Fix certificate refresh and add e2e tests #766
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We're adding an integration test that refreshes the certificates for control plane nodes as well as worker nodes. It then verifies that the new certificates have the requested expiry date and additional Subject Alternative Names. For simplicity, we'll configure the cluster to automatically approve CSR requests. While at it, we're adding E231 and E226 to the flake8 ignore list since the linter cannot properly handle format strings.
The cluster can be configured to automatically approve certificate sign requests that are issued when refeshing cluster certificates. However, k8sd rejects the CSR requests since it expects them to include a signature that is currently missing. We'll address the problem by adding the missing CSR signature. Note that the CSR signature is passed through k8s annotations and thus needs to be base64 encoded. We're updating the unit tests accordingly.
petrutlucian94
force-pushed
the
cert_tests
branch
2 times, most recently
from
2cae419
to
b3dd7ca
Compare
|
The ubuntu 20.04 job fails as the test is unable to retrieve the certificate file: It fails consistently on 20.04, is the It's either that or the LE: looks like with the |
The k8s cert dir may be either /etc/kubernetes/pki or /var/snap/k8s/etc/kubernetes/pki. We'll need to update our integration test to check both locations.
The requested expiry date and extra SANs are currently ignored when refreshing worker node certificates. There's a TODO and a hard-coded 10y expiry date. This commit ensures that the specified expiry date and Subject Alternative Name are properly passed and applied.
petrutlucian94
force-pushed
the
cert_tests
branch
from
54fdc24
to
0630357
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There are few issues that affect the
k8s refresh-certscommand:This PR addresses these issues and adds an e2e test that refreshes control-plane and worker node certificates, validating the resulting certificates.