fix: use SecretBytes type for cert values to prevent accidental printing (#147)

4141done · web-flow · commit 2ee0441d6561 · 2023-12-15T14:58:19.000-08:00
We save the values of the provided certs that we retrieve from Kubernetes secrets in the `Certificates` attribute on the `Certificates` struct. This is sensitive information that we want to make sure stays out of the logs and any stack traces. A common approach to this is to create a type definition for sensitive values that implements `Stringer` and `JSON` interfaces and cast the sensitive data to that value. Fixes issues #145
diff --git a/.tool-versions b/.tool-versions
@@ -0,0 +1 @@
+golang 1.19.13
diff --git a/cmd/tls-config-factory-test-harness/main.go b/cmd/tls-config-factory-test-harness/main.go
@@ -6,6 +6,7 @@ import (
 	"github.com/nginxinc/kubernetes-nginx-ingress/internal/authentication"
 	"github.com/nginxinc/kubernetes-nginx-ingress/internal/certification"
 	"github.com/nginxinc/kubernetes-nginx-ingress/internal/configuration"
+	"github.com/nginxinc/kubernetes-nginx-ingress/internal/core"
 	"github.com/sirupsen/logrus"
 	"os"
 )
@@ -82,7 +83,7 @@ func buildConfigMap() map[string]TlsConfiguration {
 }
 
 func ssTlsConfig() configuration.Settings {
-	certificates := make(map[string]map[string][]byte)
+	certificates := make(map[string]map[string]core.SecretBytes)
 	certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())
 	certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())
 
@@ -95,7 +96,7 @@ func ssTlsConfig() configuration.Settings {
 }
 
 func ssMtlsConfig() configuration.Settings {
-	certificates := make(map[string]map[string][]byte)
+	certificates := make(map[string]map[string]core.SecretBytes)
 	certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())
 	certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())
 
@@ -114,7 +115,7 @@ func caTlsConfig() configuration.Settings {
 }
 
 func caMtlsConfig() configuration.Settings {
-	certificates := make(map[string]map[string][]byte)
+	certificates := make(map[string]map[string]core.SecretBytes)
 	certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())
 
 	return configuration.Settings{
@@ -215,15 +216,15 @@ z/3KkMx4uqJXZyvQrmkolSg=
 `
 }
 
-func buildClientCertificateEntry(keyPEM, certificatePEM string) map[string][]byte {
-	return map[string][]byte{
-		certification.CertificateKey:    []byte(certificatePEM),
-		certification.CertificateKeyKey: []byte(keyPEM),
+func buildClientCertificateEntry(keyPEM, certificatePEM string) map[string]core.SecretBytes {
+	return map[string]core.SecretBytes{
+		certification.CertificateKey:    core.SecretBytes([]byte(certificatePEM)),
+		certification.CertificateKeyKey: core.SecretBytes([]byte(keyPEM)),
 	}
 }
 
-func buildCaCertificateEntry(certificatePEM string) map[string][]byte {
-	return map[string][]byte{
-		certification.CertificateKey: []byte(certificatePEM),
+func buildCaCertificateEntry(certificatePEM string) map[string]core.SecretBytes {
+	return map[string]core.SecretBytes{
+		certification.CertificateKey: core.SecretBytes([]byte(certificatePEM)),
 	}
 }
diff --git a/internal/authentication/factory_test.go b/internal/authentication/factory_test.go
@@ -6,9 +6,11 @@
 package authentication
 
 import (
+	"testing"
+
 	"github.com/nginxinc/kubernetes-nginx-ingress/internal/certification"
 	"github.com/nginxinc/kubernetes-nginx-ingress/internal/configuration"
-	"testing"
+	"github.com/nginxinc/kubernetes-nginx-ingress/internal/core"
 )
 
 const (
@@ -34,7 +36,7 @@ func TestTlsFactory_UnspecifiedModeDefaultsToNoTls(t *testing.T) {
 }
 
