Fix inconsistent TTL behavior in CA providers #14516
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
theme/connect
kyhavlov
requested review from
a team and
erichaberkorn
and removed request for
a team
kisunji
reviewed
Sep 13, 2022
| @@ -737,6 +724,19 @@ func (v *VaultProvider) mountNamespaced(namespace, path string, mountInfo *vault | |||
| return err | |||
| } | |||
|
|
|||
| func (v *VaultProvider) tuneMountNamespaced(namespace, path string, mountConfig *vaultapi.MountConfigInput) error { | |||
There was a problem hiding this comment.
Could you explain what this does in place of the readNamespaced codepath it replaces?
There was a problem hiding this comment.
it's not a replacement for readNamespaced - it's basically the same as mountNamespaced above but for reconfiguring the pki mount for the intermediate CA cert. In the case where that mount already exists we have to call /tune instead.
kisunji
approved these changes
Sep 13, 2022
kyhavlov
force-pushed
the
ca-ttl-fixes
branch
2 times, most recently
from
afea9b7
to
40ec083
Compare
kyhavlov
force-pushed
the
ca-ttl-fixes
branch
from
40ec083
to
d67bccd
Compare
This was referenced Sep 13, 2022
This was referenced Oct 18, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR has a couple changes related to CA provider configuration:
IntermediateCertTTLis only valid in the primary datacenter, as that's where the intermediates are signed. It isn't used at all in the secondary DCs.Configure()is called. Previously these values were only set on creation of the mount/role and then any updates to the CA config were not reflected in Vault.