public/k3s
1
0
Fork 0
mirror of https://git.vectorsigma.ru/public/k3s.git synced 2026-07-28 20:19:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Emit certs OK event on startup, if no certs need renewal (#12761)

Browse Source 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Co-authored-by: Brad Davidson <brad.davidson@rancher.com>
This commit is contained in:
Derek Nola
2025-08-14 11:34:08 -07:00
committed by GitHub
parent 2378be8255
commit 7b3cbf2f3f
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/certmonitor/certmonitor.go
View File

@@ -6,6 +6,7 @@ import (
"os"
"path/filepath"
"strings"
"sync"
"time"
daemonconfig "github.com/k3s-io/k3s/pkg/daemons/config"
@@ -67,6 +68,7 @@ func Setup(ctx context.Context, nodeConfig *daemonconfig.Node, dataDir string) e
}
deps.CreateRuntimeCertFiles(&controlConfig)
startupOnce := &sync.Once{}
caMap := map[string][]string{}
nodeList := services.Agent
if _, err := os.Stat(controlConfig.DataDir); err == nil {
@@ -87,15 +89,25 @@ func Setup(ctx context.Context, nodeConfig *daemonconfig.Node, dataDir string) e
<-executor.APIServerReadyChan()
logrus.Debugf("Running %s certificate expiration check", controllerName)
var hasErr bool
if err := checkCerts(nodeMap, time.Hour*24*daemonconfig.CertificateRenewDays); err != nil {
message := fmt.Sprintf("Node certificates require attention - restart %s on this node to trigger automatic rotation: %v", version.Program, err)
recorder.Event(nodeRef, corev1.EventTypeWarning, "CertificateExpirationWarning", message)
hasErr = true
}
if err := checkCerts(caMap, time.Hour*24*365); err != nil {
message := fmt.Sprintf("Certificate authority certificates require attention - check %s documentation and begin planning rotation: %v", version.Program, err)
message := fmt.Sprintf("Certificate Authority certificates require attention - check %s documentation and begin planning rotation: %v", version.Program, err)
recorder.Event(nodeRef, corev1.EventTypeWarning, "CACertificateExpirationWarning", message)
hasErr = true
}
// Only check for no errors and emit an OK event once, on the initial check after startup.
startupOnce.Do(func() {
if !hasErr {
message := fmt.Sprintf("Node and Certificate Authority certificates managed by %s are OK", version.Program)
recorder.Event(nodeRef, corev1.EventTypeNormal, "CertificateExpirationOK", message)
}
})
}, certCheckInterval, ctx.Done())
return nil