Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Persist one CA per cluster #467

Merged
merged 30 commits into from
Mar 15, 2019
Merged

Persist one CA per cluster #467

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
30 commits
Select commit Hold shift + click to select a range
69bb48f
Allow specifying CA validity through CABuilderOptions
sebgl Feb 27, 2019
eeaa719
Add a helper method to parse a PEM private key
sebgl Feb 27, 2019
bf5b8fb
Extract privateMatchesPublicKey for reuse
sebgl Mar 4, 2019
f1329b3
Fix CA secret name in association controller
sebgl Mar 4, 2019
adff3ed
Make ca.PrivateKey a public field to be used for elasticsearch nodecerts
sebgl Mar 4, 2019
7cef244
Reconcile one CA per cluster
sebgl Mar 4, 2019
d05606d
Rename and split reconcile.go and secrets.go into cert_*.go
sebgl Mar 4, 2019
7a72c28
Mark slow cert-related unit tests as integration
sebgl Mar 4, 2019
120f3e5
Plug new CA reconciliation to the es driver
sebgl Mar 4, 2019
5567ead
Default to CAs valid for 10 hours in dev mode
sebgl Mar 4, 2019
b25f383
Setup a flag for cert expiration safety margin and default to 1 day
sebgl Mar 4, 2019
0e474eb
Fix typos and rename variable
sebgl Mar 7, 2019
d7e27ff
Fix wrong unit test
sebgl Mar 7, 2019
0435961
Rename Ca to CA
sebgl Mar 7, 2019
31e8643
Merge branch 'master' into persist-one-ca-per-cluster
sebgl Mar 7, 2019
0adb50d
Run make fmt
sebgl Mar 7, 2019
2f5cae8
Merge branch 'master' into persist-one-ca-per-cluster
sebgl Mar 7, 2019
e502f27
Fix e2e test
sebgl Mar 8, 2019
2a9a625
Merge branch 'master' into persist-one-ca-per-cluster
sebgl Mar 8, 2019
3ac4f11
Comment CABuilderOptions
sebgl Mar 12, 2019
31d521b
Minor tests improvements
sebgl Mar 12, 2019
292aaf4
Merge branch 'master' into persist-one-ca-per-cluster
sebgl Mar 12, 2019
4a5c3b7
Fix CACertSecretName call
sebgl Mar 12, 2019
137049f
Merge branch 'master' into persist-one-ca-per-cluster
sebgl Mar 12, 2019
3e9cf90
Merge branch 'master' into persist-one-ca-per-cluster
sebgl Mar 14, 2019
9d7bad6
Validate cert validity user inputs
sebgl Mar 14, 2019
7be5225
Make sure to enqueue a reconciliation before CA cert expires
sebgl Mar 14, 2019
88d857b
Add missing license header
sebgl Mar 14, 2019
83a05f2
Rename cert validity time constants
sebgl Mar 14, 2019
9b42ebc
Add a flag for node certs expiration and rotateBefore
sebgl Mar 14, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Run make fmt
  • Loading branch information
@sebgl
sebgl committed Mar 7, 2019
commit 0adb50d52c46cdd594505e3fbf171d8ed2b6bd17
2 changes: 1 addition & 1 deletion operators/pkg/controller/elasticsearch/nodecerts/ca_secrets_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ func Test_caFromSecrets(t *testing.T) {
name string
certSecret corev1.Secret
privateKeySecret corev1.Secret
wantCa *certificates.CA
wantCa *certificates.CA
wantOK bool
}{
{
Expand Down
6 changes: 3 additions & 3 deletions operators/pkg/controller/elasticsearch/nodecerts/cert.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ var log = logf.KBLog.WithName("nodecerts")
// of the given es cluster.
func ReconcileNodeCertificateSecrets(
c k8s.Client,
ca *certificates.CA ,
ca *certificates.CA,
csrClient certificates.CSRClient,
es v1alpha1.ElasticsearchCluster,
services []corev1.Service,
Expand Down Expand Up @@ -122,7 +122,7 @@ func doReconcile(
csrClient certificates.CSRClient,
clusterName, namespace string,
svcs []corev1.Service,
ca *certificates.CA ,
ca *certificates.CA,
additionalTrustedCAsPemEncoded [][]byte,
) (reconcile.Result, error) {
// a placeholder secret may have nil entries, create them if needed
Expand Down Expand Up @@ -208,7 +208,7 @@ func doReconcile(
// - certificate has the wrong format
// - certificate is invalid or expired
// - certificate SAN and IP does not match pod SAN and IP
func shouldIssueNewCertificate(secret corev1.Secret, ca *certificates.CA , pod corev1.Pod) bool {
func shouldIssueNewCertificate(secret corev1.Secret, ca *certificates.CA, pod corev1.Pod) bool {
certData, ok := secret.Data[CertFileName]
if !ok {
// certificate is missing
Expand Down