Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor(charts/injector): improve upgrade directions for cert reinstallation #125

Merged

Conversation

sheldonhull
Copy link
Contributor

@sheldonhull sheldonhull commented Aug 9, 2024

Related to #124

  • Improve helm chart install and upgrade directions to help with reset of the self signed cert.
  • Add a check for the expiration of the existing cert in the next n days and log this.
  • Align the secret type to tls type.
  • Expose webhookCertExpireDays with a default of 365 days.
  • Chart doesn't try to recreate secret, instead gives kubectl command to do this as hook life cycles aren't a straight forward to do this without errors I can't easily test for.

fixes AB#590946
fixes #124


For more details, open the Copilot Workspace session.

…creation

Related to #124

Add expiration check for self-signed certificates in `charts/dsv-injector/templates/webhook.yaml`.

* Add a new variable `recreateSelfSignedCertThreshold` with a default of 90 days.
* Add a check for the expiration of the existing cert in the next n days.
* Update the logic to generate a new self-signed cert if the existing cert is expiring within `recreateSelfSignedCertThreshold` days.
* Update the secret cert value mapping to use the `$tlsCert` value based on it meeting the expiration check requirement.

Expose `webhookCertExpireDays` and `recreateSelfSignedCertThreshold` in `charts/dsv-injector/values.yaml`.

* Expose `webhookCertExpireDays` with a default of 365 days.
* Add `recreateSelfSignedCertThreshold` with a default of 90 days.

---

For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/DelineaXPM/dsv-k8s/issues/124?shareId=XXXX-XXXX-XXXX-XXXX).
@sheldonhull sheldonhull requested a review from a team as a code owner August 9, 2024 23:09
@sheldonhull sheldonhull requested a review from pacificcode August 9, 2024 23:09
@sheldonhull sheldonhull changed the title refactor(charts/injector): cert expiration detection and automatic recreation refactor(charts/injector): improve upgrade directions for cert reinstallation Aug 12, 2024
@sheldonhull sheldonhull reopened this Aug 12, 2024
@sheldonhull sheldonhull enabled auto-merge August 12, 2024 23:33
@sheldonhull sheldonhull disabled auto-merge August 14, 2024 18:16
@sheldonhull sheldonhull merged commit c809b12 into main Aug 14, 2024
3 checks passed
@sheldonhull sheldonhull deleted the sheldonhull/refactor/helm-chart-cert-expiration-improvements branch August 14, 2024 18:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants