-
Notifications
You must be signed in to change notification settings - Fork 12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Auto renew ca certificate #150
Conversation
closes #22 |
d364a04
to
a670d62
Compare
// IssuerChangedHandler returns an EventHandler that generates | ||
// reconcile requests for Secrets | ||
func (r *DiscoveryServiceCertificateReconciler) IssuerChangedHandler() handler.EventHandler { | ||
return handler.EnqueueRequestsFromMapFunc( | ||
func(o client.Object) []reconcile.Request { | ||
|
||
issuer := o.(*operatorv1alpha1.DiscoveryServiceCertificate) | ||
// Only interested in changes to CA certificates. A change in the CA | ||
// means that the child certificates need to be re-issued | ||
if !issuer.IsCA() { | ||
return []reconcile.Request{} | ||
} | ||
|
||
list := &operatorv1alpha1.DiscoveryServiceCertificateList{} | ||
if err := r.Client.List(context.Background(), list); err != nil { | ||
return []reconcile.Request{} | ||
} | ||
|
||
reconcileRequests := []reconcile.Request{} | ||
|
||
for _, dsc := range list.Items { | ||
if dsc.Spec.Signer.CASigned != nil && | ||
dsc.Spec.Signer.CASigned.SecretRef.Name == issuer.Spec.SecretRef.Name { | ||
|
||
reconcileRequests = append(reconcileRequests, | ||
reconcile.Request{NamespacedName: types.NamespacedName{ | ||
Name: dsc.GetName(), | ||
Namespace: dsc.GetNamespace(), | ||
}}) | ||
} | ||
} | ||
|
||
return reconcileRequests | ||
}, | ||
) | ||
} | ||
|
||
// SetupWithManager adds the controller to the manager | ||
func (r *DiscoveryServiceCertificateReconciler) SetupWithManager(mgr ctrl.Manager) error { | ||
return ctrl.NewControllerManagedBy(mgr). | ||
For(&operatorv1alpha1.DiscoveryServiceCertificate{}). | ||
Owns(&corev1.Secret{}). | ||
Watches(&source.Kind{Type: &operatorv1alpha1.DiscoveryServiceCertificate{}}, r.IssuerChangedHandler()). | ||
Complete(r) | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this is the important part, all other changes are just cleanup
/lgtm |
LGTM label has been added. Git tree hash: 4a148b8628515c0a75fad0196f2dea607bd8be59
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
/ok-to-test |
/approve |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: roivaz The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Adds a new event handler in the DiscoveryServiceCertificate controller to trigger a reconcile of any certificate that has its issuer certificate modified. After this, it is safe to enable auto-renewal of the discovery service CA certificate.
/kind feature
/assign
/priority important-longterm
Note for reviewers: #149 needs to be merged first and then I will rebase.