forked from cert-manager/cert-manager
-
Notifications
You must be signed in to change notification settings - Fork 0
/
helper.go
110 lines (95 loc) · 3.79 KB
/
helper.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
/*
Copyright 2019 The Jetstack cert-manager contributors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package controller
import (
"crypto/x509"
"fmt"
"time"
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha1"
cmlisters "github.com/jetstack/cert-manager/pkg/client/listers/certmanager/v1alpha1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
type Helper interface {
GetGenericIssuer(ref cmapi.ObjectReference, ns string) (cmapi.GenericIssuer, error)
}
// Type Helper provides a set of commonly useful functions for use when building
// a cert-manager controller.
// An instance of Helper is made available as part of a controller's context.
type helperImpl struct {
issuerLister cmlisters.IssuerLister
clusterIssuerLister cmlisters.ClusterIssuerLister
}
var _ Helper = &helperImpl{}
// NewHelper will construct a new instance of a Helper using values supplied on
// the provided controller context.
func NewHelper(issuerLister cmlisters.IssuerLister, clusterIssuerLister cmlisters.ClusterIssuerLister) Helper {
return &helperImpl{
issuerLister: issuerLister,
clusterIssuerLister: clusterIssuerLister,
}
}
// GetGenericIssuer will return an Issuer for the given IssuerRef.
// The namespace parameter must be provided if an 'Issuer' is referenced.
// This namespace will be used to read the Issuer resource.
// In most cases, the ns parameter should be set to the namespace of the resource
// that defines the IssuerRef (i.e. the namespace of the Certificate resource).
func (h *helperImpl) GetGenericIssuer(ref cmapi.ObjectReference, ns string) (cmapi.GenericIssuer, error) {
switch ref.Kind {
case "", cmapi.IssuerKind:
return h.issuerLister.Issuers(ns).Get(ref.Name)
case cmapi.ClusterIssuerKind:
// handle edge case where the ClusterIssuerLister is not set.
// this isn't actually a supported operating mode right now, nor is it
// exposed to users.
// we include it here in case we do allow this mode of operation again
// in future.
if h.clusterIssuerLister == nil {
return nil, fmt.Errorf("cannot get ClusterIssuer named %q as cert-manager is scoped to a single namespace", ref.Name)
}
return h.clusterIssuerLister.Get(ref.Name)
default:
return nil, fmt.Errorf(`invalid value %q for issuerRef.kind. Must be empty, %q or %q`, ref.Kind, cmapi.IssuerKind, cmapi.ClusterIssuerKind)
}
}
func (o IssuerOptions) ResourceNamespace(iss cmapi.GenericIssuer) string {
ns := iss.GetObjectMeta().Namespace
if ns == "" {
ns = o.ClusterResourceNamespace
}
return ns
}
func (o IssuerOptions) CanUseAmbientCredentials(iss cmapi.GenericIssuer) bool {
switch iss.(type) {
case *cmapi.ClusterIssuer:
return o.ClusterIssuerAmbientCredentials
case *cmapi.Issuer:
return o.IssuerAmbientCredentials
}
return false
}
func (o IssuerOptions) CertificateNeedsRenew(cert *x509.Certificate, renewBefore *metav1.Duration) bool {
renewBeforeDuration := o.RenewBeforeExpiryDuration
if renewBefore != nil {
renewBeforeDuration = renewBefore.Duration
}
// calculate the amount of time until expiry
durationUntilExpiry := cert.NotAfter.Sub(time.Now())
// calculate how long until we should start attempting to renew the
// certificate
renewIn := durationUntilExpiry - renewBeforeDuration
// if we should being attempting to renew now, then trigger a renewal
if renewIn <= 0 {
return true
}
return false
}