Skip to content

Commit 03d85c4

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1971 from vrutkovs/cert-annotation-update-jun10
OCPBUGS-57049: Update cert annotations
2 parents 79aa96d + 248e356 commit 03d85c4

File tree

3 files changed

+41
-16
lines changed

3 files changed

+41
-16
lines changed

‎pkg/operator/certrotation/annotations.go‎

Lines changed: 31 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,23 +16,30 @@ const (
1616
CertificateIssuer = "auth.openshift.io/certificate-issuer"
1717
// CertificateHostnames contains the hostnames used by a signer.
1818
CertificateHostnames = "auth.openshift.io/certificate-hostnames"
19-
// AutoRegenerateAfterOfflineExpiryAnnotation contains a link to PR and an e2e test name which verifies
19+
// CertificateTestNameAnnotation is an e2e test name which verifies that TLS artifact is created and used correctly
20+
CertificateTestNameAnnotation string = "certificates.openshift.io/test-name"
21+
// CertificateAutoRegenerateAfterOfflineExpiryAnnotation contains a link to PR adding this annotation which verifies
2022
// that TLS artifact is correctly regenerated after it has expired
21-
AutoRegenerateAfterOfflineExpiryAnnotation string = "certificates.openshift.io/auto-regenerate-after-offline-expiry"
23+
CertificateAutoRegenerateAfterOfflineExpiryAnnotation string = "certificates.openshift.io/auto-regenerate-after-offline-expiry"
24+
// CertificateRefreshPeriodAnnotation is the interval at which the certificate should be refreshed.
25+
CertificateRefreshPeriodAnnotation string = "certificates.openshift.io/refresh-period"
2226
)
2327

2428
type AdditionalAnnotations struct {
2529
// JiraComponent annotates tls artifacts so that owner could be easily found
2630
JiraComponent string
2731
// Description is a human-readable one sentence description of certificate purpose
2832
Description string
29-
// AutoRegenerateAfterOfflineExpiry contains a link to PR and an e2e test name which verifies
30-
// that TLS artifact is correctly regenerated after it has expired
33+
// TestName is an e2e test name which verifies that TLS artifact is created and used correctly
34+
TestName string
35+
// AutoRegenerateAfterOfflineExpiry contains a link to PR which adds this annotation on the TLS artifact
3136
AutoRegenerateAfterOfflineExpiry string
3237
// NotBefore contains certificate the certificate creation date in RFC3339 format.
3338
NotBefore string
3439
// NotAfter contains certificate the certificate validity date in RFC3339 format.
3540
NotAfter string
41+
// RefreshPeriod contains the interval at which the certificate should be refreshed.
42+
RefreshPeriod string
3643
}
3744