 func TestTlsFactory_SelfSignedTlsMode(t *testing.T) {
-	certificates := make(map[string]map[string][]byte)
+	certificates := make(map[string]map[string]core.SecretBytes)
 	certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())
 
 	settings := configuration.Settings{
@@ -69,7 +71,7 @@ func TestTlsFactory_SelfSignedTlsMode(t *testing.T) {
 }
 
 func TestTlsFactory_SelfSignedTlsModeCertPoolError(t *testing.T) {
-	certificates := make(map[string]map[string][]byte)
+	certificates := make(map[string]map[string]core.SecretBytes)
 	certificates[CaCertificateSecretKey] = buildCaCertificateEntry(invalidCertificatePEM())
 
 	settings := configuration.Settings{
@@ -90,7 +92,7 @@ func TestTlsFactory_SelfSignedTlsModeCertPoolError(t *testing.T) {
 }
 
 func TestTlsFactory_SelfSignedTlsModeCertPoolCertificateParseError(t *testing.T) {
-	certificates := make(map[string]map[string][]byte)
+	certificates := make(map[string]map[string]core.SecretBytes)
 	certificates[CaCertificateSecretKey] = buildCaCertificateEntry(invalidCertificateDataPEM())
 
 	settings := configuration.Settings{
@@ -113,7 +115,7 @@ func TestTlsFactory_SelfSignedTlsModeCertPoolCertificateParseError(t *testing.T)
 }
 
 func TestTlsFactory_SelfSignedMtlsMode(t *testing.T) {
-	certificates := make(map[string]map[string][]byte)
+	certificates := make(map[string]map[string]core.SecretBytes)
 	certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())
 	certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())
 
@@ -149,7 +151,7 @@ func TestTlsFactory_SelfSignedMtlsMode(t *testing.T) {
 }
 
 func TestTlsFactory_SelfSignedMtlsModeCertPoolError(t *testing.T) {
-	certificates := make(map[string]map[string][]byte)
+	certificates := make(map[string]map[string]core.SecretBytes)
 	certificates[CaCertificateSecretKey] = buildCaCertificateEntry(invalidCertificatePEM())
 	certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())
 
@@ -171,7 +173,7 @@ func TestTlsFactory_SelfSignedMtlsModeCertPoolError(t *testing.T) {
 }
 
 func TestTlsFactory_SelfSignedMtlsModeClientCertificateError(t *testing.T) {
-	certificates := make(map[string]map[string][]byte)
+	certificates := make(map[string]map[string]core.SecretBytes)
 	certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())
 	certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), invalidCertificatePEM())
 
@@ -222,7 +224,7 @@ func TestTlsFactory_CaTlsMode(t *testing.T) {
 }
 
 func TestTlsFactory_CaMtlsMode(t *testing.T) {
-	certificates := make(map[string]map[string][]byte)
+	certificates := make(map[string]map[string]core.SecretBytes)
 	certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())
 
 	settings := configuration.Settings{
@@ -257,7 +259,7 @@ func TestTlsFactory_CaMtlsMode(t *testing.T) {
 }
 
 func TestTlsFactory_CaMtlsModeClientCertificateError(t *testing.T) {
-	certificates := make(map[string]map[string][]byte)
+	certificates := make(map[string]map[string]core.SecretBytes)
 	certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())
 	certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), invalidCertificatePEM())
 
@@ -411,15 +413,15 @@ z/3KkMx4uqJXZyvQrmkolSg=
 `
 }
 
-func buildClientCertificateEntry(keyPEM, certificatePEM string) map[string][]byte {
-	return map[string][]byte{
-		certification.CertificateKey:    []byte(certificatePEM),
-		certification.CertificateKeyKey: []byte(keyPEM),
+func buildClientCertificateEntry(keyPEM, certificatePEM string) map[string]core.SecretBytes {
+	return map[string]core.SecretBytes{
+		certification.CertificateKey:    core.SecretBytes([]byte(certificatePEM)),
+		certification.CertificateKeyKey: core.SecretBytes([]byte(keyPEM)),
 	}
 }
 
