Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix certreloader update logic #111

Merged
merged 8 commits into from
Mar 29, 2024
Merged

fix certreloader update logic #111

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
0b89c12
fix certreloader update
t4niwa Mar 22, 2024
a4e5ee2
Merge branch 'main' into fix-certreloader-update
mlajkim Mar 27, 2024
3247f1d
fix conficlit, update
t4niwa Mar 27, 2024
27d3522
update tls-reload
t4niwa Mar 27, 2024
2e1a937
log: small (#112)
mlajkim Mar 27, 2024
7a8d1f2
revert update cert reloader logic
t4niwa Mar 27, 2024
5e873f4
Merge branch 'main' of https://github.com/t4niwa/k8s-athenz-sia into …
t4niwa Mar 27, 2024
a50f2ab
rollback tls-reload
t4niwa Mar 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 16 additions & 10 deletions pkg/certificate/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,9 +192,11 @@ func New(ctx context.Context, idCfg *config.IdentityConfig) (daemon.Daemon, erro
if err != nil {
log.Errorf("Failed to retrieve x509 certificate from identity provider: %s", err.Error())
}
err = idCfg.Reloader.UpdateCertificate([]byte(identity.X509CertificatePEM), keyPEM)
if err != nil {
log.Errorf("Failed to reload x509 certificate from identity provider: %s", err.Error())
if identity != nil && len(keyPEM) != 0 {
errUpdate := idCfg.Reloader.UpdateCertificate([]byte(identity.X509CertificatePEM), keyPEM)
if errUpdate != nil {
log.Errorf("Failed to update x509 certificate into certificate reloader: %s", errUpdate.Error())
}
}
} else if idCfg.KeyFile != "" && idCfg.CertFile != "" {
log.Debug("Attempting to load x509 certificate from cert reloader...")
Expand Down Expand Up @@ -232,10 +234,11 @@ func New(ctx context.Context, idCfg *config.IdentityConfig) (daemon.Daemon, erro
identity = k8sSecretBackupIdentity
keyPEM = k8sSecretBackupKeyPEM
log.Infof("Successfully loaded x509 certificate from kubernetes secret")

err = idCfg.Reloader.UpdateCertificate([]byte(identity.X509CertificatePEM), keyPEM)
if err != nil {
log.Errorf("Failed to reload x509 certificate from identity provider: %s", err.Error())
if identity != nil && len(keyPEM) != 0 {
errUpdate := idCfg.Reloader.UpdateCertificate([]byte(identity.X509CertificatePEM), keyPEM)
if errUpdate != nil {
log.Errorf("Failed to update x509 certificate into certificate reloader: %s", errUpdate.Error())
}
}
}
} else {
Expand All @@ -255,9 +258,12 @@ func New(ctx context.Context, idCfg *config.IdentityConfig) (daemon.Daemon, erro
} else {
identity = forceInitIdentity
keyPEM = forceInitKeyPEM
err = idCfg.Reloader.UpdateCertificate([]byte(identity.X509CertificatePEM), keyPEM)
if err != nil {
log.Errorf("Failed to reload x509 certificate from identity provider: %s", err.Error())

if identity != nil && len(keyPEM) != 0 {
errUpdate := idCfg.Reloader.UpdateCertificate([]byte(identity.X509CertificatePEM), keyPEM)
if errUpdate != nil {
log.Errorf("Failed to update x509 certificate into certificate reloader: %s", errUpdate.Error())
}
}
}
}
Expand Down
2 changes: 1 addition & 1 deletion pkg/token/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ func New(ctx context.Context, idCfg *config.IdentityConfig) (daemon.Daemon, erro
return ts, nil
}
if idCfg.TokenServerAddr == "" || tt == 0 {
log.Infof("Token server is disabled due to insufficient options: address[%s], roles[%s], token-type[%s]", idCfg.TokenServerAddr, idCfg.TargetDomainRoles, idCfg.TokenType)
log.Infof("Token server is disabled due to insufficient options: address[%s], token-type[%s]", idCfg.TokenServerAddr, idCfg.TokenType)
return ts, nil
}
tokenServer := &http.Server{
Expand Down
2 changes: 1 addition & 1 deletion pkg/util/tls-reload.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@ func NewCertReloader(config ReloadConfig) (*CertReloader, error) {
return nil, err
}
// If SIA is not issuing certificates, use pollRefresh function to periodically read certificate files and update cert reloader.
if config.ProviderService == "" {
if config.ProviderService == "" && config.CertFile != "" && config.KeyFile != "" {
mlajkim marked this conversation as resolved.
Show resolved Hide resolved
mlajkim marked this conversation as resolved.
Show resolved Hide resolved
go r.pollRefresh()
}
return r, nil
Expand Down
Loading