apiVersion: release-notes/v2
kind: bug-fix
area: security
issue:
- 29856
releaseNotes:
- |
  **Fixed** an issue causing a Secret named `<secret>-cacert` to have lower precedence than a Secret named `<secret>` for Gateway Mutual TLS.

    /**
     * A comparator implementation based on the names returned by the given namer.
     *
     * @param <T> The type of object that the namer can name
     */
    class Comparator<T> implements java.util.Comparator<T> {

        private final Namer<? super T> namer;

        public Comparator(Namer<? super T> namer) {
            this.namer = namer;
        }

        @Override
        public int compare(T o1, T o2) {

	// does not support names.
	ObjectName(obj runtime.Object) (namespace, name string, err error)
}

type ContextBasedNaming struct {
	Namer         runtime.Namer
	ClusterScoped bool
}

// ContextBasedNaming implements ScopeNamer
var _ ScopeNamer = ContextBasedNaming{}

func (n ContextBasedNaming) Namespace(req *http.Request) (namespace string, err error) {

	f(a, A, b /* ERROR "cannot use b (variable of type chan<- int) as namedA value in argument to f" */)
	f(b /* ERROR "cannot use b (variable of type chan<- int) as namedA value in argument to f" */, A, a)
	f(b /* ERROR "cannot use b (variable of type chan<- int) as namedA value in argument to f" */, a, A)
	f(A, a, b /* ERROR "cannot use b (variable of type chan<- int) as namedA value in argument to f" */)

type FileRenewer struct {
	caCert *x509.Certificate
	caKey  crypto.Signer
}

// NewFileRenewer returns a new certificate renewer that uses given CA cert and key for generating new certificates
func NewFileRenewer(caCert *x509.Certificate, caKey crypto.Signer) *FileRenewer {
	return &FileRenewer{
		caCert: caCert,
		caKey:  caKey,
	}
}

		cert.UsageServerAuth,
	}
	if signerName == "" {
		return nil, nil, nil, fmt.Errorf("signerName is required for Kubernetes CA")
	}
	certChain, caCert, err := SignCSRK8s(client, csrPEM, signerName, usages, dnsName, caFilePath, approveCsr, true, requestedLifetime)

	return certChain, keyPEM, caCert, err
}

// SignCSRK8s generates a certificate from CSR using the K8s CA
// 1. Submit a CSR
// 2. Approve a CSR

openssl x509 -req -in caCertInter.csr -CA caCert.pem -CAkey caKey.pem -CAcreateserial -out caCertInter.pem -days 100000 -extensions v3_ca -extfile intermediate_ca.conf

# Create an intermediate certificate authority with sha1 signature
openssl req -new -nodes -key caKeyInter.pem -days 100000 -out caCertInterSHA1.csr -subj "/CN=${CN_BASE}_intermediate_ca"

			serverCert: serverCert, serverKey: serverKey, serverCA: caCert,
			expectedRegisteredStatusCode: "200",
			expectEvalutionResult:        "success",
			expectDurationResult:         "success",
			expectFailOpenResult:         "",
		},

		{
			name:       "timed out request",
			clientCert: clientCert, clientKey: clientKey, clientCA: caCert,

			clientCert: clientCert, clientKey: clientKey, clientCA: caCert,
			serverCert: serverCert, serverKey: serverKey, serverCA: caCert,
			expectedRegisteredStatusCode: "200",
		},

		{
			name:       "an internal error returned from the webhook",
			clientCert: clientCert, clientKey: clientKey, clientCA: caCert,
			serverCert: serverCert, serverKey: serverKey, serverCA: caCert,
			authnFakeServiceStatusCode:   500,

  private val subjectToCaCerts: Map<X500Principal, Set<X509Certificate>>

  init {
    val map = mutableMapOf<X500Principal, MutableSet<X509Certificate>>()
    for (caCert in caCerts) {
      map.getOrPut(caCert.subjectX500Principal) { mutableSetOf() }.add(caCert)
    }
    this.subjectToCaCerts = map
  }

  override fun findByIssuerAndSignature(cert: X509Certificate): X509Certificate? {
    val issuer = cert.issuerX500Principal