Skip to content

Commit c6a4211

Browse files
vrutkovsvrutkovs
committed
certrotation: ensure that all rotated secrets/configmaps have RefreshOnlyWhenExpired set
This prevents sidecar controllers from reverting metadata updates during cluster upgrade.
1 parent 0c2dfc0 commit c6a4211

File tree

1 file changed

+67
-53
lines changed

1 file changed

+67
-53
lines changed

‎pkg/operator/certrotationcontroller/certrotationcontroller.go‎

Lines changed: 67 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -176,10 +176,11 @@ func newCertRotationController(
176176
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[sig-cli] oc adm new-project [apigroup:project.openshift.io][apigroup:authorization.openshift.io] [Suite:openshift/conformance/parallel]'",
177177
Description: "CA for aggregated apiservers to recognize kube-apiserver as front-proxy.",
178178
},
179-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.GlobalMachineSpecifiedConfigNamespace).Core().V1().ConfigMaps(),
180-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.GlobalMachineSpecifiedConfigNamespace).Core().V1().ConfigMaps().Lister(),
181-
Client: kubeClient.CoreV1(),
182-
EventRecorder: eventRecorder,
179+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
180+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.GlobalMachineSpecifiedConfigNamespace).Core().V1().ConfigMaps(),
181+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.GlobalMachineSpecifiedConfigNamespace).Core().V1().ConfigMaps().Lister(),
182+
Client: kubeClient.CoreV1(),
183+
EventRecorder: eventRecorder,
183184
},
184185
certrotation.RotatedSelfSignedCertKeySecret{
185186
Namespace: operatorclient.TargetNamespace,
@@ -233,10 +234,11 @@ func newCertRotationController(
233234
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[sig-cli] Kubectl logs logs should be able to retrieve and filter logs [Conformance] [Suite:openshift/conformance/parallel/minimal] [Suite:k8s]'",
234235
Description: "CA for the kubelet to recognize the kube-apiserver client certificate.",
235236
},
236-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
237-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
238-
Client: kubeClient.CoreV1(),
239-
EventRecorder: eventRecorder,
237+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
238+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
239+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
240+
Client: kubeClient.CoreV1(),
241+
EventRecorder: eventRecorder,
240242
},
241243
certrotation.RotatedSelfSignedCertKeySecret{
242244
Namespace: operatorclient.TargetNamespace,
@@ -296,10 +298,11 @@ func newCertRotationController(
296298
// other signers are updated and needs to have the same metadata set
297299
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[Conformance][sig-api-machinery][Feature:APIServer] local kubeconfig \"localhost.kubeconfig\" should be present on all masters and work [apigroup:config.openshift.io] [Suite:openshift/conformance/parallel/minimal]'",
298300
},
299-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
300-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
301-
Client: kubeClient.CoreV1(),
302-
EventRecorder: eventRecorder,
301+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
302+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
303+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
304+
Client: kubeClient.CoreV1(),
305+
EventRecorder: eventRecorder,
303306
},
304307
certrotation.RotatedSelfSignedCertKeySecret{
305308
Namespace: operatorclient.TargetNamespace,
@@ -359,10 +362,11 @@ func newCertRotationController(
359362
// other signers are updated and needs to have the same metadata set
360363
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[Conformance][sig-api-machinery][Feature:APIServer] kube-apiserver should be accessible via service network endpoint [Suite:openshift/conformance/parallel/minimal]'",
361364
},
362-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
363-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
364-
Client: kubeClient.CoreV1(),
365-
EventRecorder: eventRecorder,
365+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
366+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
367+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
368+
Client: kubeClient.CoreV1(),
369+
EventRecorder: eventRecorder,
366370
},
367371
certrotation.RotatedSelfSignedCertKeySecret{
368372
Namespace: operatorclient.TargetNamespace,
@@ -423,10 +427,11 @@ func newCertRotationController(
423427
// other signers are updated and needs to have the same metadata set
424428
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[Conformance][sig-api-machinery][Feature:APIServer] kube-apiserver should be accessible via api-int endpoint [Suite:openshift/conformance/parallel/minimal]'",
425429
},
426-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
427-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
428-
Client: kubeClient.CoreV1(),
429-
EventRecorder: eventRecorder,
430+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
431+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
432+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
433+
Client: kubeClient.CoreV1(),
434+
EventRecorder: eventRecorder,
430435
},
431436
certrotation.RotatedSelfSignedCertKeySecret{
432437
Namespace: operatorclient.TargetNamespace,
@@ -487,10 +492,11 @@ func newCertRotationController(
487492
// other signers are updated and needs to have the same metadata set
488493
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[Conformance][sig-api-machinery][Feature:APIServer] kube-apiserver should be accessible via api-int endpoint [Suite:openshift/conformance/parallel/minimal]'",
489494
},
490-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
491-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
492-
Client: kubeClient.CoreV1(),
493-
EventRecorder: eventRecorder,
495+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
496+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
497+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
498+
Client: kubeClient.CoreV1(),
499+
EventRecorder: eventRecorder,
494500
},
495501
certrotation.RotatedSelfSignedCertKeySecret{
496502
Namespace: operatorclient.TargetNamespace,
@@ -529,7 +535,8 @@ func newCertRotationController(
529535
// other signers are updated and needs to have the same metadata set
530536
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[Conformance][sig-api-machinery][Feature:APIServer] local kubeconfig \"localhost-recovery.kubeconfig\" should be present on all masters and work [apigroup:config.openshift.io] [Suite:openshift/conformance/parallel/minimal]'",
531537
},
532-
Validity: foreverPeriod, // this comes from the installer
538+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
539+
