github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 13:37:30 +00:00
Code Issues Projects Releases Wiki Activity

Make certificate approve/deny no-op if CSR is already approved

Browse Source 
Approval for CSRs is only needed once. If the CSR is already approved or
denied we can skip updating it. Add a `--force` flag that allows the
existing behavior for when a user has a specific need to update the CSR.

This is backwards compatible with the intended use of the conditions,
although it's possible some users are depending on the status being
updated. It makes bulk approval as an admin much faster for scripting.
This commit is contained in:
Clayton Coleman 2018-03-31 00:05:06 -04:00
parent 9847c8ee0a
commit c7b37767ba
No known key found for this signature in database
GPG Key ID: 3D16906B4F1C5CB3
1 changed files with 21 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
pkg/kubectl/cmd/certificates.go
View File

@ -87,17 +87,18 @@ func NewCmdCertificateApprove(f cmdutil.Factory, out io.Writer) *cobra.Command {
Run: func(cmd *cobra.Command, args []string) { Run: func(cmd *cobra.Command, args []string) {
cmdutil.CheckErr(options.Complete(cmd, args)) cmdutil.CheckErr(options.Complete(cmd, args))
cmdutil.CheckErr(options.Validate()) cmdutil.CheckErr(options.Validate())
cmdutil.CheckErr(options.RunCertificateApprove(f, out)) cmdutil.CheckErr(options.RunCertificateApprove(f, out, cmdutil.GetFlagBool(cmd, "force")))
}, },
} }
cmd.Flags().Bool("force", false, "Update the CSR even if it is already approved.")
cmdutil.AddOutputFlagsForMutation(cmd) cmdutil.AddOutputFlagsForMutation(cmd)
cmdutil.AddFilenameOptionFlags(cmd, &options.FilenameOptions, "identifying the resource to update") cmdutil.AddFilenameOptionFlags(cmd, &options.FilenameOptions, "identifying the resource to update")
return cmd return cmd
} }
func (options *CertificateOptions) RunCertificateApprove(f cmdutil.Factory, out io.Writer) error { func (options *CertificateOptions) RunCertificateApprove(f cmdutil.Factory, out io.Writer, force bool) error {
return options.modifyCertificateCondition(f, out, func(csr *certificates.CertificateSigningRequest) (*certificates.CertificateSigningRequest, string) { return options.modifyCertificateCondition(f, out, force, func(csr *certificates.CertificateSigningRequest) (*certificates.CertificateSigningRequest, bool, string) {
var alreadyApproved bool var alreadyApproved bool
for _, c := range csr.Status.Conditions { for _, c := range csr.Status.Conditions {
if c.Type == certificates.CertificateApproved { if c.Type == certificates.CertificateApproved {
@ -105,7 +106,7 @@ func (options *CertificateOptions) RunCertificateApprove(f cmdutil.Factory, out
} }
} }
if alreadyApproved { if alreadyApproved {
return csr, "approved" return csr, true, "approved"
} }
csr.Status.Conditions = append(csr.Status.Conditions, certificates.CertificateSigningRequestCondition{ csr.Status.Conditions = append(csr.Status.Conditions, certificates.CertificateSigningRequestCondition{
Type: certificates.CertificateApproved, Type: certificates.CertificateApproved,
@ -113,7 +114,7 @@ func (options *CertificateOptions) RunCertificateApprove(f cmdutil.Factory, out
Message: "This CSR was approved by kubectl certificate approve.", Message: "This CSR was approved by kubectl certificate approve.",
LastUpdateTime: metav1.Now(), LastUpdateTime: metav1.Now(),
}) })
return csr, "approved" return csr, false, "approved"
}) })
} }
@ -133,17 +134,18 @@ func NewCmdCertificateDeny(f cmdutil.Factory, out io.Writer) *cobra.Command {
Run: func(cmd *cobra.Command, args []string) { Run: func(cmd *cobra.Command, args []string) {
