Skip to content

Commit 47fb4aa

Browse files
vrutkovsopenshift-cherrypick-robot
vrutkovs
authored and
openshift-cherrypick-robot
committed
certrotation: ensure that all rotated secrets/configmaps have RefreshOnlyWhenExpired set
This prevents sidecar controllers from reverting metadata updates during cluster upgrade.
1 parent e2ad6c1 commit 47fb4aa

File tree

1 file changed

+67
-53
lines changed

1 file changed

+67
-53
lines changed

‎pkg/operator/certrotationcontroller/certrotationcontroller.go‎

Lines changed: 67 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -173,10 +173,11 @@ func newCertRotationController(
173173
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'operator conditions openshift-apiserver'",
174174
Description: "CA for aggregated apiservers to recognize kube-apiserver as front-proxy.",
175175
},
176-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.GlobalMachineSpecifiedConfigNamespace).Core().V1().ConfigMaps(),
177-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.GlobalMachineSpecifiedConfigNamespace).Core().V1().ConfigMaps().Lister(),
178-
Client: kubeClient.CoreV1(),
179-
EventRecorder: eventRecorder,
176+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
177+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.GlobalMachineSpecifiedConfigNamespace).Core().V1().ConfigMaps(),
178+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.GlobalMachineSpecifiedConfigNamespace).Core().V1().ConfigMaps().Lister(),
179+
Client: kubeClient.CoreV1(),
180+
EventRecorder: eventRecorder,
180181
},
181182
certrotation.RotatedSelfSignedCertKeySecret{
182183
Namespace: operatorclient.TargetNamespace,
@@ -230,10 +231,11 @@ func newCertRotationController(
230231
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'[sig-cli] Kubectl logs logs should be able to retrieve and filter logs [Conformance] [Suite:openshift/conformance/parallel/minimal] [Suite:k8s]'",
231232
Description: "CA for the kubelet to recognize the kube-apiserver client certificate.",
232233
},
233-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
234-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
235-
Client: kubeClient.CoreV1(),
236-
EventRecorder: eventRecorder,
234+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
235+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
236+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
237+
Client: kubeClient.CoreV1(),
238+
EventRecorder: eventRecorder,
237239
},
238240
certrotation.RotatedSelfSignedCertKeySecret{
239241
Namespace: operatorclient.TargetNamespace,
@@ -287,10 +289,11 @@ func newCertRotationController(
287289
JiraComponent: "kube-apiserver",
288290
Description: "CA for recognizing the kube-apiserver when connecting via localhost.",
289291
},
290-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
291-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
292-
Client: kubeClient.CoreV1(),
293-
EventRecorder: eventRecorder,
292+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
293+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
294+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
295+
Client: kubeClient.CoreV1(),
296+
EventRecorder: eventRecorder,
294297
},
295298
certrotation.RotatedSelfSignedCertKeySecret{
296299
Namespace: operatorclient.TargetNamespace,
@@ -344,10 +347,11 @@ func newCertRotationController(
344347
JiraComponent: "kube-apiserver",
345348
Description: "CA for recognizing the kube-apiserver when connecting via the service network (kuberentes.default.svc).",
346349
},
347-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
348-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
349-
Client: kubeClient.CoreV1(),
350-
EventRecorder: eventRecorder,
350+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
351+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
352+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
353+
Client: kubeClient.CoreV1(),
354+
EventRecorder: eventRecorder,
351355
},
352356
certrotation.RotatedSelfSignedCertKeySecret{
353357
Namespace: operatorclient.TargetNamespace,
@@ -402,10 +406,11 @@ func newCertRotationController(
402406
JiraComponent: "kube-apiserver",
403407
Description: "CA for recognizing the kube-apiserver when connecting via the internal or external load balancers.",
404408
},
405-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
406-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
407-
Client: kubeClient.CoreV1(),
408-
EventRecorder: eventRecorder,
409+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
410+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
411+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
412+
Client: kubeClient.CoreV1(),
413+
EventRecorder: eventRecorder,
409414
},
410415
certrotation.RotatedSelfSignedCertKeySecret{
411416
Namespace: operatorclient.TargetNamespace,
@@ -460,10 +465,11 @@ func newCertRotationController(
460465
JiraComponent: "kube-apiserver",
461466
Description: "CA for recognizing the kube-apiserver when connecting via the internal or external load balancers.",
462467
},
463-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
464-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
465-
Client: kubeClient.CoreV1(),
466-
EventRecorder: eventRecorder,
468+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
469+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
470+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
471+
Client: kubeClient.CoreV1(),
472+
EventRecorder: eventRecorder,
467473
},
468474
certrotation.RotatedSelfSignedCertKeySecret{
469475
Namespace: operatorclient.TargetNamespace,
@@ -499,7 +505,8 @@ func newCertRotationController(
499505
JiraComponent: "kube-apiserver",
500506
Description: "Signer used by the kube-apiserver to create serving certificates for the kube-apiserver via the service network.",
501507
},
502-
Validity: foreverPeriod, // this comes from the installer
508+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
509+
