Skip to content

Commit

Permalink
certrotationcontroller: use minutes instead of days when FeatureShort…
Browse files Browse the repository at this point in the history 
…CertRotation is enabled
  • Loading branch information
@vrutkovs
vrutkovs committed Nov 15, 2024
1 parent a2df7f4 commit dcb8d99
Show file tree
Hide file tree
Showing 3 changed files with 44 additions and 33 deletions.
29 changes: 22 additions & 7 deletions pkg/cmd/recoverycontroller/cmd.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,19 @@ package recoverycontroller
import (
"context"
"fmt"
"time"

operatorv1 "github.com/openshift/api/operator/v1"
configeversionedclient "github.com/openshift/client-go/config/clientset/versioned"
configexternalinformers "github.com/openshift/client-go/config/informers/externalversions"
"github.com/openshift/cluster-kube-controller-manager-operator/pkg/operator"
"github.com/openshift/cluster-kube-controller-manager-operator/pkg/operator/certrotationcontroller"
"github.com/openshift/cluster-kube-controller-manager-operator/pkg/operator/operatorclient"
"github.com/openshift/cluster-kube-controller-manager-operator/pkg/version"
"github.com/openshift/library-go/pkg/controller/controllercmd"
"github.com/openshift/library-go/pkg/operator/certrotation"
"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
"github.com/openshift/library-go/pkg/operator/genericoperatorclient"
"github.com/openshift/library-go/pkg/operator/status"
"github.com/openshift/library-go/pkg/operator/v1helpers"
"github.com/spf13/cobra"
"k8s.io/client-go/kubernetes"
Expand Down Expand Up @@ -91,21 +95,28 @@ func (o *Options) Run(ctx context.Context) error {
return err
}

certRotationScale, err := certrotation.GetCertRotationScale(ctx, kubeClient, operatorclient.GlobalUserSpecifiedConfigNamespace)
configClient, err := configeversionedclient.NewForConfig(o.controllerContext.KubeConfig)
if err != nil {
return err
return fmt.Errorf("failed to create config client: %w", err)
}
configInformers := configexternalinformers.NewSharedInformerFactory(configClient, 10*time.Minute)
desiredVersion := status.VersionForOperatorFromEnv()
missingVersion := "0.0.1-snapshot"
featureGateAccessor := featuregates.NewFeatureGateAccess(
desiredVersion, missingVersion,
configInformers.Config().V1().ClusterVersions(), configInformers.Config().V1().FeatureGates(),
o.controllerContext.EventRecorder,
)
go featureGateAccessor.Run(ctx)
go configInformers.Start(ctx.Done())

certRotationController, err := certrotationcontroller.NewCertRotationControllerOnlyWhenExpired(
v1helpers.CachedSecretGetter(kubeClient.CoreV1(), kubeInformersForNamespaces),
v1helpers.CachedConfigMapGetter(kubeClient.CoreV1(), kubeInformersForNamespaces),
operatorClient,
kubeInformersForNamespaces,
o.controllerContext.EventRecorder,
// this is weird, but when we turn down rotation in CI, we go fast enough that kubelets and kas are racing to observe the new signer before the signer is used.
// we need to establish some kind of delay or back pressure to prevent the rollout. This ensures we don't trigger kas restart
// during e2e tests for now.
certRotationScale*8,
featureGateAccessor,
)
if err != nil {
return err
Expand Down Expand Up @@ -134,6 +145,10 @@ func (o *Options) Run(ctx context.Context) error {
csrController.Run(ctx)
}()

go func() {
featureGateAccessor.Run(ctx)
}()

<-ctx.Done()

return nil
Expand Down
37 changes: 21 additions & 16 deletions pkg/operator/certrotationcontroller/certrotationcontroller.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,18 +2,19 @@ package certrotationcontroller

import (
"context"
"fmt"
"time"

"k8s.io/klog/v2"

corev1client "k8s.io/client-go/kubernetes/typed/core/v1"

"github.com/openshift/library-go/pkg/operator/certrotation"
"github.com/openshift/library-go/pkg/operator/events"
"github.com/openshift/library-go/pkg/operator/v1helpers"

features "github.com/openshift/api/features"
"github.com/openshift/cluster-kube-controller-manager-operator/pkg/operator/operatorclient"
"github.com/openshift/library-go/pkg/controller/factory"
"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
)