cmdutil.CheckErr(options.Complete(cmd, args)) cmdutil.CheckErr(options.Complete(cmd, args))
cmdutil.CheckErr(options.Validate()) cmdutil.CheckErr(options.Validate())
cmdutil.CheckErr(options.RunCertificateDeny(f, out)) cmdutil.CheckErr(options.RunCertificateDeny(f, out, cmdutil.GetFlagBool(cmd, "force")))
}, },
} }
cmd.Flags().Bool("force", false, "Update the CSR even if it is already denied.")
cmdutil.AddOutputFlagsForMutation(cmd) cmdutil.AddOutputFlagsForMutation(cmd)
cmdutil.AddFilenameOptionFlags(cmd, &options.FilenameOptions, "identifying the resource to update") cmdutil.AddFilenameOptionFlags(cmd, &options.FilenameOptions, "identifying the resource to update")
return cmd return cmd
} }
func (options *CertificateOptions) RunCertificateDeny(f cmdutil.Factory, out io.Writer) error { func (options *CertificateOptions) RunCertificateDeny(f cmdutil.Factory, out io.Writer, force bool) error {
return options.modifyCertificateCondition(f, out, func(csr *certificates.CertificateSigningRequest) (*certificates.CertificateSigningRequest, string) { return options.modifyCertificateCondition(f, out, force, func(csr *certificates.CertificateSigningRequest) (*certificates.CertificateSigningRequest, bool, string) {
var alreadyDenied bool var alreadyDenied bool
for _, c := range csr.Status.Conditions { for _, c := range csr.Status.Conditions {
if c.Type == certificates.CertificateDenied { if c.Type == certificates.CertificateDenied {
@ -151,7 +153,7 @@ func (options *CertificateOptions) RunCertificateDeny(f cmdutil.Factory, out io.
} }
} }
if alreadyDenied { if alreadyDenied {
return csr, "denied" return csr, true, "denied"
} }
csr.Status.Conditions = append(csr.Status.Conditions, certificates.CertificateSigningRequestCondition{ csr.Status.Conditions = append(csr.Status.Conditions, certificates.CertificateSigningRequestCondition{
Type: certificates.CertificateDenied, Type: certificates.CertificateDenied,
@ -159,11 +161,11 @@ func (options *CertificateOptions) RunCertificateDeny(f cmdutil.Factory, out io.
Message: "This CSR was approved by kubectl certificate deny.", Message: "This CSR was approved by kubectl certificate deny.",
LastUpdateTime: metav1.Now(), LastUpdateTime: metav1.Now(),
}) })
return csr, "denied" return csr, false, "denied"
}) })
} }
func (options *CertificateOptions) modifyCertificateCondition(f cmdutil.Factory, out io.Writer, modify func(csr *certificates.CertificateSigningRequest) (*certificates.CertificateSigningRequest, string)) error { func (options *CertificateOptions) modifyCertificateCondition(f cmdutil.Factory, out io.Writer, force bool, modify func(csr *certificates.CertificateSigningRequest) (*certificates.CertificateSigningRequest, bool, string)) error {
var found int var found int
c, err := f.ClientSet() c, err := f.ClientSet()
if err != nil { if err != nil {
@ -183,12 +185,14 @@ func (options *CertificateOptions) modifyCertificateCondition(f cmdutil.Factory,
return err return err
} }
csr := info.Object.(*certificates.CertificateSigningRequest) csr := info.Object.(*certificates.CertificateSigningRequest)
csr, verb := modify(csr) csr, hasCondition, verb := modify(csr)
csr, err = c.Certificates(). if !hasCondition || force {
CertificateSigningRequests(). csr, err = c.Certificates().
UpdateApproval(csr) CertificateSigningRequests().
if err != nil { UpdateApproval(csr)
return err if err != nil {
return err
}
} }
found++ found++
cmdutil.PrintSuccess(options.outputStyle == "name", out, info.Object, false, verb) cmdutil.PrintSuccess(options.outputStyle == "name", out, info.Object, false, verb)