3845
func (a AdditionalAnnotations) EnsureTLSMetadataUpdate(meta *metav1.ObjectMeta) bool {
@@ -52,20 +59,36 @@ func (a AdditionalAnnotations) EnsureTLSMetadataUpdate(meta *metav1.ObjectMeta)
5259
meta.Annotations[annotations.OpenShiftDescription] = a.Description
5360
modified = true
5461
}
55-
if len(a.AutoRegenerateAfterOfflineExpiry) > 0 && meta.Annotations[AutoRegenerateAfterOfflineExpiryAnnotation] != a.AutoRegenerateAfterOfflineExpiry {
56-
diff := cmp.Diff(meta.Annotations[AutoRegenerateAfterOfflineExpiryAnnotation], a.AutoRegenerateAfterOfflineExpiry)
57-
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", AutoRegenerateAfterOfflineExpiryAnnotation, meta.Namespace, meta.Name, diff)
58-
meta.Annotations[AutoRegenerateAfterOfflineExpiryAnnotation] = a.AutoRegenerateAfterOfflineExpiry
62+
if len(a.TestName) > 0 && meta.Annotations[CertificateTestNameAnnotation] != a.TestName {
63+
diff := cmp.Diff(meta.Annotations[CertificateTestNameAnnotation], a.TestName)
64+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateTestNameAnnotation, meta.Name, meta.Namespace, diff)
65+
meta.Annotations[CertificateTestNameAnnotation] = a.TestName
66+
modified = true
67+
}
68+
if len(a.AutoRegenerateAfterOfflineExpiry) > 0 && meta.Annotations[CertificateAutoRegenerateAfterOfflineExpiryAnnotation] != a.AutoRegenerateAfterOfflineExpiry {
69+
diff := cmp.Diff(meta.Annotations[CertificateAutoRegenerateAfterOfflineExpiryAnnotation], a.AutoRegenerateAfterOfflineExpiry)
70+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateAutoRegenerateAfterOfflineExpiryAnnotation, meta.Namespace, meta.Name, diff)
71+
meta.Annotations[CertificateAutoRegenerateAfterOfflineExpiryAnnotation] = a.AutoRegenerateAfterOfflineExpiry
5972
modified = true
6073
}
6174
if len(a.NotBefore) > 0 && meta.Annotations[CertificateNotBeforeAnnotation] != a.NotBefore {
75+
diff := cmp.Diff(meta.Annotations[CertificateNotBeforeAnnotation], a.NotBefore)
76+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateNotBeforeAnnotation, meta.Name, meta.Namespace, diff)
6277
meta.Annotations[CertificateNotBeforeAnnotation] = a.NotBefore
6378
modified = true
6479
}
6580
if len(a.NotAfter) > 0 && meta.Annotations[CertificateNotAfterAnnotation] != a.NotAfter {
81+
diff := cmp.Diff(meta.Annotations[CertificateNotAfterAnnotation], a.NotAfter)
82+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateNotAfterAnnotation, meta.Name, meta.Namespace, diff)
6683
meta.Annotations[CertificateNotAfterAnnotation] = a.NotAfter
6784
modified = true
6885
}
86+
if len(a.RefreshPeriod) > 0 && meta.Annotations[CertificateRefreshPeriodAnnotation] != a.RefreshPeriod {
87+
diff := cmp.Diff(meta.Annotations[CertificateRefreshPeriodAnnotation], a.RefreshPeriod)
88+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateRefreshPeriodAnnotation, meta.Name, meta.Namespace, diff)
89+
meta.Annotations[CertificateRefreshPeriodAnnotation] = a.RefreshPeriod
90+
modified = true
91+
}
6992
return modified
7093
}
7194

‎pkg/operator/certrotation/signer.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ func (c RotatedSigningCASecret) EnsureSigningCertKeyPair(ctx context.Context) (*
9292
reason = "secret doesn't exist"
9393
}
9494
c.EventRecorder.Eventf("SignerUpdateRequired", "%q in %q requires a new signing cert/key pair: %v", c.Name, c.Namespace, reason)
95-
if err = setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret, c.Validity, c.AdditionalAnnotations); err != nil {
95+
if err = setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret, c.Validity, c.Refresh, c.AdditionalAnnotations); err != nil {
9696
return nil, false, err
9797
}
9898

@@ -201,13 +201,13 @@ func getValidityFromAnnotations(annotations map[string]string) (notBefore time.T
201201

202202
// setSigningCertKeyPairSecretAndTLSAnnotations generates a new signing certificate and key pair,
203203
// stores them in the specified secret, and adds predefined TLS annotations to that secret.
204-
func setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret *corev1.Secret, validity time.Duration, tlsAnnotations AdditionalAnnotations) error {
204+
func setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret *corev1.Secret, validity, refresh time.Duration, tlsAnnotations AdditionalAnnotations) error {
205205
ca, err := setSigningCertKeyPairSecret(signingCertKeyPairSecret, validity)
206206
if err != nil {
207207
return err
208208
}
209209

210-
setTLSAnnotationsOnSigningCertKeyPairSecret(signingCertKeyPairSecret, ca, tlsAnnotations)
210+
setTLSAnnotationsOnSigningCertKeyPairSecret(signingCertKeyPairSecret, ca, refresh, tlsAnnotations)
211211
return nil
212212
}
213213

@@ -243,10 +243,11 @@ func setSigningCertKeyPairSecret(signingCertKeyPairSecret *corev1.Secret, validi
243243
//
244244
// These assumptions are safe because this function is only called after the secret
245245
// has been initialized in setSigningCertKeyPairSecret.
246-
func setTLSAnnotationsOnSigningCertKeyPairSecret(signingCertKeyPairSecret *corev1.Secret, ca *crypto.TLSCertificateConfig, tlsAnnotations AdditionalAnnotations) {
246+
func setTLSAnnotationsOnSigningCertKeyPairSecret(signingCertKeyPairSecret *corev1.Secret, ca *crypto.TLSCertificateConfig, refresh time.Duration, tlsAnnotations AdditionalAnnotations) {
247247
signingCertKeyPairSecret.Annotations[CertificateIssuer] = ca.Certs[0].Issuer.CommonName
248248

