@@ -893,7 +893,13 @@ func (lbc *LoadBalancerController) updateAllConfigs() {
893893 if mgmtErr != nil {
894894 nl .Errorf (lbc .Logger , "configmap %s/%s: %v" , lbc .mgmtConfigMap .GetNamespace (), lbc .mgmtConfigMap .GetName (), mgmtErr )
895895 }
896- // update special license secret in mgmtConfigParams
896+ }
897+
898+ lbc .configurator .CfgParams = cfgParams
899+ lbc .configurator .MgmtCfgParams = mgmtCfgParams
900+
901+ // update special license secret in mgmtConfigParams
902+ if lbc .mgmtConfigMap != nil && lbc .isNginxPlus {
897903 if mgmtCfgParams .Secrets .License != "" {
898904 secret , err := lbc .client .CoreV1 ().Secrets (lbc .mgmtConfigMap .GetNamespace ()).Get (context .TODO (), mgmtCfgParams .Secrets .License , meta_v1.GetOptions {})
899905 if err != nil {
@@ -909,7 +915,7 @@ func (lbc *LoadBalancerController) updateAllConfigs() {
909915 nl .Errorf (lbc .Logger , "secret %s/%s: %v" , lbc .mgmtConfigMap .GetNamespace (), mgmtCfgParams .Secrets .TrustedCert , err )
910916 }
911917 if _ , hasCRL := secret .Data [configs .CACrlKey ]; hasCRL {
912- mgmtCfgParams .Secrets .TrustedCRL = secret .Name
918+ lbc . configurator . MgmtCfgParams .Secrets .TrustedCRL = secret .Name
913919 }
914920 lbc .specialSecrets .trustedCertSecret = fmt .Sprintf ("%s/%s" , secret .Namespace , secret .Name )
915921 lbc .handleSpecialSecretUpdate (secret , reloadNginx )
@@ -924,14 +930,11 @@ func (lbc *LoadBalancerController) updateAllConfigs() {
924930 lbc .handleSpecialSecretUpdate (secret , reloadNginx )
925931 }
926932 }
927-
928933 resources := lbc .configuration .GetResources ()
929-
930934 nl .Debugf (lbc .Logger , "Updating %v resources" , len (resources ))
931-
932935 resourceExes := lbc .createExtendedResources (resources )
936+ warnings , updateErr := lbc .configurator .UpdateConfig (resourceExes )
933937
934- warnings , updateErr := lbc .configurator .UpdateConfig (cfgParams , mgmtCfgParams , resourceExes )
935938 eventTitle := "Updated"
936939 eventType := api_v1 .EventTypeNormal
937940 eventWarningMessage := ""
@@ -1874,7 +1877,7 @@ func (lbc *LoadBalancerController) handleSpecialSecretUpdate(secret *api_v1.Secr
18741877 return
18751878 }
18761879
1877- if ok := lbc .writeSpecialSecrets (secret , secretNsName , specialTLSSecretsToUpdate ); ! ok {
1880+ if ok := lbc .writeSpecialSecrets (secret , specialTLSSecretsToUpdate ); ! ok {
18781881 // if not ok bail early
18791882 return
18801883 }
@@ -1910,7 +1913,12 @@ func (lbc *LoadBalancerController) handleSpecialSecretUpdate(secret *api_v1.Secr
19101913}
19111914
19121915// writeSpecialSecrets generates content and writes the secret to disk
1913- func (lbc * LoadBalancerController ) writeSpecialSecrets (secret * api_v1.Secret , secretNsName string , specialTLSSecretsToUpdate []string ) bool {
1916+ func (lbc * LoadBalancerController ) writeSpecialSecrets (secret * api_v1.Secret , specialTLSSecretsToUpdate []string ) bool {
1917+ secretNsName := generateSecretNSName (secret )
1918+ var mgmtClientAuthNamespaceName string
1919+ if lbc .configurator .MgmtCfgParams != nil {
1920+ mgmtClientAuthNamespaceName = fmt .Sprintf ("%s/%s" , lbc .metadata .pod .Namespace , lbc .configurator .MgmtCfgParams .Secrets .ClientAuth )
1921+ }
19141922 switch secret .Type {
19151923 case secrets .SecretTypeLicense :
19161924 err := lbc .configurator .AddOrUpdateLicenseSecret (secret )
@@ -1922,7 +1930,12 @@ func (lbc *LoadBalancerController) writeSpecialSecrets(secret *api_v1.Secret, se
19221930 case secrets .SecretTypeCA :
19231931 lbc .configurator .AddOrUpdateCASecret (secret , fmt .Sprintf ("mgmt/%s" , configs .CACrtKey ), fmt .Sprintf ("mgmt/%s" , configs .CACrlKey ))
19241932 case api_v1 .SecretTypeTLS :
1925- lbc .configurator .AddOrUpdateSpecialTLSSecrets (secret , specialTLSSecretsToUpdate )
1933+ // if the secret name matches the specified
1934+ if secretNsName == mgmtClientAuthNamespaceName {
1935+ lbc .configurator .AddOrUpdateMGMTClientAuthSecret (secret )
1936+ } else {
1937+ lbc .configurator .AddOrUpdateSpecialTLSSecrets (secret , specialTLSSecretsToUpdate )
1938+ }
19261939 }
19271940 return true
19281941}
@@ -1961,7 +1974,7 @@ func (lbc *LoadBalancerController) specialSecretValidation(secretNsName string,
19611974 }
19621975 }
19631976 if secretNsName == lbc .specialSecrets .clientAuthSecret {
1964- err := lbc . validationTLSSpecialSecret (secret , configs . ClientAuthCertSecretFileName , specialTLSSecretsToUpdate )
1977+ err := secrets . ValidateTLSSecret (secret )
19651978 if err != nil {
19661979 nl .Errorf (lbc .Logger , "Couldn't validate the special Secret %v: %v" , secretNsName , err )
19671980 lbc .recorder .Eventf (lbc .metadata .pod , api_v1 .EventTypeWarning , "Rejected" , "the special Secret %v was rejected, using the previous version: %v" , secretNsName , err )
0 commit comments