github/dynamiclistener
1
0
Fork 1
mirror of https://github.com/rancher/dynamiclistener.git synced 2025-06-29 08:06:54 +00:00
Code Issues Projects Releases Wiki Activity
165 Commits 21 Branches 45 Tags 2.5 MiB
Go 100%
2ee4a16846
Go to file
Brad Davidson 2ee4a16846
Check certificate fingerprint when deciding if memory store needs to be updated (#180) 
When using a chained store of Kubernetes -> Memory -> File, a file-backed cert with a valid ResourceVersion could not be updated when the Kubernetes store was offline, as the Memory store was skipping the update if the ResourceVersion was not changed.
The Kubernetes store passes through the secret update without a modified ResourceVersion if the Secret controller is not yet available to round-trip the secret through the apiserver, as the apiserver is what handles updating the ResourceVersion when the Secret changes.
In RKE2, this caused a deadlock on startup when the certificate is expired, as the apiserver cannot be started until the cert is updated, but the cert cannot be updated until the apiserver is up.

Fix this by also considering the certificate hash annotation when deciding if the update can be skipped.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 242c2af2db)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-06-11 18:41:32 +00:00
.github Check certificate fingerprint when deciding if memory store needs to be updated (#180) 2025-06-11 18:41:32 +00:00
cert always use CATTLE_NEW_SIGNED_CERT_EXPIRATION_DAYS when generating a certificate 2022-07-20 12:07:31 -07:00
factory Check certificate fingerprint when deciding if memory store needs to be updated (#180) 2025-06-11 18:41:32 +00:00
server Revert change using !errors.Is(...) vs err != ... 2024-08-29 13:54:15 -07:00
storage Check certificate fingerprint when deciding if memory store needs to be updated (#180) 2025-06-11 18:41:32 +00:00
filter.go Add filter helper method 2020-11-09 21:52:17 -07:00
go.mod Bump dependencies to support k8s v1.32 (#158) 2025-02-11 14:54:43 -05:00
go.sum Bump dependencies to support k8s v1.32 (#158) 2025-02-11 14:54:43 -05:00
LICENSE Initial Commit 2019-05-09 12:36:03 -07:00
listener_test.go Tests for Marking additional connections as ready 2022-10-19 12:32:07 -07:00
listener.go Use more Verbose name for Listener 2023-07-14 08:28:47 +02:00
README.md Implement versioning ADR (#124) 2024-11-15 09:36:48 -05:00
redirect.go Fix acme listener 2020-02-07 14:20:45 -07:00
tcp.go Refactor to not include a server by default 2019-10-30 19:14:34 -07:00
VERSION.md Update VERSION.md to include wrangler version (#159) 2025-04-23 17:11:44 -07:00

README.md

dynamiclistener

DynamicListener allows you to setup a server with automatically generated (and re-generated) TLS certs with kubernetes secrets integration.

This README is a work in progress; aimed towards providing information for navigating the contents of this repository.

Changing the Expiration Days for Newly Signed Certificates

By default, a newly signed certificate is set to expire 365 days (1 year) after its creation time and date. You can use the CATTLE_NEW_SIGNED_CERT_EXPIRATION_DAYS environment variable to change this value.

Please note: the value for the aforementioned variable must be a string representing an unsigned integer corresponding to the number of days until expiration (i.e. X509 "NotAfter" value).

Versioning

See VERSION.md.