Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix get csrSignerName from env MINIO_OPERATOR_CSR_SIGNER_NAME #2005

Merged
merged 3 commits into from
Mar 1, 2024

Conversation

jiuker
Copy link
Contributor

@jiuker jiuker commented Feb 29, 2024

fix #1985
we should keep csrSingerName from env.

@pjuarezd
Copy link
Member

may I suggest getDefaultCsrSignerName only returns a value if the env variable is set:

func getDefaultCsrSignerName() string {
         defaultCsrSignerNameOnce.Do(func() {
		if os.Getenv(CSRSignerName) != "" {
			defaultCsrSignerName = os.Getenv(CSRSignerName)
			return
		}
		defaultCsrSignerName = ""
	})
	return defaultCsrSignerName
}

If variable is set, we immediatly return that, else detect EKS, else return defalt CSR signer

func GetCSRSignerName(clientSet kubernetes.Interface) string {
	csrSignerNameOnce.Do(func() {
		csrSignerName = getDefaultCsrSignerName()
		if csrSignerName != "" {
		  return csrSignerName
		}
		// only for csr api v1 we will try to detect if we are running inside an EKS cluster and switch to AWS's way to
		// get certificates using their CSRSignerName https://docs.aws.amazon.com/eks/latest/userguide/cert-signing.html
		if GetCertificatesAPIVersion(clientSet) == CSRV1 {
			// if the user specified the EKS runtime, no need to do the check
			if utils.GetOperatorRuntime() == common.OperatorRuntimeEKS {
				csrSignerName = EKSCsrSignerName
				return
			}
			nodes, err := clientSet.CoreV1().Nodes().List(context.Background(), metav1.ListOptions{})
			if err != nil {
				klog.Infof("Could not retrieve nodes to determine if we are in EKS: %v", err)
			}
			// if we find a single node with a kubeletVersion that contains "eks" or a label that starts with
			// "eks.amazonaws.com", we'll start using AWS EKS signer name
			for _, n := range nodes.Items {
				if strings.Contains(n.Status.NodeInfo.KubeletVersion, "eks") {
					csrSignerName = EKSCsrSignerName
					break
				}
				for k := range n.ObjectMeta.Labels {
					if strings.HasPrefix(k, "eks.amazonaws.com") {
						csrSignerName = EKSCsrSignerName
					}
				}
			}
		}
		if csrSignerName == "" {
                     csrSignerName = certificatesV1.KubeletServingSignerName
                 }
	})
	return csrSignerName

Copy link
Contributor

@shtripat shtripat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@pjuarezd pjuarezd merged commit ae4af42 into minio:master Mar 1, 2024
26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

MINIO_OPERATOR_CSR_SIGNER_NAME env variable is ignored if detected platform is EKS
3 participants