929b1559a0
Close outbound connections when using a cert callback and certificates rotate. This means that we won't get into a situation where we have open TLS connections using expires certs, which would get unauthorized errors at the apiserver Attempt to retrieve a new certificate if open connections near expiry, to prevent the case where the cert expires but we haven't yet opened a new TLS connection and so GetClientCertificate hasn't been called. Move certificate rotation logic to a separate function Rely on generic transport approach to handle closing TLS client connections in exec plugin; no need to use a custom dialer as this is now the default behaviour of the transport when faced with a cert callback. As a result of handling this case, it is now safe to apply the transport approach even in cases where there is a custom Dialer (this will not affect kubelet connrotation behaviour, because that uses a custom transport, not just a dialer). Check expiry of the full TLS certificate chain that will be presented, not only the leaf. Only do this check when the certificate actually rotates. Start the certificate as a zero value, not nil, so that we don't see a rotation when there is in fact no client certificate Drain the timer when we first initialize it, to prevent immediate rotation. Additionally, calling Stop() on the timer isn't necessary. Don't close connections on the first 'rotation' Remove RotateCertFromDisk and RotateClientCertFromDisk flags. Instead simply default to rotating certificates from disk whenever files are exclusively provided. Add integration test for client certificate rotation Simplify logic; rotate every 5 mins Instead of trying to be clever and checking for rotation just before an expiry, let's match the logic of the new apiserver cert rotation logic as much as possible. We write a controller that checks for rotation every 5 mins. We also check on every new connection. Respond to review Fix kubelet certificate rotation logic The kubelet rotation logic seems to be broken because it expects its cert files to end up as cert data whereas in fact they end up as a callback. We should just call the tlsConfig GetCertificate callback as this obtains a current cert even in cases where a static cert is provided, and check that for validity. Later on we can refactor all of the kubelet logic so that all it does is write files to disk, and the cert rotation work does the rest. Only read certificates once a second at most Respond to review 1) Don't blat the cert file names 2) Make it more obvious where we have a neverstop 3) Naming 4) Verbosity Avoid cache busting Use filenames as cache keys when rotation is enabled, and add the rotation later in the creation of the transport. Caller should start the rotating dialer Add continuous request rotation test Rebase: use context in List/Watch Swap goroutine around Retry GETs on net.IsProbableEOF Refactor certRotatingDialer For simplicity, don't affect cert callbacks To reduce change surface, lets not try to handle the case of a changing GetCert callback in this PR. Reverting this commit should be sufficient to handle that case in a later PR. This PR will focus only on rotating certificate and key files. Therefore, we don't need to modify the exec auth plugin. Fix copyright year
58 lines
2.2 KiB
Python
58 lines
2.2 KiB
Python
package(default_visibility = ["//visibility:public"])
|
|
|
|
load(
|
|
"@io_bazel_rules_go//go:def.bzl",
|
|
"go_test",
|
|
)
|
|
|
|
go_test(
|
|
name = "go_default_test",
|
|
size = "large",
|
|
srcs = [
|
|
"cert_rotation_test.go",
|
|
"client_test.go",
|
|
"dynamic_client_test.go",
|
|
"main_test.go",
|
|
],
|
|
rundir = ".",
|
|
tags = ["integration"],
|
|
deps = [
|
|
"//cmd/kube-apiserver/app/testing:go_default_library",
|
|
"//pkg/api/legacyscheme:go_default_library",
|
|
"//staging/src/k8s.io/api/core/v1:go_default_library",
|
|
"//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library",
|
|
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
|
|
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured:go_default_library",
|
|
"//staging/src/k8s.io/apimachinery/pkg/fields:go_default_library",
|
|
"//staging/src/k8s.io/apimachinery/pkg/labels:go_default_library",
|
|
"//staging/src/k8s.io/apimachinery/pkg/runtime:go_default_library",
|
|
"//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
|
|
"//staging/src/k8s.io/apimachinery/pkg/types:go_default_library",
|
|
"//staging/src/k8s.io/apimachinery/pkg/util/wait:go_default_library",
|
|
"//staging/src/k8s.io/apimachinery/pkg/watch:go_default_library",
|
|
"//staging/src/k8s.io/client-go/dynamic:go_default_library",
|
|
"//staging/src/k8s.io/client-go/kubernetes:go_default_library",
|
|
"//staging/src/k8s.io/client-go/kubernetes/scheme:go_default_library",
|
|
"//staging/src/k8s.io/client-go/transport:go_default_library",
|
|
"//staging/src/k8s.io/client-go/util/cert:go_default_library",
|
|
"//staging/src/k8s.io/component-base/version:go_default_library",
|
|
"//test/integration/framework:go_default_library",
|
|
"//test/utils:go_default_library",
|
|
"//test/utils/image:go_default_library",
|
|
"//vendor/github.com/stretchr/testify/assert:go_default_library",
|
|
],
|
|
)
|
|
|
|
filegroup(
|
|
name = "package-srcs",
|
|
srcs = glob(["**"]),
|
|
tags = ["automanaged"],
|
|
visibility = ["//visibility:private"],
|
|
)
|
|
|
|
filegroup(
|
|
name = "all-srcs",
|
|
srcs = [":package-srcs"],
|
|
tags = ["automanaged"],
|
|
)
|