249249
tlsAnnotations.NotBefore = ca.Certs[0].NotBefore.Format(time.RFC3339)
250250
tlsAnnotations.NotAfter = ca.Certs[0].NotAfter.Format(time.RFC3339)
251+
tlsAnnotations.RefreshPeriod = refresh.String()
251252
_ = tlsAnnotations.EnsureTLSMetadataUpdate(&signingCertKeyPairSecret.ObjectMeta)
252253
}

‎pkg/operator/certrotation/target.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ func (c RotatedSelfSignedCertKeySecret) EnsureTargetCertKeyPair(ctx context.Cont
121121

122122
if reason := c.CertCreator.NeedNewTargetCertKeyPair(targetCertKeyPairSecret, signingCertKeyPair, caBundleCerts, c.Refresh, c.RefreshOnlyWhenExpired, creationRequired); len(reason) > 0 {
123123
c.EventRecorder.Eventf("TargetUpdateRequired", "%q in %q requires a new target cert/key pair: %v", c.Name, c.Namespace, reason)
124-
if err = setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret, c.Validity, signingCertKeyPair, c.CertCreator, c.AdditionalAnnotations); err != nil {
124+
if err = setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret, c.Validity, c.Refresh, signingCertKeyPair, c.CertCreator, c.AdditionalAnnotations); err != nil {
125125
return nil, err
126126
}
127127

@@ -234,13 +234,13 @@ func needNewTargetCertKeyPairForTime(annotations map[string]string, signer *cryp
234234

235235
// setTargetCertKeyPairSecretAndTLSAnnotations generates a new cert/key pair,
236236
// stores them in the specified secret, and adds predefined TLS annotations to that secret.
237-
func setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret *corev1.Secret, validity time.Duration, signer *crypto.CA, certCreator TargetCertCreator, tlsAnnotations AdditionalAnnotations) error {
237+
func setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret *corev1.Secret, validity, refresh time.Duration, signer *crypto.CA, certCreator TargetCertCreator, tlsAnnotations AdditionalAnnotations) error {
238238
certKeyPair, err := setTargetCertKeyPairSecret(targetCertKeyPairSecret, validity, signer, certCreator)
239239
if err != nil {
240240
return err
241241
}
242242

243-
setTLSAnnotationsOnTargetCertKeyPairSecret(targetCertKeyPairSecret, certKeyPair, certCreator, tlsAnnotations)
243+
setTLSAnnotationsOnTargetCertKeyPairSecret(targetCertKeyPairSecret, certKeyPair, certCreator, refresh, tlsAnnotations)
244244
return nil
245245
}
246246

@@ -277,11 +277,12 @@ func setTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, validity
277277
//
278278
// These assumptions are safe because this function is only called after the secret
279279
// has been initialized in setTargetCertKeyPairSecret.
280-
func setTLSAnnotationsOnTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, certKeyPair *crypto.TLSCertificateConfig, certCreator TargetCertCreator, tlsAnnotations AdditionalAnnotations) {
280+
func setTLSAnnotationsOnTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, certKeyPair *crypto.TLSCertificateConfig, certCreator TargetCertCreator, refresh time.Duration, tlsAnnotations AdditionalAnnotations) {
281281
targetCertKeyPairSecret.Annotations[CertificateIssuer] = certKeyPair.Certs[0].Issuer.CommonName
282282

283283
tlsAnnotations.NotBefore = certKeyPair.Certs[0].NotBefore.Format(time.RFC3339)
284284
tlsAnnotations.NotAfter = certKeyPair.Certs[0].NotAfter.Format(time.RFC3339)
285+
tlsAnnotations.RefreshPeriod = refresh.String()
285286
_ = tlsAnnotations.EnsureTLSMetadataUpdate(&targetCertKeyPairSecret.ObjectMeta)
286287

287288
certCreator.SetAnnotations(certKeyPair, targetCertKeyPairSecret.Annotations)

0 commit comments

Comments
 (0)