-func buildCaCertificateEntry(certificatePEM string) map[string][]byte {
-	return map[string][]byte{
-		certification.CertificateKey: []byte(certificatePEM),
+func buildCaCertificateEntry(certificatePEM string) map[string]core.SecretBytes {
+	return map[string]core.SecretBytes{
+		certification.CertificateKey: core.SecretBytes([]byte(certificatePEM)),
 	}
 }
diff --git a/internal/certification/certificates.go b/internal/certification/certificates.go
@@ -11,11 +11,14 @@ package certification
 import (
 	"context"
 	"fmt"
+
 	"github.com/sirupsen/logrus"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/client-go/informers"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/cache"
+
+	"github.com/nginxinc/kubernetes-nginx-ingress/internal/core"
 )
 
 const (
@@ -30,7 +33,7 @@ const (
 )
 
 type Certificates struct {
-	Certificates map[string]map[string][]byte
+	Certificates map[string]map[string]core.SecretBytes
 
 	// Context is the context used to control the application.
 	Context context.Context
@@ -61,14 +64,14 @@ func NewCertificates(ctx context.Context, k8sClient kubernetes.Interface) *Certi
 }
 
 // GetCACertificate returns the Certificate Authority certificate.
-func (c *Certificates) GetCACertificate() []byte {
+func (c *Certificates) GetCACertificate() core.SecretBytes {
 	bytes := c.Certificates[c.CaCertificateSecretKey][CertificateKey]
 
 	return bytes
 }
 
 // GetClientCertificate returns the Client certificate and key.
-func (c *Certificates) GetClientCertificate() ([]byte, []byte) {
+func (c *Certificates) GetClientCertificate() (core.SecretBytes, core.SecretBytes) {
 	keyBytes := c.Certificates[c.ClientCertificateSecretKey][CertificateKeyKey]
 	certificateBytes := c.Certificates[c.ClientCertificateSecretKey][CertificateKey]
 
@@ -81,7 +84,7 @@ func (c *Certificates) Initialize() error {
 
 	var err error
 
-	c.Certificates = make(map[string]map[string][]byte)
+	c.Certificates = make(map[string]map[string]core.SecretBytes)
 
 	informer, err := c.buildInformer()
 	if err != nil {
@@ -151,10 +154,14 @@ func (c *Certificates) handleAddEvent(obj interface{}) {
 		return
 	}
 
-	c.Certificates[secret.Name] = map[string][]byte{}
+	c.Certificates[secret.Name] = map[string]core.SecretBytes{}
 
+	// Input from the secret comes in the form
+	//   tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVCVEN...
+	//   tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0l...
+	// Where the keys are `tls.crt` and `tls.key` and the values are []byte
 	for k, v := range secret.Data {
-		c.Certificates[secret.Name][k] = v
+		c.Certificates[secret.Name][k] = core.SecretBytes(v)
 	}
 