Validity: foreverPeriod, // this comes from the installer
533540
// Refresh set to 80% of the validity.
534541
// This range is consistent with most other signers defined in this pkg.
535542
// Given that in this case rotation will be after 8y,
@@ -550,10 +557,11 @@ func newCertRotationController(
550557
// other signers are updated and needs to have the same metadata set
551558
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[Conformance][sig-api-machinery][Feature:APIServer] local kubeconfig \"localhost-recovery.kubeconfig\" should be present on all masters and work [apigroup:config.openshift.io] [Suite:openshift/conformance/parallel/minimal]'",
552559
},
553-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
554-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
555-
Client: kubeClient.CoreV1(),
556-
EventRecorder: eventRecorder,
560+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
561+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
562+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
563+
Client: kubeClient.CoreV1(),
564+
EventRecorder: eventRecorder,
557565
},
558566
certrotation.RotatedSelfSignedCertKeySecret{
559567
Namespace: operatorclient.TargetNamespace,
@@ -573,10 +581,11 @@ func newCertRotationController(
573581
CertCreator: &certrotation.ServingRotation{
574582
Hostnames: func() []string { return []string{"localhost-recovery"} },
575583
},
576-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets(),
577-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
578-
Client: kubeClient.CoreV1(),
579-
EventRecorder: eventRecorder,
584+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
585+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets(),
586+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
587+
Client: kubeClient.CoreV1(),
588+
EventRecorder: eventRecorder,
580589
},
581590
eventRecorder,
582591
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
@@ -609,10 +618,11 @@ func newCertRotationController(
609618
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[sig-apps] Deployment RollingUpdateDeployment should delete old pods and create new ones [Conformance] [Suite:openshift/conformance/parallel/minimal] [Suite:k8s]'",
610619
Description: "CA for kube-apiserver to recognize the kube-controller-manager and kube-scheduler client certificates.",
611620
},
612-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
613-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
614-
Client: kubeClient.CoreV1(),
615-
EventRecorder: eventRecorder,
621+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
622+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
623+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
624+
Client: kubeClient.CoreV1(),
625+
EventRecorder: eventRecorder,
616626
},
617627
certrotation.RotatedSelfSignedCertKeySecret{
618628
Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace,
@@ -664,10 +674,11 @@ func newCertRotationController(
664674
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[sig-apps] Deployment RollingUpdateDeployment should delete old pods and create new ones [Conformance] [Suite:openshift/conformance/parallel/minimal] [Suite:k8s]'",
665675
Description: "CA for kube-apiserver to recognize the kube-controller-manager and kube-scheduler client certificates.",
666676
},
667-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
668-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
669-
Client: kubeClient.CoreV1(),
670-
EventRecorder: eventRecorder,
677+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
678+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
679+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
680+
Client: kubeClient.CoreV1(),
681+
EventRecorder: eventRecorder,
671682
},
672683
certrotation.RotatedSelfSignedCertKeySecret{
673684
Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace,
@@ -719,10 +730,11 @@ func newCertRotationController(
719730
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[sig-apps] Deployment RollingUpdateDeployment should delete old pods and create new ones [Conformance] [Suite:openshift/conformance/parallel/minimal] [Suite:k8s]'",
720731
Description: "CA for kube-apiserver to recognize the kube-controller-manager and kube-scheduler client certificates.",
721732
},
722-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
723-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
724-
Client: kubeClient.CoreV1(),
725-
EventRecorder: eventRecorder,
733+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
734+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
735+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
736+
Client: kubeClient.CoreV1(),
737+
EventRecorder: eventRecorder,
726738
},
727739
certrotation.RotatedSelfSignedCertKeySecret{
728740
Namespace: operatorclient.TargetNamespace,
@@ -773,10 +785,11 @@ func newCertRotationController(
773785
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[sig-apps] Deployment RollingUpdateDeployment should delete old pods and create new ones [Conformance] [Suite:openshift/conformance/parallel/minimal] [Suite:k8s]'",
774786
Description: "CA for kube-apiserver to recognize the kube-controller-manager and kube-scheduler client certificates.",
775787
},
776-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
777-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
778-
Client: kubeClient.CoreV1(),
779-
EventRecorder: eventRecorder,
788+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
789+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
790+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
791+
Client: kubeClient.CoreV1(),
792+
EventRecorder: eventRecorder,
780793
},
781794
certrotation.RotatedSelfSignedCertKeySecret{
782795
Namespace: operatorclient.TargetNamespace,
@@ -830,10 +843,11 @@ func newCertRotationController(
830843
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[Conformance][sig-api-machinery][Feature:APIServer] local kubeconfig \"localhost-recovery.kubeconfig\" should be present on all masters and work [apigroup:config.openshift.io] [Suite:openshift/conformance/parallel/minimal]'",
831844
Description: "CA for kube-apiserver to recognize local system:masters rendered to each master.",
832845
},
833-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
834-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
835-
Client: kubeClient.CoreV1(),
836-
EventRecorder: eventRecorder,
846+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
847+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
848+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
849+
Client: kubeClient.CoreV1(),
850+
EventRecorder: eventRecorder,
837851
},
838852
certrotation.RotatedSelfSignedCertKeySecret{
839853
Namespace: operatorclient.OperatorNamespace,

0 commit comments

Comments
 (0)