Skip to content

Conversation

@claudiolor
Copy link
Contributor

Description

This patch changes the certificate renewal flow as the previous one was broken.

  • ResourceSlices: it makes the local ResourceSlice controller manager the renew: when the certificate reaches 2/3 of lifetime, it changes the CSR so that the CR replicator can propagate the change on the remote cluster and make the remoteresourceslice controller handle the renewal.
  • Tenant: in this case we have a different issue, as the CR replicator does not handle the Tenant resource, we make the localrenewer controller (which does not handle resource slices anymore) generate a Renew resource, propagated on the remote cluster, where the remote renewer makes sure to write the CSR into the Tenant resource and let handle the Tenant controller the renewal. Once the certificate is renewed, the new certificate written in the Renew resource status and then in the Identity by the localrenewer controller.

@adamjensenbot
Copy link
Collaborator

Hi @claudiolor. Thanks for your PR!

I am @adamjensenbot.
You can interact with me issuing a slash command in the first line of a comment.
Currently, I understand the following commands:

  • /rebase: Rebase this PR onto the master branch (You can add the option test=true to launch the tests
    when the rebase operation is completed)
  • /merge: Merge this PR into the master branch
  • /build Build Liqo components
  • /test Launch the E2E and Unit tests
  • /hold, /unhold Add/remove the hold label to prevent merging with /merge

Make sure this PR appears in the liqo changelog, adding one of the following labels:

  • feat: 🚀 New Feature
  • fix: 🐛 Bug Fix
  • refactor: 🧹 Code Refactoring
  • docs: 📝 Documentation
  • style: 💄 Code Style
  • perf: 🐎 Performance Improvement
  • test: ✅ Tests
  • chore: 🚚 Dependencies Management
  • build: 📦 Builds Management
  • ci: 👷 CI/CD
  • revert: ⏪ Reverts Previous Changes

@github-actions github-actions bot added the fix Fixes a bug in the codebase. label Feb 9, 2026
@adamjensenbot
Copy link
Collaborator

The generated artifacts appear to be out-of-date.

Please, ensure you are using the correct version of the generators (eg. controller-gen) and re-run:

make generate
Here it is an excerpt of the diff:
diff --git a/pkg/liqo-controller-manager/authentication/remoterenwer-controller/remoterenewer_controller.go b/pkg/liqo-controller-manager/authentication/remoterenwer-controller/remoterenewer_controller.go%0Aindex 71173f3..1c22784 100644%0A--- a/pkg/liqo-controller-manager/authentication/remoterenwer-controller/remoterenewer_controller.go%0A+++ b/pkg/liqo-controller-manager/authentication/remoterenwer-controller/remoterenewer_controller.go%0A@@ -33,8 +33,8 @@ import (%0A 	authv1beta1 "github.com/liqotech/liqo/apis/authentication/v1beta1"%0A 	"github.com/liqotech/liqo/internal/crdReplicator/reflection"%0A 	"github.com/liqotech/liqo/pkg/consts"%0A-	tenantnamespace "github.com/liqotech/liqo/pkg/tenantNamespace"%0A 	"github.com/liqotech/liqo/pkg/liqo-controller-manager/authentication/utils"%0A+	tenantnamespace "github.com/liqotech/liqo/pkg/tenantNamespace"%0A 	"github.com/liqotech/liqo/pkg/utils/events"%0A 	"github.com/liqotech/liqo/pkg/utils/getters"%0A )

@claudiolor claudiolor force-pushed the clo/fix-certificate-renewal branch from c75ae54 to c0503ab Compare February 9, 2026 11:50
This patch changes the certificate renewal flow as the previous one was
broken.
- ResourceSlices: it makes the local ResourceSlice controller manager
  the renew: when the certificate reaches 2/3 of lifetime, it changes
  the CSR so that the CR replicator can propagate the change on the
  remote cluster and make the remoteresourceslice controller handle the
  renewal.
- Tenant: in this case we have a different issue, as the CR replicator
  does not handle the Tenant resource, we make the localrenewer
  controller (which does not handle resource slices anymore) generate a
  Renew resource, propagated on the remote cluster, where the remote
  renewer makes sure to write the CSR into the Tenant resource and let
  handle the Tenant controller the renewal. Once the certificate is
  renewed, the new certificate written in the Renew resource status and
  then in the Identity by the localrenewer controller.
@claudiolor claudiolor force-pushed the clo/fix-certificate-renewal branch from c0503ab to a7451d9 Compare February 9, 2026 12:13
@claudiolor
Copy link
Contributor Author

/build

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fix Fixes a bug in the codebase. size/L

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants