fix: front-proxy certs updated by rotate-certs #4467
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jadarsie The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Codecov Report
@@ Coverage Diff @@
## master #4467 +/- ##
========================================
Coverage 72.04% 72.05%
========================================
Files 141 141
Lines 21631 21765 +134
========================================
+ Hits 15584 15682 +98
- Misses 5096 5131 +35
- Partials 951 952 +1
Continue to review full report at Codecov.
|
| @@ -37,6 +37,11 @@ cp_certs() { | |||
|
|
|||
| cp_proxy() { | |||
| source /etc/environment | |||
| local NODE_INDEX | |||
| NODE_INDEX=$(hostname | tail -c 2) | |||
| if [[ $NODE_INDEX == 0 ]]; then | |||
There was a problem hiding this comment.
so the idea is that only one control plane node will update the cert, and we are doing this operation serially so the remaining control plane nodes will perform a successful etcdctl get?
There was a problem hiding this comment.
Correct, it is serial and ordered (master-0 comes first). See the second commit for context/clarification.
| @@ -62,13 +62,13 @@ ETCDCTL_API=3 etcdctl ${ETCDCTL_PARAMS} lock ${PROXY_CERTS_LOCK_NAME} >"${PROXY_ | |||
|
|
|||
| pid=$! | |||
| if read -r lockthis <"${PROXY_CERT_LOCK_FILE}"; then | |||
| if [[ "" == "$(ETCDCTL_API=3 etcdctl ${ETCDCTL_PARAMS} get $ETCD_REQUESTHEADER_CLIENT_CA --print-value-only)" ]]; then | |||
| if [ "${OVERRIDE_PROXY_CERTS}" = "true" ] || [[ "" == "$(ETCDCTL_API=3 etcdctl ${ETCDCTL_PARAMS} get $ETCD_REQUESTHEADER_CLIENT_CA --print-value-only)" ]]; then | |||
There was a problem hiding this comment.
let's use [[ (double brackets) and == (double-equal for equality comparison) to be consistent with the surrounding bash
Reason for Change:
aks-engine rotate-certsis not rotating the front-proxy certs.AKS Engine creates a separate PKI for the front-proxy as part of node bootstrapping process and delivers them to all nodes through etcd. To effectively reuse this functionality,
rotate-certshas to replace the certs stored in etcd.Also, front-proxy certs now expire after 30 years.
Issue Fixed:
Fixes #4463
Credit Where Due:
Does this change contain code from or inspired by another project?
Requirements:
Notes: