Skip to content

Commit 2d60b68

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1812 from vrutkovs/cert-rotation-annotations-cas-devel
OCPBUGS-55217: Optimistically update Kube Server and Client CA bundles
2 parents 3b26613 + 508860f commit 2d60b68

File tree

2 files changed

+702
-19
lines changed

2 files changed

+702
-19
lines changed

‎pkg/operator/targetconfigcontroller/targetconfigcontroller.go‎

Lines changed: 90 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313

1414
"github.com/ghodss/yaml"
1515

16-
"github.com/openshift/api/annotations"
1716
kubecontrolplanev1 "github.com/openshift/api/kubecontrolplane/v1"
1817
operatorv1 "github.com/openshift/api/operator/v1"
1918
"github.com/openshift/cluster-kube-apiserver-operator/bindata"
@@ -24,6 +23,7 @@ import (
2423
"github.com/openshift/library-go/pkg/operator/certrotation"
2524
"github.com/openshift/library-go/pkg/operator/events"
2625
"github.com/openshift/library-go/pkg/operator/resource/resourceapply"
26+
"github.com/openshift/library-go/pkg/operator/resource/resourcehelper"
2727
"github.com/openshift/library-go/pkg/operator/resource/resourcemerge"
2828
"github.com/openshift/library-go/pkg/operator/resource/resourceread"
2929
"github.com/openshift/library-go/pkg/operator/resourcesynccontroller"
@@ -39,6 +39,7 @@ import (
3939
"k8s.io/client-go/kubernetes"
4040
coreclientv1 "k8s.io/client-go/kubernetes/typed/core/v1"
4141
corev1listers "k8s.io/client-go/listers/core/v1"
42+
"k8s.io/klog/v2"
4243
)
4344

4445
const (
@@ -354,12 +355,33 @@ func generateOptionalStartupMonitorPod(isStartupMonitorEnabledFn func() (bool, e
354355
}
355356

356357
func ManageClientCABundle(ctx context.Context, lister corev1listers.ConfigMapLister, client coreclientv1.ConfigMapsGetter, recorder events.Recorder) (*corev1.ConfigMap, bool, error) {
357-
requiredConfigMap, err := resourcesynccontroller.CombineCABundleConfigMaps(
358-
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "client-ca"},
358+
359+
additionalAnnotations := certrotation.AdditionalAnnotations{
360+
JiraComponent: "kube-apiserver",
361+
}
362+
caBundleConfigMapName := "client-ca"
363+
364+
creationRequired := false
365+
updateRequired := false
366+
367+
caBundleConfigMap, err := lister.ConfigMaps(operatorclient.TargetNamespace).Get(caBundleConfigMapName)
368+
switch {
369+
case apierrors.IsNotFound(err):
370+
creationRequired = true
371+
caBundleConfigMap = &corev1.ConfigMap{
372+
ObjectMeta: metav1.ObjectMeta{
373+
Name: caBundleConfigMapName,
374+
Namespace: operatorclient.TargetNamespace,
375+
},
376+
}
377+
case err != nil:
378+
return nil, false, err
379+
}
380+
381+
requiredConfigMap, updateRequired, err := resourcesynccontroller.CombineCABundleConfigMapsOptimistically(
382+
caBundleConfigMap,
359383
lister,
360-
certrotation.AdditionalAnnotations{
361-
JiraComponent: "kube-apiserver",
362-
},
384+
additionalAnnotations,
363385
// this is from the installer and contains the value to verify the admin.kubeconfig user
364386
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.GlobalUserSpecifiedConfigNamespace, Name: "admin-kubeconfig-client-ca"},
365387
// this is from the installer and contains the value to verify the node bootstrapping cert that is baked into images
@@ -379,21 +401,56 @@ func ManageClientCABundle(ctx context.Context, lister corev1listers.ConfigMapLis
379401
if err != nil {
380402
return nil, false, err
381403
}
382-
if requiredConfigMap.Annotations == nil {
383-
requiredConfigMap.Annotations = map[string]string{}
404+
405+
if creationRequired {
406+
caBundleConfigMap, err = client.ConfigMaps(operatorclient.TargetNamespace).Create(ctx, requiredConfigMap, metav1.CreateOptions{})
407+
resourcehelper.ReportCreateEvent(recorder, caBundleConfigMap, err)
408+
if err != nil {
409+
return nil, false, err
410+
}
411+
klog.V(2).Infof("Created client CA bundle configmap %s/%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name)
412+
return caBundleConfigMap, true, nil
413+
} else if updateRequired {
414+
caBundleConfigMap, err = client.ConfigMaps(operatorclient.TargetNamespace).Update(ctx, requiredConfigMap, metav1.UpdateOptions{})
415+
resourcehelper.ReportUpdateEvent(recorder, caBundleConfigMap, err)
416+
if err != nil {
417+
return nil, false, err
418+
}
419+
klog.V(2).Infof("Updated client CA bundle configmap %s/%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name)
420+
return caBundleConfigMap, true, nil
384421
}
385-
requiredConfigMap.Annotations[annotations.OpenShiftComponent] = "kube-apiserver"
386422

