mirrors/external-dns
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/external-dns.git synced 2025-11-29 08:51:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(aes-encryption): support plain txt and url safe base64 strings

Browse Source 
Signed-off-by: ivan katliarchuk <ivan.katliarchuk@gmail.com>
This commit is contained in:
ivan katliarchuk 2024-12-28 15:38:37 +00:00
parent e964a66153
commit ad226caeb9
No known key found for this signature in database
GPG Key ID: 601CDBBBB76E47BE
1 changed files with 20 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
docs/registry/txt.md
View File

@ -26,7 +26,7 @@ wildcard domains will have invalid domain syntax and be rejected by most provide
## Encryption ## Encryption
Registry TXT records may contain information, such as the internal ingress name or namespace, considered sensitive, , which attackers could exploit to gather information about your infrastructure. Registry TXT records may contain information, such as the internal ingress name or namespace, considered sensitive, , which attackers could exploit to gather information about your infrastructure.
By encrypting TXT records, you can protect this information from unauthorized access. By encrypting TXT records, you can protect this information from unauthorized access.
Encryption is enabled by using the `--txt-encrypt-enabled` flag. The 32-byte AES-256-GCM encryption Encryption is enabled by using the `--txt-encrypt-enabled` flag. The 32-byte AES-256-GCM encryption
@ -78,14 +78,25 @@ import (
) )
func main() { func main() {
key := []byte("testtesttesttesttesttesttesttest") keys := []string{
encrypted, _ := endpoint.EncryptText( "ZPitL0NGVQBZbTD6DwXJzD8RiStSazzYXQsdUowLURY=", // safe base64 url encoded 44 bytes and 32 when decoded
"heritage=external-dns,external-dns/owner=example,external-dns/resource=ingress/default/example", "01234567890123456789012345678901", // plain txt 32 bytes
key, "passphrasewhichneedstobe32bytes!", // plain txt 32 bytes
nil, }
)
decrypted, _, _ := endpoint.DecryptText(encrypted, key) for _, k := range keys {
fmt.Println(decrypted) key := []byte(k)
encrypted, _ := endpoint.EncryptText(
"heritage=external-dns,external-dns/owner=example,external-dns/resource=ingress/default/example",
key,
nil,
)
decrypted, _, err := endpoint.DecryptText(encrypted, key)
if err != nil {
fmt.Println("Error decrypting:", err, "for key:", k)
}
fmt.Println(decrypted)
}
} }
``` ```