Skip to content

Conversation

@jiuker
Copy link
Contributor

@jiuker jiuker commented Feb 29, 2024

fix #1985
we should keep csrSingerName from env.

@pjuarezd
Copy link
Member

may I suggest getDefaultCsrSignerName only returns a value if the env variable is set:

func getDefaultCsrSignerName() string {
         defaultCsrSignerNameOnce.Do(func() {
		if os.Getenv(CSRSignerName) != "" {
			defaultCsrSignerName = os.Getenv(CSRSignerName)
			return
		}
		defaultCsrSignerName = ""
	})
	return defaultCsrSignerName
}

If variable is set, we immediatly return that, else detect EKS, else return defalt CSR signer

func GetCSRSignerName(clientSet kubernetes.Interface) string {
	csrSignerNameOnce.Do(func() {
		csrSignerName = getDefaultCsrSignerName()
		if csrSignerName != "" {
		  return csrSignerName
		}
		// only for csr api v1 we will try to detect if we are running inside an EKS cluster and switch to AWS's way to
		// get certificates using their CSRSignerName https://docs.aws.amazon.com/eks/latest/userguide/cert-signing.html
		if GetCertificatesAPIVersion(clientSet) == CSRV1 {
			// if the user specified the EKS runtime, no need to do the check
			if utils.GetOperatorRuntime() == common.OperatorRuntimeEKS {
				csrSignerName = EKSCsrSignerName
				return
			}
			nodes, err := clientSet.CoreV1().Nodes().List(context.Background(), metav1.ListOptions{})
			if err != nil {
				klog.Infof("Could not retrieve nodes to determine if we are in EKS: %v", err)
			}
			// if we find a single node with a kubeletVersion that contains "eks" or a label that starts with
			// "eks.amazonaws.com", we'll start using AWS EKS signer name
			for _, n := range nodes.Items {
				if strings.Contains(n.Status.NodeInfo.KubeletVersion, "eks") {
					csrSignerName = EKSCsrSignerName
					break
				}
				for k := range n.ObjectMeta.Labels {
					if strings.HasPrefix(k, "eks.amazonaws.com") {
						csrSignerName = EKSCsrSignerName
					}
				}
			}
		}
		if csrSignerName == "" {
                     csrSignerName = certificatesV1.KubeletServingSignerName
                 }
	})
	return csrSignerName

Copy link
Contributor

@shtripat shtripat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@pjuarezd pjuarezd merged commit ae4af42 into minio:master Mar 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

MINIO_OPERATOR_CSR_SIGNER_NAME env variable is ignored if detected platform is EKS

3 participants