Change:
unit tests since switching to go1.18 No response No response Weirdly, the test is passing in CI () and failing locally /sig api-machinery auth testing
seems related Jordan, are you using mac ?
yes, though the description in that issue seems to be not just test-only changes to the errors received from invalid certificates (which is what I saw), but actual certificates that previously validated
marking as release blocker until it is determined that go1.18 is not rejecting valid certificates
this needs an assignee and a reproducer we can file as an upstream issue for golang to ask why previously valid certificates now fail validation
marking critical until root-caused and determined whether this is prod-impacting, since (in my opinion) this should block rc0
On linux it works fine: on MacOS, it fails:
Looks like the change in golang that broke the scenario was:
if the only impact is a different failure message on an already-invalid certificate, I don't care and we can update the test to accept either message is what makes me wonder what previously-accepted certificates are now failing
reproducer test case here. this one has no issues under go 1.17 and fails with go 1.18 (stripped down version of ) : :
the new error message is minted here: i suspect it is related to: So essentially this seems to be something that may hit in our case. right?
yeah, if this is scoped to just darwin clients, and only ones using system roots, that greatly narrows the impact
Asked on gophers slack -
xref:
opened to tolerate the additional errors discussion in indicates the tightened validation is very bounded (darwin-only, so clients-only, system roots only), and certificates issued by public CAs would be expected to pass this validation dropping release-blocking label and priority to important-soon, but should still make it into 1.24 to make unit tests pass locally

Discussion:
"net/http/httptest" "net/url" "reflect" <del> "strings" </del> <ins> "regexp" </ins> "testing" "k8s.io/apimachinery/pkg/util/diff"

}, "secure, no roots": { TLSConfig:   &tls.Config{InsecureSkipVerify: false}, <del> ExpectError: "unknown authority", </del> <ins> ExpectError: "unknown authority|not trusted", </ins> }, "secure with roots": { TLSConfig: &tls.Config{InsecureSkipVerify: false, RootCAs: roots},

"secure, no roots, custom dial": { TLSConfig:   &tls.Config{InsecureSkipVerify: false}, Dial:        d.DialContext, <del> ExpectError: "unknown authority", </del> <ins> ExpectError: "unknown authority|not trusted", </ins> }, "secure with roots, custom dial": { TLSConfig: &tls.Config{InsecureSkipVerify: false, RootCAs: roots},

if tc.ExpectError == "" { t.Errorf("%s: expected no error, got %q", k, err.Error()) } <del> if !strings.Contains(err.Error(), tc.ExpectError) { </del> <ins> if tc.ExpectError != "" && !regexp.MustCompile(tc.ExpectError).MatchString(err.Error()) { </ins> t.Errorf("%s: expected error containing %q, got %q", k, tc.ExpectError, err.Error()) } return

errBadCertificate    = "Get .*: remote error: tls: bad certificate" errNoConfiguration   = "invalid configuration: no configuration has been provided" errMissingCertPath   = "invalid configuration: unable to read %s %s for %s due to open %s: .*" <del> errSignedByUnknownCA = "Get .*: x509: certificate signed by unknown authority" </del> <ins> errSignedByUnknownCA = "Get .*: x509: .*(unknown authority|not standards compliant|not trusted)" </ins> ) var (