387-
return resourceapply.ApplyConfigMap(ctx, client, recorder, requiredConfigMap)
423+
return caBundleConfigMap, false, nil
388424
}
389425

390426
func manageKubeAPIServerCABundle(ctx context.Context, lister corev1listers.ConfigMapLister, client coreclientv1.ConfigMapsGetter, recorder events.Recorder) (*corev1.ConfigMap, bool, error) {
391-
requiredConfigMap, err := resourcesynccontroller.CombineCABundleConfigMaps(
392-
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "kube-apiserver-server-ca"},
427+
428+
additionalAnnotations := certrotation.AdditionalAnnotations{
429+
JiraComponent: "kube-apiserver",
430+
}
431+
caBundleConfigMapName := "kube-apiserver-server-ca"
432+
433+
creationRequired := false
434+
updateRequired := false
435+
436+
caBundleConfigMap, err := lister.ConfigMaps(operatorclient.TargetNamespace).Get(caBundleConfigMapName)
437+
switch {
438+
case apierrors.IsNotFound(err):
439+
creationRequired = true
440+
caBundleConfigMap = &corev1.ConfigMap{
441+
ObjectMeta: metav1.ObjectMeta{
442+
Name: caBundleConfigMapName,
443+
Namespace: operatorclient.TargetNamespace,
444+
},
445+
}
446+
case err != nil:
447+
return nil, false, err
448+
}
449+
450+
requiredConfigMap, updateRequired, err := resourcesynccontroller.CombineCABundleConfigMapsOptimistically(
451+
caBundleConfigMap,
393452
lister,
394-
certrotation.AdditionalAnnotations{
395-
JiraComponent: "kube-apiserver",
396-
},
453+
additionalAnnotations,
397454
// this bundle is what this operator uses to mint loadbalancers certs
398455
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.OperatorNamespace, Name: "loadbalancer-serving-ca"},
399456
// this bundle is what this operator uses to mint localhost certs
@@ -406,12 +463,26 @@ func manageKubeAPIServerCABundle(ctx context.Context, lister corev1listers.Confi
406463
if err != nil {
407464
return nil, false, err
408465
}
409-
if requiredConfigMap.Annotations == nil {
410-
requiredConfigMap.Annotations = map[string]string{}
466+
467+
if creationRequired {
468+
caBundleConfigMap, err := client.ConfigMaps(operatorclient.TargetNamespace).Create(ctx, requiredConfigMap, metav1.CreateOptions{})
469+
resourcehelper.ReportCreateEvent(recorder, caBundleConfigMap, err)
470+
if err != nil {
471+
return nil, false, err
472+
}
473+
klog.V(2).Infof("Created kube apiserver CA bundle configmap %s/%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name)
474+
return caBundleConfigMap, true, nil
475+
} else if updateRequired {
476+
caBundleConfigMap, err := client.ConfigMaps(operatorclient.TargetNamespace).Update(ctx, requiredConfigMap, metav1.UpdateOptions{})
477+
resourcehelper.ReportUpdateEvent(recorder, caBundleConfigMap, err)
478+
if err != nil {
479+
return nil, false, err
480+
}
481+
klog.V(2).Infof("Updated kube apiserver CA bundle configmap %s/%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name)
482+
return caBundleConfigMap, true, nil
411483
}
412-
requiredConfigMap.Annotations[annotations.OpenShiftComponent] = "kube-apiserver"
413484

414-
return resourceapply.ApplyConfigMap(ctx, client, recorder, requiredConfigMap)
485+
return caBundleConfigMap, false, nil
415486
}
416487

417488
func ensureKubeAPIServerTrustedCA(ctx context.Context, client coreclientv1.CoreV1Interface, recorder events.Recorder) error {

0 commit comments

Comments
 (0)