 	logrus.Debugf("Certificates::handleAddEvent: certificates (%d)", len(c.Certificates))
diff --git a/internal/core/secret_bytes.go b/internal/core/secret_bytes.go
@@ -0,0 +1,21 @@
+package core
+
+import (
+	"encoding/json"
+)
+
+// Wraps byte slices which potentially could contain
+// sensitive data that should not be output to the logs.
+// This will output [REDACTED] if attempts are made
+// to print this type in logs, serialize to JSON, or
+// otherwise convert it to a string.
+// Usage: core.SecretBytes(myByteSlice)
+type SecretBytes []byte
+
+func (sb SecretBytes) String() string {
+	return "[REDACTED]"
+}
+
+func (sb SecretBytes) MarshalJSON() ([]byte, error) {
+	return json.Marshal("[REDACTED]")
+}
diff --git a/internal/core/secret_bytes_test.go b/internal/core/secret_bytes_test.go
@@ -0,0 +1,31 @@
+/*
+ * Copyright 2023 F5 Inc. All rights reserved.
+ * Use of this source code is governed by the Apache License that can be found in the LICENSE file.
+ */
+
+package core
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+)
+
+func TestSecretBytesToString(t *testing.T) {
+	sensitive := SecretBytes([]byte("If you can see this we have a problem"))
+
+	expected := "foo [REDACTED] bar"
+	result := fmt.Sprintf("foo %v bar", sensitive)
+	if result != expected {
+		t.Errorf("Expected %s, got %s", expected, result)
+	}
+}
+
+func TestSecretBytesToJSON(t *testing.T) {
+	sensitive, _ := json.Marshal(SecretBytes([]byte("If you can see this we have a problem")))
+	expected := `foo "[REDACTED]" bar`
+	result := fmt.Sprintf("foo %v bar", string(sensitive))
+	if result != expected {
+		t.Errorf("Expected %s, got %s", expected, result)
+	}
+}

