ClusterTrustBundle: Enforce max size during validation

Author: ahmedtd

pkg/apis/certificates/types.go

@@ -277,3 +277,6 @@ type ClusterTrustBundleList struct {
 	// Items is a collection of ClusterTrustBundle objects
 	Items []ClusterTrustBundle
 }
+
+// MaxTrustBundleSize is the maximimum size of a single trust bundle field.
+const MaxTrustBundleSize = 1 * 1024 * 1024

pkg/apis/certificates/validation/validation.go

@@ -508,6 +508,11 @@ func ValidateClusterTrustBundleUpdate(newBundle, oldBundle *certificates.Cluster
 func validateTrustBundle(path *field.Path, in string) field.ErrorList {
 	var allErrors field.ErrorList
 
+	if len(in) > certificates.MaxTrustBundleSize {
+		allErrors = append(allErrors, field.TooLong(path, fmt.Sprintf("<value omitted, len %d>", len(in)), certificates.MaxTrustBundleSize))
+		return allErrors
+	}
+
 	blockDedupe := map[string][]int{}
 
 	rest := []byte(in)