Validity: foreverPeriod, // this comes from the installer
503510
// Refresh set to 80% of the validity.
504511
// This range is consistent with most other signers defined in this pkg.
505512
// Given that in this case rotation will be after 8y,
@@ -517,10 +524,11 @@ func newCertRotationController(
517524
JiraComponent: "kube-apiserver",
518525
Description: "CA for recognizing the kube-apiserver when connecting via the localhost recovery SNI ServerName.",
519526
},
520-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
521-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
522-
Client: kubeClient.CoreV1(),
523-
EventRecorder: eventRecorder,
527+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
528+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
529+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
530+
Client: kubeClient.CoreV1(),
531+
EventRecorder: eventRecorder,
524532
},
525533
certrotation.RotatedSelfSignedCertKeySecret{
526534
Namespace: operatorclient.TargetNamespace,
@@ -538,10 +546,11 @@ func newCertRotationController(
538546
CertCreator: &certrotation.ServingRotation{
539547
Hostnames: func() []string { return []string{"localhost-recovery"} },
540548
},
541-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets(),
542-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
543-
Client: kubeClient.CoreV1(),
544-
EventRecorder: eventRecorder,
549+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
550+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets(),
551+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
552+
Client: kubeClient.CoreV1(),
553+
EventRecorder: eventRecorder,
545554
},
546555
eventRecorder,
547556
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
@@ -574,10 +583,11 @@ func newCertRotationController(
574583
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'operator conditions kube-apiserver'",
575584
Description: "CA for kube-apiserver to recognize the kube-controller-manager and kube-scheduler client certificates.",
576585
},
577-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
578-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
579-
Client: kubeClient.CoreV1(),
580-
EventRecorder: eventRecorder,
586+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
587+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
588+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
589+
Client: kubeClient.CoreV1(),
590+
EventRecorder: eventRecorder,
581591
},
582592
certrotation.RotatedSelfSignedCertKeySecret{
583593
Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace,
@@ -629,10 +639,11 @@ func newCertRotationController(
629639
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'operator conditions kube-apiserver'",
630640
Description: "CA for kube-apiserver to recognize the kube-controller-manager and kube-scheduler client certificates.",
631641
},
632-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
633-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
634-
Client: kubeClient.CoreV1(),
635-
EventRecorder: eventRecorder,
642+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
643+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
644+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
645+
Client: kubeClient.CoreV1(),
646+
EventRecorder: eventRecorder,
636647
},
637648
certrotation.RotatedSelfSignedCertKeySecret{
638649
Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace,
@@ -684,10 +695,11 @@ func newCertRotationController(
684695
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'operator conditions kube-apiserver'",
685696
Description: "CA for kube-apiserver to recognize the kube-controller-manager and kube-scheduler client certificates.",
686697
},
687-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
688-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
689-
Client: kubeClient.CoreV1(),
690-
EventRecorder: eventRecorder,
698+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
699+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
700+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
701+
Client: kubeClient.CoreV1(),
702+
EventRecorder: eventRecorder,
691703
},
692704
certrotation.RotatedSelfSignedCertKeySecret{
693705
Namespace: operatorclient.TargetNamespace,
@@ -738,10 +750,11 @@ func newCertRotationController(
738750
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'operator conditions kube-apiserver'",
739751
Description: "CA for kube-apiserver to recognize the kube-controller-manager and kube-scheduler client certificates.",
740752
},
741-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
742-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
743-
Client: kubeClient.CoreV1(),
744-
EventRecorder: eventRecorder,
753+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
754+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
755+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
756+
Client: kubeClient.CoreV1(),
757+
EventRecorder: eventRecorder,
745758
},
746759
certrotation.RotatedSelfSignedCertKeySecret{
747760
Namespace: operatorclient.TargetNamespace,
@@ -795,10 +808,11 @@ func newCertRotationController(
795808
AutoRegenerateAfterOfflineExpiry: "https://github.com/openshift/cluster-kube-apiserver-operator/pull/1631,'operator conditions kube-apiserver'",
796809
Description: "CA for kube-apiserver to recognize local system:masters rendered to each master.",
797810
},
798-
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
799-
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
800-
Client: kubeClient.CoreV1(),
801-
EventRecorder: eventRecorder,
811+
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
812+
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
813+
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
814+
Client: kubeClient.CoreV1(),
815+
EventRecorder: eventRecorder,
802816
},
803817
certrotation.RotatedSelfSignedCertKeySecret{
804818
Namespace: operatorclient.OperatorNamespace,

0 commit comments

Comments
 (0)