Update pem to 1.0.1

CHANGELOG.md

@@ -8,6 +8,7 @@ UNRELEASED
  * BREAKING: Moved `CustomResource` derive crate overrides into subattribute `#[kube(crates(...))]` - #690
    - Replace `#[kube(kube_core = .., k8s_openapi = .., schema = .., serde = .., serde_json = ..)]` with `#[kube(crates(kube_core = .., k8s_openapi = .., schema = .., serde = .., serde_json = ..))]`
  * Added `openssl-tls` feature to use `openssl` for TLS on all platforms. Note that, even though `native-tls` uses a platform specific TLS, `kube` requires `openssl` on all platforms because `native-tls` only allows PKCS12 input to load certificates and private key at the moment, and creating PKCS12 requires `openssl`. - #700
+ * BREAKING: Changed to fail loading configurations with PEM-encoded certificates containing invalid sections instead of ignoring them. Updated `pem` to 1.0.1.
 
 ### Refining Errors
 

kube-client/Cargo.toml

@@ -49,7 +49,7 @@ http-body = { version = "0.4.2", optional = true }
 either = { version = "1.6.1", optional = true }
 thiserror = "1.0.29"
 futures = { version = "0.3.17", optional = true }
-pem = { version = "0.8.2", optional = true }
+pem = { version = "1.0.1", optional = true }
 openssl = { version = "0.10.36", optional = true }
 tokio-native-tls = { version = "0.3.0", optional = true }
 rustls = { version = "0.19.1", features = ["dangerous_configuration"], optional = true }

kube-client/src/config/file_loader.rs

@@ -106,7 +106,9 @@ impl ConfigLoader {
 
     pub fn ca_bundle(&self) -> Result<Option<Vec<Vec<u8>>>, KubeconfigError> {
         if let Some(bundle) = self.cluster.load_certificate_authority()? {
-            Ok(Some(super::certs(&bundle)))
+            Ok(Some(
+                super::certs(&bundle).map_err(KubeconfigError::ParseCertificates)?,
+            ))
         } else {
             Ok(None)
         }

kube-client/src/config/incluster_config.rs

@@ -38,6 +38,10 @@ pub enum Error {
     /// Failed to parse cluster url
     #[error("failed to parse cluster url: {0}")]
     ParseClusterUrl(#[source] http::uri::InvalidUri),
+
+    /// Failed to parse PEM-encoded certificates
+    #[error("failed to parse PEM-encoded certificates: {0}")]
+    ParseCertificates(#[source] pem::PemError),
 }
 
 /// Returns Kubernetes address from specified environment variables.
@@ -79,7 +83,7 @@ pub fn load_token() -> Result<String, Error> {
 /// Returns certification from specified path in cluster.
 pub fn load_cert() -> Result<Vec<Vec<u8>>, Error> {
     let certs = std::fs::read(&SERVICE_CERTFILE).map_err(Error::ReadCertificateBundle)?;
-    Ok(super::certs(&certs))
+    super::certs(&certs).map_err(Error::ParseCertificates)
 }
 
 /// Returns the default namespace from specified path in cluster.

kube-client/src/config/mod.rs

@@ -92,6 +92,10 @@ pub enum KubeconfigError {
     /// Failed to load client key
     #[error("failed to load client key")]
     LoadClientKey(#[source] LoadDataError),
+
+    /// Failed to parse PEM-encoded certificates
+    #[error("failed to parse PEM-encoded certificates: {0}")]
+    ParseCertificates(#[source] pem::PemError),
 }
 
 /// Errors from loading data from a base64 string or a file
@@ -290,8 +294,8 @@ impl Config {
     }
 }
 
-fn certs(data: &[u8]) -> Vec<Vec<u8>> {
-    pem::parse_many(data)
+fn certs(data: &[u8]) -> Result<Vec<Vec<u8>>, pem::PemError> {
+    Ok(pem::parse_many(data)?
         .into_iter()
         .filter_map(|p| {
             if p.tag == "CERTIFICATE" {
@@ -300,7 +304,7 @@ fn certs(data: &[u8]) -> Vec<Vec<u8>> {
                 None
             }
         })
-        .collect::<Vec<_>>()
+        .collect::<Vec<_>>())
 }
 
 // https://github.com/kube-rs/kube-rs/issues/146#issuecomment-590924397