Original file line number	Diff line number	Diff line change
`@@ -6,6 +6,7 @@ import (`
`6`	`6`	`"github.com/nginxinc/kubernetes-nginx-ingress/internal/authentication"`
`7`	`7`	`"github.com/nginxinc/kubernetes-nginx-ingress/internal/certification"`
`8`	`8`	`"github.com/nginxinc/kubernetes-nginx-ingress/internal/configuration"`
	`9`	`+ "github.com/nginxinc/kubernetes-nginx-ingress/internal/core"`
`9`	`10`	`"github.com/sirupsen/logrus"`
`10`	`11`	`"os"`
`11`	`12`	`)`
`@@ -82,7 +83,7 @@ func buildConfigMap() map[string]TlsConfiguration {`
`82`	`83`	`}`
`83`	`84`
`84`	`85`	`func ssTlsConfig() configuration.Settings {`
`85`		`- certificates := make(map[string]map[string][]byte)`
	`86`	`+ certificates := make(map[string]map[string]core.SecretBytes)`
`86`	`87`	`certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())`
`87`	`88`	`certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())`
`88`	`89`
`@@ -95,7 +96,7 @@ func ssTlsConfig() configuration.Settings {`
`95`	`96`	`}`
`96`	`97`
`97`	`98`	`func ssMtlsConfig() configuration.Settings {`
`98`		`- certificates := make(map[string]map[string][]byte)`
	`99`	`+ certificates := make(map[string]map[string]core.SecretBytes)`
`99`	`100`	`certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())`
`100`	`101`	`certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())`
`101`	`102`
`@@ -114,7 +115,7 @@ func caTlsConfig() configuration.Settings {`
`114`	`115`	`}`
`115`	`116`
`116`	`117`	`func caMtlsConfig() configuration.Settings {`
`117`		`- certificates := make(map[string]map[string][]byte)`
	`118`	`+ certificates := make(map[string]map[string]core.SecretBytes)`
`118`	`119`	`certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())`
`119`	`120`
`120`	`121`	`return configuration.Settings{`
`@@ -215,15 +216,15 @@ z/3KkMx4uqJXZyvQrmkolSg=`
`215`	`216`	`
`216`	`217`	`}`
`217`	`218`
`218`		`-func buildClientCertificateEntry(keyPEM, certificatePEM string) map[string][]byte {`
`219`		`- return map[string][]byte{`
`220`		`- certification.CertificateKey: []byte(certificatePEM),`
`221`		`- certification.CertificateKeyKey: []byte(keyPEM),`
	`219`	`+func buildClientCertificateEntry(keyPEM, certificatePEM string) map[string]core.SecretBytes {`
	`220`	`+ return map[string]core.SecretBytes{`
	`221`	`+ certification.CertificateKey: core.SecretBytes([]byte(certificatePEM)),`
	`222`	`+ certification.CertificateKeyKey: core.SecretBytes([]byte(keyPEM)),`
`222`	`223`	`}`
`223`	`224`	`}`
`224`	`225`
`225`		`-func buildCaCertificateEntry(certificatePEM string) map[string][]byte {`
`226`		`- return map[string][]byte{`
`227`		`- certification.CertificateKey: []byte(certificatePEM),`
	`226`	`+func buildCaCertificateEntry(certificatePEM string) map[string]core.SecretBytes {`
	`227`	`+ return map[string]core.SecretBytes{`
	`228`	`+ certification.CertificateKey: core.SecretBytes([]byte(certificatePEM)),`
`228`	`229`	`}`
`229`	`230`	`}`
Original file line number	Diff line number	Diff line change
`@@ -6,9 +6,11 @@`
`6`	`6`	`package authentication`
`7`	`7`
`8`	`8`	`import (`
	`9`	`+ "testing"`
	`10`	`+`
`9`	`11`	`"github.com/nginxinc/kubernetes-nginx-ingress/internal/certification"`
`10`	`12`	`"github.com/nginxinc/kubernetes-nginx-ingress/internal/configuration"`
`11`		`- "testing"`
	`13`	`+ "github.com/nginxinc/kubernetes-nginx-ingress/internal/core"`
`12`	`14`	`)`
`13`	`15`
`14`	`16`	`const (`
`@@ -34,7 +36,7 @@ func TestTlsFactory_UnspecifiedModeDefaultsToNoTls(t *testing.T) {`
`34`	`36`	`}`
`35`	`37`
`36`	`38`	`func TestTlsFactory_SelfSignedTlsMode(t *testing.T) {`
`37`		`- certificates := make(map[string]map[string][]byte)`
	`39`	`+ certificates := make(map[string]map[string]core.SecretBytes)`
`38`	`40`	`certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())`
`39`	`41`
`40`	`42`	`settings := configuration.Settings{`
`@@ -69,7 +71,7 @@ func TestTlsFactory_SelfSignedTlsMode(t *testing.T) {`
`69`	`71`	`}`
`70`	`72`
`71`	`73`	`func TestTlsFactory_SelfSignedTlsModeCertPoolError(t *testing.T) {`
`72`		`- certificates := make(map[string]map[string][]byte)`
	`74`	`+ certificates := make(map[string]map[string]core.SecretBytes)`
`73`	`75`	`certificates[CaCertificateSecretKey] = buildCaCertificateEntry(invalidCertificatePEM())`
`74`	`76`
