Skip to content

Commit 43f1f5e

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #5008 from DustinChaloupka/master
🐛 (go/v4): Replace custom CertWatcher with controller-runtime’s built-in implementation for webhook and metrics server cert reloads. Ensures non-leader replicas update certificates correctly.
2 parents 0dc0185 + d14f894 commit 43f1f5e

File tree

7 files changed

+70
-351
lines changed
  • docs/book/src
    • cronjob-tutorial/testdata/project/cmd
    • getting-started/testdata/project/cmd
    • multiversion-tutorial/testdata/project/cmd
  • pkg/plugins/golang/v4/scaffolds/internal/templates/cmd
  • testdata

7 files changed

+70
-351
lines changed

‎docs/book/src/cronjob-tutorial/testdata/project/cmd/main.go

Lines changed: 10 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ import (
2121
"crypto/tls"
2222
"flag"
2323
"os"
24-
"path/filepath"
2524

2625
// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
2726
// to ensure that exec-entrypoint and run can make use of them.
@@ -31,7 +30,6 @@ import (
3130
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
3231
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
3332
ctrl "sigs.k8s.io/controller-runtime"
34-
"sigs.k8s.io/controller-runtime/pkg/certwatcher"
3533
"sigs.k8s.io/controller-runtime/pkg/healthz"
3634
"sigs.k8s.io/controller-runtime/pkg/log/zap"
3735
"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
@@ -124,34 +122,22 @@ func main() {
124122
tlsOpts = append(tlsOpts, disableHTTP2)
125123
}
126124

127-
// Create watchers for metrics and webhooks certificates
128-
var metricsCertWatcher, webhookCertWatcher *certwatcher.CertWatcher
129-
130125
// Initial webhook TLS options
131126
webhookTLSOpts := tlsOpts
127+
webhookServerOptions := webhook.Options{
128+
TLSOpts: webhookTLSOpts,
129+
}
132130

133131
if len(webhookCertPath) > 0 {
134132
setupLog.Info("Initializing webhook certificate watcher using provided certificates",
135133
"webhook-cert-path", webhookCertPath, "webhook-cert-name", webhookCertName, "webhook-cert-key", webhookCertKey)
136134

137-
var err error
138-
webhookCertWatcher, err = certwatcher.New(
139-
filepath.Join(webhookCertPath, webhookCertName),
140-
filepath.Join(webhookCertPath, webhookCertKey),
141-
)
142-
if err != nil {
143-
setupLog.Error(err, "Failed to initialize webhook certificate watcher")
144-
os.Exit(1)
145-
}
146-
147-
webhookTLSOpts = append(webhookTLSOpts, func(config *tls.Config) {
148-
config.GetCertificate = webhookCertWatcher.GetCertificate
149-
})
135+
webhookServerOptions.CertDir = webhookCertPath
136+
webhookServerOptions.CertName = webhookCertName
137+
webhookServerOptions.KeyName = webhookCertKey
150138
}
151139

152-
webhookServer := webhook.NewServer(webhook.Options{
153-
TLSOpts: webhookTLSOpts,
154-
})
140+
webhookServer := webhook.NewServer(webhookServerOptions)
155141

156142
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
157143
// More info:
@@ -183,19 +169,9 @@ func main() {
183169
setupLog.Info("Initializing metrics certificate watcher using provided certificates",
184170
"metrics-cert-path", metricsCertPath, "metrics-cert-name", metricsCertName, "metrics-cert-key", metricsCertKey)
185171

186-
var err error
187-
metricsCertWatcher, err = certwatcher.New(
188-
filepath.Join(metricsCertPath, metricsCertName),
189-
filepath.Join(metricsCertPath, metricsCertKey),
190-
)
191-
if err != nil {
192-
setupLog.Error(err, "to initialize metrics certificate watcher", "error", err)
193-
os.Exit(1)
194-
}
195-
196-
metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, func(config *tls.Config) {
197-
config.GetCertificate = metricsCertWatcher.GetCertificate
198-
})
172+
metricsServerOptions.CertDir = metricsCertPath
173+
metricsServerOptions.CertName = metricsCertName
174+
metricsServerOptions.KeyName = metricsCertKey
199175
}
200176

201177
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
@@ -249,22 +225,6 @@ func main() {
249225
}
250226
// +kubebuilder:scaffold:builder
251227

