4 commits into
Open
sia: support san email addresses in service certificate CSRs#3452havetisyan wants to merge 4 commits into
havetisyan wants to merge 4 commits into
Conversation
GenerateSvcCertCSR now accepts an EmailAddresses option and includes those entries as rfc822 SANs in the generated CSR. Empty and duplicate addresses are skipped; when no addresses are requested the CSR is unchanged. The setting is exposed to the callers through a new san_email_addresses sia_config option (comma separated, also configurable with the ATHENZ_SIA_SAN_EMAIL_ADDRESSES environment variable) and is passed to the CSR request in the register and refresh paths for both the generic agent and the azure vm provider. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for including RFC822 (email) Subject Alternative Names in service-certificate CSRs generated by the Go SIA tooling, and exposes the setting via config/env so callers can request these SANs.
Changes:
- Extend service CSR generation (
GenerateSvcCertCSR) to accept a list of email SANs (skipping empty/duplicates) and include them in the CSR. - Expose
san_email_addresses(andATHENZ_SIA_SAN_EMAIL_ADDRESSES) through SIA config parsing (generic + AWS) and plumb it into the agent CSR request paths. - Add/extend unit tests for CSR generation and for agent/azure-vm register+refresh flows to verify email SANs propagate into issued certs.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| provider/azure/sia-vm/options/options.go | Adds EmailAddresses field to azure-vm provider Options struct. |
| provider/azure/sia-vm/authn.go | Passes EmailAddresses into CSR request options for register/refresh. |
| provider/azure/sia-vm/authn_test.go | Validates issued cert contains requested email SANs in register/refresh paths. |
| libs/go/sia/util/util.go | Adds EmailAddresses to CSR request options; includes them in generated CSR; adds AppendEmail helper. |
| libs/go/sia/util/util_test.go | Adds CSR-level and helper-level tests for email SAN behavior. |
| libs/go/sia/options/options.go | Reads ATHENZ_SIA_SAN_EMAIL_ADDRESSES and propagates parsed email list into runtime options. |
| libs/go/sia/options/options_test.go | Tests config/env parsing and propagation of san_email_addresses. |
| libs/go/sia/options/data/sia_config | Updates sample config to include san_email_addresses. |
| libs/go/sia/config/config.go | Adds san_email_addresses to Config and EmailAddresses to runtime Options. |
| libs/go/sia/aws/options/options.go | Adds env/config plumbing for email SANs in AWS-specific options parsing. |
| libs/go/sia/aws/options/options_test.go | Tests AWS config/env parsing and propagation of san_email_addresses. |
| libs/go/sia/aws/options/data/sia_config | Updates AWS sample config to include san_email_addresses. |
| libs/go/sia/agent/agent.go | Passes EmailAddresses into CSR request options for register/refresh. |
| libs/go/sia/agent/agent_test.go | Validates issued cert contains requested email SANs in register/refresh paths. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Henry Avetisyan <havetisy@yahoo.com>
InitGenericProfileConfig now accepts the config object built from the config file / environment settings and only overrides the account, domain and service values with the ones retrieved from the metadata service. Previously the config object was discarded and replaced with a brand new one, so any settings from the config file (user, expiry time, san email addresses, etc.) were lost whenever the domain or service could not be determined from the file or environment. When no config object is given (access profile only lookups) the behavior is unchanged, and a metadata failure returns the given object as is. The gce, gke and run providers pass their config object to the call in the register/refresh config paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…nz into sia-svc-cert-email-addresses
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GenerateSvcCertCSR now accepts an EmailAddresses option and includes those entries as rfc822 SANs in the generated CSR. Empty and duplicate addresses are skipped; when no addresses are requested the CSR is unchanged.
The setting is exposed to the callers through a new san_email_addresses sia_config option (comma separated, also configurable with the ATHENZ_SIA_SAN_EMAIL_ADDRESSES environment variable) and is passed to the CSR request in the register and refresh paths for both the generic agent and the azure vm provider.
Description
Contribution Checklist:
Attach Screenshots (Optional)