[mtls] use fullchain for leaf and chain when individual files unavailable

Fixes cert loading failures in k8s with certificates from cert-manager

diff --git a/mtls/provider_file.go b/mtls/provider_file.go
index 284b784812db1c2f7ae46e19a1e162b6d59cbaba..3b2952d3d9c6ca9431bd4826a55332ebb616cb9c 100644 (file)
--- a/mtls/provider_file.go
+++ b/mtls/provider_file.go
@@ -118,11 +118,37 @@ func newFileBackedCertificateFromBaseDir(mtlsRootPath string, serviceIdentity st
        logger.V(2).Debugf("trying to load identity %q from root path %q", serviceIdentity, certDirectory)
 
        leafPath := path.Join(certDirectory, "cert.pem")
+       fullchainPath := path.Join(certDirectory, "fullchain.pem")
        chainPath := path.Join(certDirectory, "chain.pem")
        keyPath := path.Join(certDirectory, "privkey.pem")
        rootPath := path.Join(mtlsRootPath, "rootca.pem")
 
-       for _, file := range []string{leafPath, chainPath, keyPath, rootPath} {
+       if leafErr := fsutil.FileExistsAndIsReadable(leafPath); leafErr != nil {
+               err := fsutil.FileExistsAndIsReadable(fullchainPath)
+               if err == nil {
+                       logger.V(2).Debugf("Leaf file %s not accessible, using fullchain %s", leafPath, fullchainPath)
+                       leafPath = fullchainPath
+               } else {
+                       logger.V(2).Errorf(
+                               "cannot load identity %q from %s: cannot read from either possible leaf "+
+                                       "certificate path:\n  %s: %v\n  %s: %v",
+                               serviceIdentity, certDirectory, leafPath, leafErr, fullchainPath, err)
+                       return nil, err
+               }
+       }
+       if chainErr := fsutil.FileExistsAndIsReadable(chainPath); chainErr != nil {
+               err := fsutil.FileExistsAndIsReadable(fullchainPath)
+               if err == nil {
+                       logger.V(2).Debugf("Chain file %s not accessible, using fullchain %s", chainPath, fullchainPath)
+                       chainPath = fullchainPath
+               } else {
+                       logger.V(2).Errorf(
+                               "cannot load identity %q from %s: cannot read from either possible "+
+                                       "intermediate chain path:\n  %s: %v\n  %s: %v",
+                               serviceIdentity, certDirectory, chainPath, chainErr, fullchainPath, err)
+               }
+       }
+       for _, file := range []string{keyPath, rootPath} {
                if err := fsutil.FileExistsAndIsReadable(file); err != nil {
                        logger.V(2).Errorf("cannot load identity %q from %s: error reading file %q: %v", serviceIdentity, certDirectory, file, err)
                        return nil, err