// defaultRotationDay is the default rotation base for all cert rotation operations.
Expand All @@ -29,15 +30,15 @@ func NewCertRotationController(
operatorClient v1helpers.StaticPodOperatorClient,
kubeInformersForNamespaces v1helpers.KubeInformersForNamespaces,
eventRecorder events.Recorder,
day time.Duration,
featureGateAccessor featuregates.FeatureGateAccess,
) (*CertRotationController, error) {
return newCertRotationController(
secretsGetter,
configMapsGetter,
operatorClient,
kubeInformersForNamespaces,
eventRecorder,
day,
featureGateAccessor,
false,
)
}
Expand All @@ -48,15 +49,15 @@ func NewCertRotationControllerOnlyWhenExpired(
operatorClient v1helpers.StaticPodOperatorClient,
kubeInformersForNamespaces v1helpers.KubeInformersForNamespaces,
eventRecorder events.Recorder,
day time.Duration,
featureGateAccessor featuregates.FeatureGateAccess,
) (*CertRotationController, error) {
return newCertRotationController(
secretsGetter,
configMapsGetter,
operatorClient,
kubeInformersForNamespaces,
eventRecorder,
day,
featureGateAccessor,
true,
)
}
Expand All @@ -67,16 +68,20 @@ func newCertRotationController(
operatorClient v1helpers.StaticPodOperatorClient,
kubeInformersForNamespaces v1helpers.KubeInformersForNamespaces,
eventRecorder events.Recorder,
day time.Duration,
featureGateAccessor featuregates.FeatureGateAccess,
refreshOnlyWhenExpired bool,
) (*CertRotationController, error) {
ret := &CertRotationController{}

rotationDay := defaultRotationDay
if day != time.Duration(0) {
rotationDay = day
klog.Warningf("!!! UNSUPPORTED VALUE SET !!!")
klog.Warningf("Certificate rotation base set to %q", rotationDay)
monthPeriod := time.Hour * 24 * 30

featureGates, err := featureGateAccessor.CurrentFeatureGates()
if err != nil {
return nil, fmt.Errorf("unable to get FeatureGates: %w", err)
}

if featureGates.Enabled(features.FeatureShortCertRotation) {
monthPeriod = time.Hour
}

certRotator := certrotation.NewCertRotationController(
Expand All @@ -88,8 +93,8 @@ func newCertRotationController(
AdditionalAnnotations: certrotation.AdditionalAnnotations{
JiraComponent: "kube-controller-manager",
},
Validity: 60 * rotationDay,
Refresh: 30 * rotationDay,
Validity: monthPeriod,
Refresh: monthPeriod / 2,
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets(),
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Expand All @@ -113,8 +118,8 @@ func newCertRotationController(
AdditionalAnnotations: certrotation.AdditionalAnnotations{
JiraComponent: "kube-controller-manager",
},
Validity: 30 * rotationDay,
Refresh: 15 * rotationDay,
Validity: monthPeriod,
Refresh: monthPeriod / 2,
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
CertCreator: &certrotation.SignerRotation{
SignerName: "kube-csr-signer",
Expand Down
11 changes: 1 addition & 10 deletions pkg/operator/starter.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@ import (
"github.com/openshift/cluster-kube-controller-manager-operator/pkg/operator/resourcesynccontroller"
"github.com/openshift/cluster-kube-controller-manager-operator/pkg/operator/targetconfigcontroller"
"github.com/openshift/library-go/pkg/controller/controllercmd"
"github.com/openshift/library-go/pkg/operator/certrotation"
"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
"github.com/openshift/library-go/pkg/operator/genericoperatorclient"
"github.com/openshift/library-go/pkg/operator/latencyprofilecontroller"
Expand Down Expand Up @@ -260,21 +259,13 @@ func RunOperator(ctx context.Context, cc *controllercmd.ControllerContext) error
cc.EventRecorder,
)

certRotationScale, err := certrotation.GetCertRotationScale(ctx, kubeClient, operatorclient.GlobalUserSpecifiedConfigNamespace)
if err != nil {
return err
}

certRotationController, err := certrotationcontroller.NewCertRotationController(
v1helpers.CachedSecretGetter(kubeClient.CoreV1(), kubeInformersForNamespaces),
v1helpers.CachedConfigMapGetter(kubeClient.CoreV1(), kubeInformersForNamespaces),
operatorClient,
kubeInformersForNamespaces,
cc.EventRecorder,
// this is weird, but when we turn down rotation in CI, we go fast enough that kubelets and kas are racing to observe the new signer before the signer is used.
// we need to establish some kind of delay or back pressure to prevent the rollout. This ensures we don't trigger kas restart
// during e2e tests for now.
certRotationScale*8,
featureGateAccessor,
)
if err != nil {
return err
Expand Down

0 comments on commit dcb8d99

Please sign in to comment.