252-
if metricsCertWatcher != nil {
253-
setupLog.Info("Adding metrics certificate watcher to manager")
254-
if err := mgr.Add(metricsCertWatcher); err != nil {
255-
setupLog.Error(err, "unable to add metrics certificate watcher to manager")
256-
os.Exit(1)
257-
}
258-
}
259-
260-
if webhookCertWatcher != nil {
261-
setupLog.Info("Adding webhook certificate watcher to manager")
262-
if err := mgr.Add(webhookCertWatcher); err != nil {
263-
setupLog.Error(err, "unable to add webhook certificate watcher to manager")
264-
os.Exit(1)
265-
}
266-
}
267-
268228
if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
269229
setupLog.Error(err, "unable to set up health check")
270230
os.Exit(1)

‎docs/book/src/getting-started/testdata/project/cmd/main.go

Lines changed: 10 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ import (
2020
"crypto/tls"
2121
"flag"
2222
"os"
23-
"path/filepath"
2423

2524
// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
2625
// to ensure that exec-entrypoint and run can make use of them.
@@ -30,7 +29,6 @@ import (
3029
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
3130
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
3231
ctrl "sigs.k8s.io/controller-runtime"
33-
"sigs.k8s.io/controller-runtime/pkg/certwatcher"
3432
"sigs.k8s.io/controller-runtime/pkg/healthz"
3533
"sigs.k8s.io/controller-runtime/pkg/log/zap"
3634
"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
@@ -104,34 +102,22 @@ func main() {
104102
tlsOpts = append(tlsOpts, disableHTTP2)
105103
}
106104

107-
// Create watchers for metrics and webhooks certificates
108-
var metricsCertWatcher, webhookCertWatcher *certwatcher.CertWatcher
109-
110105
// Initial webhook TLS options
111106
webhookTLSOpts := tlsOpts
107+
webhookServerOptions := webhook.Options{
108+
TLSOpts: webhookTLSOpts,
109+
}
112110

113111
if len(webhookCertPath) > 0 {
114112
setupLog.Info("Initializing webhook certificate watcher using provided certificates",
115113
"webhook-cert-path", webhookCertPath, "webhook-cert-name", webhookCertName, "webhook-cert-key", webhookCertKey)
116114

117-
var err error
118-
webhookCertWatcher, err = certwatcher.New(
119-
filepath.Join(webhookCertPath, webhookCertName),
120-
filepath.Join(webhookCertPath, webhookCertKey),
121-
)
122-
if err != nil {
123-
setupLog.Error(err, "Failed to initialize webhook certificate watcher")
124-
os.Exit(1)
125-
}
126-
127-
webhookTLSOpts = append(webhookTLSOpts, func(config *tls.Config) {
128-
config.GetCertificate = webhookCertWatcher.GetCertificate
129-
})
115+
webhookServerOptions.CertDir = webhookCertPath
116+
webhookServerOptions.CertName = webhookCertName
117+
webhookServerOptions.KeyName = webhookCertKey
130118
}
131119

132-
webhookServer := webhook.NewServer(webhook.Options{
133-
TLSOpts: webhookTLSOpts,
134-
})
120+
webhookServer := webhook.NewServer(webhookServerOptions)
135121

136122
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
137123
// More info:
@@ -163,19 +149,9 @@ func main() {
163149
setupLog.Info("Initializing metrics certificate watcher using provided certificates",
164150
"metrics-cert-path", metricsCertPath, "metrics-cert-name", metricsCertName, "metrics-cert-key", metricsCertKey)
165151

166-
var err error
167-
metricsCertWatcher, err = certwatcher.New(
168-
filepath.Join(metricsCertPath, metricsCertName),
169-
filepath.Join(metricsCertPath, metricsCertKey),
170-
)
171-
if err != nil {
172-
setupLog.Error(err, "to initialize metrics certificate watcher", "error", err)
173-
os.Exit(1)
174-
}
175-
176-
metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, func(config *tls.Config) {
177-
config.GetCertificate = metricsCertWatcher.GetCertificate
178-
})
152+
metricsServerOptions.CertDir = metricsCertPath
153+
metricsServerOptions.CertName = metricsCertName
154+
metricsServerOptions.KeyName = metricsCertKey
179155
}
180156

181157
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
@@ -211,22 +187,6 @@ func main() {
211187
}
212188
// +kubebuilder:scaffold:builder
213189

214-
if metricsCertWatcher != nil {
215-
setupLog.Info("Adding metrics certificate watcher to manager")
216-
if err := mgr.Add(metricsCertWatcher); err != nil {
217-
setupLog.Error(err, "unable to add metrics certificate watcher to manager")
218-
os.Exit(1)
219-
}
220-
}
221-
222-
if webhookCertWatcher != nil {
223-
setupLog.Info("Adding webhook certificate watcher to manager")
224-
if err := mgr.Add(webhookCertWatcher); err != nil {
225-
setupLog.Error(err, "unable to add webhook certificate watcher to manager")
226-
os.Exit(1)
227-
}
228-
}
229-
230190
if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
231191
setupLog.Error(err, "unable to set up health check")
232192
os.Exit(1)

