mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-31 03:45:17 +00:00
Code Activity

ValidCert Secret Annotation Check (#2933)

Browse source 
* Annotation check for Secrets

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Fix inconsistent errors

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Fix linting error

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
This commit is contained in:
Kumar Mallikarjuna 2022-01-08 01:45:00 +05:30 • committed by GitHub
parent 4410b6adc3
commit 9e16e763a0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 35 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
pkg/tls/certRenewer.go
View file

@ -332,6 +332,41 @@ func (c *CertRenewer) RollingUpdate() error {
func (c *CertRenewer) ValidCert() (bool, error) {
logger := c.log.WithName("ValidCert")
certProps, err := GetTLSCertProps(c.clientConfig)
if err != nil {
return false, nil
}
var managedByKyverno bool
snameTLS := generateTLSPairSecretName(certProps)
snameCA := generateRootCASecretName(certProps)
unstrSecret, err := c.client.GetResource("", "Secret", certProps.Namespace, snameTLS)
if err != nil {
return false, nil
}
if label, ok := unstrSecret.GetLabels()[ManagedByLabel]; ok {
managedByKyverno = label == "kyverno"
}
_, ok := unstrSecret.GetAnnotations()[MasterDeploymentUID]
if managedByKyverno && !ok {
return false, nil
}
unstrSecret, err = c.client.GetResource("", "Secret", certProps.Namespace, snameCA)
if err != nil {
return false, nil
}
if label, ok := unstrSecret.GetLabels()[ManagedByLabel]; ok {
managedByKyverno = label == "kyverno"
}
_, ok = unstrSecret.GetAnnotations()[MasterDeploymentUID]
if managedByKyverno && !ok {
return false, nil
}
rootCA, err := ReadRootCASecret(c.clientConfig, c.client)
if err != nil {
return false, errors.Wrap(err, "unable to read CA from secret")