rancher/rke
1
0
Fork 0
mirror of https://github.com/rancher/rke.git synced 2025-07-07 12:28:46 +00:00
Code Issues Releases Wiki Activity

Merge pull request #1977 from mrajashree/kube_ca_check

Browse Source 
Validate kube-ca cert before rotating certs
This commit is contained in:
Rajashree Mandaogane 2020-03-19 11:26:12 -07:00 committed by GitHub
commit cd8271c976
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
cmd/cert.go
View File

@ -2,11 +2,10 @@ package cmd
import (
"context"
"crypto/x509"
"fmt"
"time"
"github.com/sirupsen/logrus"
"github.com/rancher/rke/cluster"
"github.com/rancher/rke/hosts"
"github.com/rancher/rke/log"
@ -14,6 +13,7 @@ import (
"github.com/rancher/rke/pki/cert"
"github.com/rancher/rke/services"
v3 "github.com/rancher/types/apis/management.cattle.io/v3"
"github.com/sirupsen/logrus"
"github.com/urfave/cli"
)
@ -236,6 +236,21 @@ func rotateRKECertificates(ctx context.Context, kubeCluster *cluster.Cluster, fl
return nil, fmt.Errorf("Failed to rotate certificates: can't find old certificates")
}
currentCluster.RotateCertificates = kubeCluster.RotateCertificates
if !kubeCluster.RotateCertificates.CACertificates {
caCertPKI, ok := rkeFullState.CurrentState.CertificatesBundle[pki.CACertName]
if !ok {
return nil, fmt.Errorf("Failed to rotate certificates: can't find CA certificate")
}
caCert := caCertPKI.Certificate
if caCert == nil {
return nil, fmt.Errorf("Failed to rotate certificates: CA certificate is nil")
}
certPool := x509.NewCertPool()
certPool.AddCert(caCert)
if _, err := caCert.Verify(x509.VerifyOptions{Roots: certPool, KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}}); err != nil {
return nil, fmt.Errorf("Failed to rotate certificates: CA certificate is invalid, please use the --rotate-ca flag to rotate CA certificate, error: %v", err)
}
}
if err := cluster.RotateRKECertificates(ctx, currentCluster, flags, rkeFullState); err != nil {
return nil, err
}

1
cmd/etcd.go
View File

@ -206,6 +206,7 @@ func validateCerts(state cluster.State) error {
} else {
failedErrs = errors.Wrap(failedErrs, fmt.Sprintf("Certificate [%s] is nil", certPKI.Name))
}
continue
}
certPool := x509.NewCertPool()