‎docs/book/src/multiversion-tutorial/testdata/project/cmd/main.go

Lines changed: 10 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ import (
2121
"crypto/tls"
2222
"flag"
2323
"os"
24-
"path/filepath"
2524

2625
// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
2726
// to ensure that exec-entrypoint and run can make use of them.
@@ -32,7 +31,6 @@ import (
3231
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
3332
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
3433
ctrl "sigs.k8s.io/controller-runtime"
35-
"sigs.k8s.io/controller-runtime/pkg/certwatcher"
3634
"sigs.k8s.io/controller-runtime/pkg/healthz"
3735
"sigs.k8s.io/controller-runtime/pkg/log/zap"
3836
"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
@@ -123,34 +121,22 @@ func main() {
123121
tlsOpts = append(tlsOpts, disableHTTP2)
124122
}
125123

126-
// Create watchers for metrics and webhooks certificates
127-
var metricsCertWatcher, webhookCertWatcher *certwatcher.CertWatcher
128-
129124
// Initial webhook TLS options
130125
webhookTLSOpts := tlsOpts
126+
webhookServerOptions := webhook.Options{
127+
TLSOpts: webhookTLSOpts,
128+
}
131129

132130
if len(webhookCertPath) > 0 {
133131
setupLog.Info("Initializing webhook certificate watcher using provided certificates",
134132
"webhook-cert-path", webhookCertPath, "webhook-cert-name", webhookCertName, "webhook-cert-key", webhookCertKey)
135133

136-
var err error
137-
webhookCertWatcher, err = certwatcher.New(
138-
filepath.Join(webhookCertPath, webhookCertName),
139-
filepath.Join(webhookCertPath, webhookCertKey),
140-
)
141-
if err != nil {
142-
setupLog.Error(err, "Failed to initialize webhook certificate watcher")
143-
os.Exit(1)
144-
}
145-
146-
webhookTLSOpts = append(webhookTLSOpts, func(config *tls.Config) {
147-
config.GetCertificate = webhookCertWatcher.GetCertificate
148-
})
134+
webhookServerOptions.CertDir = webhookCertPath
135+
webhookServerOptions.CertName = webhookCertName
136+
webhookServerOptions.KeyName = webhookCertKey
149137
}
150138

151-
webhookServer := webhook.NewServer(webhook.Options{
152-
TLSOpts: webhookTLSOpts,
153-
})
139+
webhookServer := webhook.NewServer(webhookServerOptions)
154140

155141
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
156142
// More info:
@@ -182,19 +168,9 @@ func main() {
182168
setupLog.Info("Initializing metrics certificate watcher using provided certificates",
183169
"metrics-cert-path", metricsCertPath, "metrics-cert-name", metricsCertName, "metrics-cert-key", metricsCertKey)
184170

185-
var err error
186-
metricsCertWatcher, err = certwatcher.New(
187-
filepath.Join(metricsCertPath, metricsCertName),
188-
filepath.Join(metricsCertPath, metricsCertKey),
189-
)
190-
if err != nil {
191-
setupLog.Error(err, "to initialize metrics certificate watcher", "error", err)
192-
os.Exit(1)
193-
}
194-
195-
metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, func(config *tls.Config) {
196-
config.GetCertificate = metricsCertWatcher.GetCertificate
197-
})
171+
metricsServerOptions.CertDir = metricsCertPath
172+
metricsServerOptions.CertName = metricsCertName
173+
metricsServerOptions.KeyName = metricsCertKey
198174
}
199175

200176
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
@@ -252,22 +228,6 @@ func main() {
252228
/*
253229
*/
254230

255-
if metricsCertWatcher != nil {
256-
setupLog.Info("Adding metrics certificate watcher to manager")
257-
if err := mgr.Add(metricsCertWatcher); err != nil {
258-
setupLog.Error(err, "unable to add metrics certificate watcher to manager")
259-
os.Exit(1)
260-
}
261-
}
262-
263-
if webhookCertWatcher != nil {
264-
setupLog.Info("Adding webhook certificate watcher to manager")
265-
if err := mgr.Add(webhookCertWatcher); err != nil {
266-
setupLog.Error(err, "unable to add webhook certificate watcher to manager")
267-
os.Exit(1)
268-
}
269-
}
270-
271231
if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
272232
setupLog.Error(err, "unable to set up health check")
273233
os.Exit(1)

0 commit comments

Comments
 (0)