Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Give certificates some NotBefore leeway for VMs clocks that lag host clocks #2823

Merged
merged 1 commit into from
May 23, 2018
Merged

Give certificates some NotBefore leeway for VMs clocks that lag host clocks #2823

merged 1 commit into from
May 23, 2018

Conversation

ivan-section-io
Copy link
Contributor

Addresses issue #2749

60 minutes selected anecdotally. I have seen tens of minutes in Host/VMs clock mismatch before - beyond that feels like an edge case.

@k8s-ci-robot
Copy link
Contributor

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@k8s-ci-robot k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels May 19, 2018
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ivan-section-io
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: r2d4

Assign the PR to them by writing /assign @r2d4 in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@minikube-bot
Copy link
Collaborator

Can one of the admins verify this patch?

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels May 19, 2018
@ivan-section-io
Copy link
Contributor Author

/assign @r2d4

dlorenc
dlorenc reviewed May 21, 2018
View reviewed changes
pkg/util/crypto.go Outdated
@@ -44,7 +44,7 @@ func GenerateCACert(certPath, keyPath string, name string) error {
Subject: pkix.Name{
CommonName: name,
},
NotBefore: time.Now(),
NotBefore: time.Now().Add(time.Hour * -1),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! What do you think about doing a whole day here, to help out in the case of timezone issues?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that's likely a great idea (aspect I hadn't considered).
I'll update the PR.

@dlorenc
Copy link
Contributor

dlorenc commented May 21, 2018

@minikube-bot OK to test

@ivan-section-io
Copy link
Contributor Author

@dlorenc I like the 1 day for possible timezone issues.
PR updated & commits squashed

@dlorenc dlorenc merged commit 4bdba1f into kubernetes:master May 23, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dlorenc dlorenc dlorenc approved these changes

Assignees

@r2d4 r2d4

Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@ivan-section-io @k8s-ci-robot @minikube-bot @dlorenc @r2d4