Skip to content
This repository has been archived by the owner on Dec 11, 2023. It is now read-only.

Renew webhook certificates automatically #244

Merged
merged 2 commits into from
Apr 30, 2020
Merged

Conversation

lrgar
Copy link
Contributor

@lrgar lrgar commented Apr 29, 2020

With this PR the webhook bootstrapper renews automatically the certificates used by the webhook:

  • I've moved the certificate generation from the OpenSSL CLI to the Go standard library.
  • CA certificates are configured to last for 365 days, and will be renewed 4 hours before the expiration.
  • Server certificates are configured to last for 7 days, and will also be renewed 4 hours before the expiration.
  • The generated certificates are stored in a secret dynatrace-oneagent-webhook-certs on the Operator namespace, and will be reused if you restart the webhook Pod.
  • You can force the regeneration of certificates by deleting this secret as well. The webhook bootstrapper will check and every five minutes.

@lrgar lrgar requested a review from DTMad April 29, 2020 16:22
@lrgar lrgar merged commit e9d8591 into master Apr 30, 2020
@lrgar lrgar deleted the feature/webhook-renew branch April 30, 2020 08:01
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants