99 appsv1 "k8s.io/api/apps/v1"
1010 corev1 "k8s.io/api/core/v1"
1111 rbacv1 "k8s.io/api/rbac/v1"
12- k8serrors "k8s.io/apimachinery/pkg/api/errors"
12+ apierrors "k8s.io/apimachinery/pkg/api/errors"
1313 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1414 "k8s.io/apimachinery/pkg/util/intstr"
1515
@@ -160,7 +160,7 @@ func (i *StrategyDeploymentInstaller) getCertResources() []certResource {
160160}
161161
162162func (i * StrategyDeploymentInstaller ) certResourcesForDeployment (deploymentName string ) []certResource {
163- result := []certResource {}
163+ var result []certResource
164164 for _ , desc := range i .getCertResources () {
165165 if desc .getDeploymentName () == deploymentName {
166166 result = append (result , desc )
@@ -185,13 +185,12 @@ func (i *StrategyDeploymentInstaller) installCertRequirements(strategy Strategy)
185185 }
186186
187187 // Create the CA
188- expiration := time .Now (). Add ( DefaultCertValidFor )
189- ca , err := certs .GenerateCA (expiration , Organization )
188+ i . certificateExpirationTime = CalculateCertExpiration ( time .Now ())
189+ ca , err := certs .GenerateCA (i . certificateExpirationTime , Organization )
190190 if err != nil {
191191 logger .Debug ("failed to generate CA" )
192192 return nil , err
193193 }
194- rotateAt := expiration .Add (- 1 * DefaultCertMinFresh )
195194
196195 for n , sddSpec := range strategyDetailsDeployment .DeploymentSpecs {
197196 certResources := i .certResourcesForDeployment (sddSpec .Name )
@@ -202,7 +201,7 @@ func (i *StrategyDeploymentInstaller) installCertRequirements(strategy Strategy)
202201 }
203202
204203 // Update the deployment for each certResource
205- newDepSpec , caPEM , err := i .installCertRequirementsForDeployment (sddSpec .Name , ca , rotateAt , sddSpec .Spec , getServicePorts (certResources ))
204+ newDepSpec , caPEM , err := i .installCertRequirementsForDeployment (sddSpec .Name , ca , i . certificateExpirationTime , sddSpec .Spec , getServicePorts (certResources ))
206205 if err != nil {
207206 return nil , err
208207 }
@@ -214,6 +213,14 @@ func (i *StrategyDeploymentInstaller) installCertRequirements(strategy Strategy)
214213 return strategyDetailsDeployment , nil
215214}
216215
216+ func (i * StrategyDeploymentInstaller ) CertsRotateAt () time.Time {
217+ return CalculateCertRotatesAt (i .certificateExpirationTime )
218+ }
219+
220+ func (i * StrategyDeploymentInstaller ) CertsRotated () bool {
221+ return i .certificatesRotated
222+ }
223+
217224func ShouldRotateCerts (csv * v1alpha1.ClusterServiceVersion ) bool {
218225 now := metav1 .Now ()
219226 if ! csv .Status .CertsRotateAt .IsZero () && csv .Status .CertsRotateAt .Before (& now ) {
@@ -223,7 +230,15 @@ func ShouldRotateCerts(csv *v1alpha1.ClusterServiceVersion) bool {
223230 return false
224231}
225232
226- func (i * StrategyDeploymentInstaller ) installCertRequirementsForDeployment (deploymentName string , ca * certs.KeyPair , rotateAt time.Time , depSpec appsv1.DeploymentSpec , ports []corev1.ServicePort ) (* appsv1.DeploymentSpec , []byte , error ) {
233+ func CalculateCertExpiration (startingFrom time.Time ) time.Time {
234+ return startingFrom .Add (DefaultCertValidFor )
235+ }
236+
237+ func CalculateCertRotatesAt (certExpirationTime time.Time ) time.Time {
238+ return certExpirationTime .Add (- 1 * DefaultCertMinFresh )
239+ }
240+
241+ func (i * StrategyDeploymentInstaller ) installCertRequirementsForDeployment (deploymentName string , ca * certs.KeyPair , expiration time.Time , depSpec appsv1.DeploymentSpec , ports []corev1.ServicePort ) (* appsv1.DeploymentSpec , []byte , error ) {
227242 logger := log .WithFields (log.Fields {})
228243
229244 // Create a service for the deployment
@@ -246,7 +261,7 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
246261
247262 // Delete the Service to replace
248263 deleteErr := i .strategyClient .GetOpClient ().DeleteService (service .GetNamespace (), service .GetName (), & metav1.DeleteOptions {})