`75`	`77`	`settings := configuration.Settings{`
`@@ -90,7 +92,7 @@ func TestTlsFactory_SelfSignedTlsModeCertPoolError(t *testing.T) {`
`90`	`92`	`}`
`91`	`93`
`92`	`94`	`func TestTlsFactory_SelfSignedTlsModeCertPoolCertificateParseError(t *testing.T) {`
`93`		`- certificates := make(map[string]map[string][]byte)`
	`95`	`+ certificates := make(map[string]map[string]core.SecretBytes)`
`94`	`96`	`certificates[CaCertificateSecretKey] = buildCaCertificateEntry(invalidCertificateDataPEM())`
`95`	`97`
`96`	`98`	`settings := configuration.Settings{`
`@@ -113,7 +115,7 @@ func TestTlsFactory_SelfSignedTlsModeCertPoolCertificateParseError(t *testing.T)`
`113`	`115`	`}`
`114`	`116`
`115`	`117`	`func TestTlsFactory_SelfSignedMtlsMode(t *testing.T) {`
`116`		`- certificates := make(map[string]map[string][]byte)`
	`118`	`+ certificates := make(map[string]map[string]core.SecretBytes)`
`117`	`119`	`certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())`
`118`	`120`	`certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())`
`119`	`121`
`@@ -149,7 +151,7 @@ func TestTlsFactory_SelfSignedMtlsMode(t *testing.T) {`
`149`	`151`	`}`
`150`	`152`
`151`	`153`	`func TestTlsFactory_SelfSignedMtlsModeCertPoolError(t *testing.T) {`
`152`		`- certificates := make(map[string]map[string][]byte)`
	`154`	`+ certificates := make(map[string]map[string]core.SecretBytes)`
`153`	`155`	`certificates[CaCertificateSecretKey] = buildCaCertificateEntry(invalidCertificatePEM())`
`154`	`156`	`certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())`
`155`	`157`
`@@ -171,7 +173,7 @@ func TestTlsFactory_SelfSignedMtlsModeCertPoolError(t *testing.T) {`
`171`	`173`	`}`
`172`	`174`
`173`	`175`	`func TestTlsFactory_SelfSignedMtlsModeClientCertificateError(t *testing.T) {`
`174`		`- certificates := make(map[string]map[string][]byte)`
	`176`	`+ certificates := make(map[string]map[string]core.SecretBytes)`
`175`	`177`	`certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())`
`176`	`178`	`certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), invalidCertificatePEM())`
`177`	`179`
`@@ -222,7 +224,7 @@ func TestTlsFactory_CaTlsMode(t *testing.T) {`
`222`	`224`	`}`
`223`	`225`
`224`	`226`	`func TestTlsFactory_CaMtlsMode(t *testing.T) {`
`225`		`- certificates := make(map[string]map[string][]byte)`
	`227`	`+ certificates := make(map[string]map[string]core.SecretBytes)`
`226`	`228`	`certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), clientCertificatePEM())`
`227`	`229`
`228`	`230`	`settings := configuration.Settings{`
`@@ -257,7 +259,7 @@ func TestTlsFactory_CaMtlsMode(t *testing.T) {`
`257`	`259`	`}`
`258`	`260`
`259`	`261`	`func TestTlsFactory_CaMtlsModeClientCertificateError(t *testing.T) {`
`260`		`- certificates := make(map[string]map[string][]byte)`
	`262`	`+ certificates := make(map[string]map[string]core.SecretBytes)`
`261`	`263`	`certificates[CaCertificateSecretKey] = buildCaCertificateEntry(caCertificatePEM())`
`262`	`264`	`certificates[ClientCertificateSecretKey] = buildClientCertificateEntry(clientKeyPEM(), invalidCertificatePEM())`
`263`	`265`
`@@ -411,15 +413,15 @@ z/3KkMx4uqJXZyvQrmkolSg=`
`411`	`413`	`
`412`	`414`	`}`
`413`	`415`
`414`		`-func buildClientCertificateEntry(keyPEM, certificatePEM string) map[string][]byte {`
`415`		`- return map[string][]byte{`
`416`		`- certification.CertificateKey: []byte(certificatePEM),`
`417`		`- certification.CertificateKeyKey: []byte(keyPEM),`
	`416`	`+func buildClientCertificateEntry(keyPEM, certificatePEM string) map[string]core.SecretBytes {`
	`417`	`+ return map[string]core.SecretBytes{`
	`418`	`+ certification.CertificateKey: core.SecretBytes([]byte(certificatePEM)),`
	`419`	`+ certification.CertificateKeyKey: core.SecretBytes([]byte(keyPEM)),`
`418`	`420`	`}`
`419`	`421`	`}`
`420`	`422`
`421`		`-func buildCaCertificateEntry(certificatePEM string) map[string][]byte {`
`422`		`- return map[string][]byte{`
`423`		`- certification.CertificateKey: []byte(certificatePEM),`
	`423`	`+func buildCaCertificateEntry(certificatePEM string) map[string]core.SecretBytes {`
	`424`	`+ return map[string]core.SecretBytes{`
	`425`	`+ certification.CertificateKey: core.SecretBytes([]byte(certificatePEM)),`
`424`	`426`	`}`
`425`	`427`	`}`