rancher/rke
1
0
Fork 0
mirror of https://github.com/rancher/rke.git synced 2025-09-16 15:10:12 +00:00
Code Issues Releases Wiki Activity

Force deploy certs if etcd cert was changed

Browse Source
This commit is contained in:
Erik Wilson
2019-05-22 16:28:07 -07:00
committed by Alena Prokharchyk
parent f409da01bd
commit e2f7f865ed
1 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
cluster/certificates.go
View File

@@ -17,7 +17,7 @@ import (
func SetUpAuthentication(ctx context.Context, kubeCluster, currentCluster *Cluster, fullState *FullState) error { func SetUpAuthentication(ctx context.Context, kubeCluster, currentCluster *Cluster, fullState *FullState) error {
if kubeCluster.AuthnStrategies[AuthnX509Provider] { if kubeCluster.AuthnStrategies[AuthnX509Provider] {
compareKubeAPICerts(ctx, kubeCluster, currentCluster) compareCerts(ctx, kubeCluster, currentCluster)
kubeCluster.Certificates = fullState.DesiredState.CertificatesBundle kubeCluster.Certificates = fullState.DesiredState.CertificatesBundle
return nil return nil
} }
@@ -225,15 +225,21 @@ func GetClusterCertsFromNodes(ctx context.Context, kubeCluster *Cluster) (map[st
return nil, err return nil, err
} }
func compareKubeAPICerts(ctx context.Context, kubeCluster, currentCluster *Cluster) { func compareCerts(ctx context.Context, kubeCluster, currentCluster *Cluster) {
// checking if kubeapi cert got changed then we set force deploy to true // check if relevant certs were changed and if so set force deploy to true
// to force deploying the kubeapi cert with new SANs // to deploy certs with new SANs
if currentCluster != nil { if currentCluster != nil {
currentKubeAPICert := currentCluster.Certificates[pki.KubeAPICertName] for _, certName := range []string{
desiredKubeAPICert := kubeCluster.Certificates[pki.KubeAPICertName] pki.KubeAPICertName,
if desiredKubeAPICert.CertificatePEM != currentKubeAPICert.CertificatePEM { pki.EtcdCertName,
log.Infof(ctx, "[certificates] KubeAPI certificate changed, force deploying certs") } {
kubeCluster.ForceDeployCerts = true currentCert := currentCluster.Certificates[certName]
desiredCert := kubeCluster.Certificates[certName]
if desiredCert.CertificatePEM != currentCert.CertificatePEM {
log.Infof(ctx, "[certificates] %s certificate changed, force deploying certs", certName)
kubeCluster.ForceDeployCerts = true
return
}
} }
} }
} }