249- if deleteErr != nil && ! k8serrors .IsNotFound (deleteErr ) {
264+ if deleteErr != nil && ! apierrors .IsNotFound (deleteErr ) {
250265 return nil , nil , fmt .Errorf ("could not delete existing service %s" , service .GetName ())
251266 }
252267 }
@@ -263,7 +278,7 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
263278 fmt .Sprintf ("%s.%s" , service .GetName (), i .owner .GetNamespace ()),
264279 fmt .Sprintf ("%s.%s.svc" , service .GetName (), i .owner .GetNamespace ()),
265280 }
266- servingPair , err := certGenerator .Generate (rotateAt , Organization , ca , hosts )
281+ servingPair , err := certGenerator .Generate (expiration , Organization , ca , hosts )
267282 if err != nil {
268283 logger .Warnf ("could not generate signed certs for hosts %v" , hosts )
269284 return nil , nil , err
@@ -311,16 +326,18 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
311326 secret = existingSecret
312327 caPEM = existingCAPEM
313328 caHash = certs .PEMSHA256 (caPEM )
314- } else if _ , err := i .strategyClient .GetOpClient ().UpdateSecret (secret ); err != nil {
315- logger .Warnf ("could not update secret %s" , secret .GetName ())
316- return nil , nil , err
329+ } else {
330+ if _ , err := i .strategyClient .GetOpClient ().UpdateSecret (secret ); err != nil {
331+ logger .Warnf ("could not update secret %s" , secret .GetName ())
332+ return nil , nil , err
333+ }
334+ i .certificatesRotated = true
317335 }
318-
319- } else if k8serrors .IsNotFound (err ) {
336+ } else if apierrors .IsNotFound (err ) {
320337 // Create the secret
321338 ownerutil .AddNonBlockingOwner (secret , i .owner )
322339 if _ , err := i .strategyClient .GetOpClient ().CreateSecret (secret ); err != nil {
323- if ! k8serrors .IsAlreadyExists (err ) {
340+ if ! apierrors .IsAlreadyExists (err ) {
324341 log .Warnf ("could not create secret %s: %v" , secret .GetName (), err )
325342 return nil , nil , err
326343 }
@@ -331,6 +348,7 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
331348 return nil , nil , err
332349 }
333350 }
351+ i .certificatesRotated = true
334352 } else {
335353 return nil , nil , err
336354 }
@@ -361,7 +379,7 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
361379 logger .Warnf ("could not update secret role %s" , secretRole .GetName ())
362380 return nil , nil , err
363381 }
364- } else if k8serrors .IsNotFound (err ) {
382+ } else if apierrors .IsNotFound (err ) {
365383 // Create the role
366384 ownerutil .AddNonBlockingOwner (secretRole , i .owner )
367385 _ , err = i .strategyClient .GetOpClient ().CreateRole (secretRole )
@@ -407,7 +425,7 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
407425 logger .Warnf ("could not update secret rolebinding %s" , secretRoleBinding .GetName ())
408426 return nil , nil , err
409427 }
410- } else if k8serrors .IsNotFound (err ) {
428+ } else if apierrors .IsNotFound (err ) {
411429 // Create the role
412430 ownerutil .AddNonBlockingOwner (secretRoleBinding , i .owner )
413431 _ , err = i .strategyClient .GetOpClient ().CreateRoleBinding (secretRoleBinding )
@@ -452,7 +470,7 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
452470 logger .Warnf ("could not update auth delegator clusterrolebinding %s" , authDelegatorClusterRoleBinding .GetName ())
453471 return nil , nil , err
454472 }
455- } else if k8serrors .IsNotFound (err ) {
473+ } else if apierrors .IsNotFound (err ) {
456474 // Create the role.
457475 if err := ownerutil .AddOwnerLabels (authDelegatorClusterRoleBinding , i .owner ); err != nil {
458476 return nil , nil , err
@@ -499,7 +517,7 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
499517 logger .Warnf ("could not update auth reader role binding %s" , authReaderRoleBinding .GetName ())
500518 return nil , nil , err
501519 }
502- } else if k8serrors .IsNotFound (err ) {
520+ } else if apierrors .IsNotFound (err ) {
503521 // Create the role.
504522 if err := ownerutil .AddOwnerLabels (authReaderRoleBinding , i .owner ); err != nil {
505523 return nil , nil , err
0 commit comments