rancher/rke
1
0
Fork 0
mirror of https://github.com/rancher/rke.git synced 2025-09-16 15:10:12 +00:00
Code Issues Releases Wiki Activity

Force deploy certs if etcd cert was changed

Browse Source
This commit is contained in:
Erik Wilson
2019-05-22 16:28:07 -07:00
committed by Alena Prokharchyk
parent f409da01bd
commit e2f7f865ed
1 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
cluster/certificates.go
View File

@@ -17,7 +17,7 @@ import (
func SetUpAuthentication(ctx context.Context, kubeCluster, currentCluster *Cluster, fullState *FullState) error {
if kubeCluster.AuthnStrategies[AuthnX509Provider] {
compareKubeAPICerts(ctx, kubeCluster, currentCluster)
compareCerts(ctx, kubeCluster, currentCluster)
kubeCluster.Certificates = fullState.DesiredState.CertificatesBundle
return nil
}
@@ -225,15 +225,21 @@ func GetClusterCertsFromNodes(ctx context.Context, kubeCluster *Cluster) (map[st
return nil, err
}
func compareKubeAPICerts(ctx context.Context, kubeCluster, currentCluster *Cluster) {
// checking if kubeapi cert got changed then we set force deploy to true
// to force deploying the kubeapi cert with new SANs
func compareCerts(ctx context.Context, kubeCluster, currentCluster *Cluster) {
// check if relevant certs were changed and if so set force deploy to true
// to deploy certs with new SANs
if currentCluster != nil {
currentKubeAPICert := currentCluster.Certificates[pki.KubeAPICertName]
desiredKubeAPICert := kubeCluster.Certificates[pki.KubeAPICertName]
if desiredKubeAPICert.CertificatePEM != currentKubeAPICert.CertificatePEM {
log.Infof(ctx, "[certificates] KubeAPI certificate changed, force deploying certs")
for _, certName := range []string{
pki.KubeAPICertName,
pki.EtcdCertName,
} {
currentCert := currentCluster.Certificates[certName]
desiredCert := kubeCluster.Certificates[certName]
if desiredCert.CertificatePEM != currentCert.CertificatePEM {
log.Infof(ctx, "[certificates] %s certificate changed, force deploying certs", certName)
kubeCluster.ForceDeployCerts = true
return
}
}
}
}