mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 02:18:15 +00:00
Code Activity

fix: renew tls cert when ca cert is deleted (#8114)

Browse source 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
This commit is contained in:
shuting 2023-08-26 00:15:14 +08:00 • committed by GitHub
parent 58bf667f61
commit c751f1de58
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
pkg/tls/renewer.go
View file

@ -8,6 +8,7 @@ import (
"time"
"github.com/kyverno/kyverno/api/kyverno"
"github.com/kyverno/kyverno/pkg/config"
corev1 "k8s.io/api/core/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@ -123,7 +124,21 @@ func (c *certRenewer) RenewCA(ctx context.Context) error {
logger.Error(err, "failed to write CA")
return err
}
logger.Info("CA was renewed")
valid, err := c.ValidateCert(ctx)
if err != nil {
logger.Error(err, "failed to validate certs")
return err
}
if !valid {
logger.Info("mismatched certs chain, renewing", "CA certificate", config.GenerateRootCASecretName(), "TLS certificate", config.GenerateTLSPairSecretName())
if err := c.RenewTLS(ctx); err != nil {
logger.Error(err, "failed to renew TLS certificate", "name", config.GenerateTLSPairSecretName())
return err
}
}
return nil
}
@ -140,10 +155,16 @@ func (c *certRenewer) RenewTLS(ctx context.Context) error {
return err
}
now := time.Now()
if cert != nil && !allCertificatesExpired(now.Add(5*c.certRenewalInterval), cert) {
logger.V(4).Info("TLS certificate does not need to be renewed")
return nil
if cert != nil {
valid, err := c.ValidateCert(ctx)
if err != nil || !valid {
logger.Info("invalid cert chain, renewing TLS certificate", "name", config.GenerateTLSPairSecretName(), "error", err.Error())
} else if !allCertificatesExpired(now.Add(5*c.certRenewalInterval), cert) {
logger.V(4).Info("TLS certificate does not need to be renewed")
return nil
}
}
if !isSecretManagedByKyverno(secret) {
err := fmt.Errorf("tls is not valid but certificates are not managed by kyverno, we can't renew them")
logger.Error(err, "tls is not valid but certificates are not managed by kyverno, we can't renew them")