weiguoqiang/cert-manager
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Update ACME issuer

Browse Source
This commit is contained in:
James Munnelly 2018-08-06 17:04:00 +01:00
parent e9285c6bdb
commit 2fcbee05b7
4 changed files with 22 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
pkg/issuer/acme/acme.go
View File

@ -8,15 +8,13 @@ import (
"github.com/golang/glog"
corev1 "k8s.io/api/core/v1"
"k8s.io/client-go/kubernetes"
corelisters "k8s.io/client-go/listers/core/v1"
extlisters "k8s.io/client-go/listers/extensions/v1beta1"
"k8s.io/client-go/tools/record"
"github.com/jetstack/cert-manager/pkg/acme"
"github.com/jetstack/cert-manager/pkg/acme/client"
"github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha1"
clientset "github.com/jetstack/cert-manager/pkg/client/clientset/versioned"
"github.com/jetstack/cert-manager/pkg/controller"
"github.com/jetstack/cert-manager/pkg/issuer"
"github.com/jetstack/cert-manager/pkg/issuer/acme/dns"
"github.com/jetstack/cert-manager/pkg/issuer/acme/http"
@ -27,13 +25,9 @@ import (
// certificates from any ACME server. It supports DNS01 and HTTP01 challenge
// mechanisms.
type Acme struct {
helper *acme.Helper
issuer v1alpha1.GenericIssuer
client kubernetes.Interface
cmClient clientset.Interface
recorder record.EventRecorder
*controller.Context
helper *acme.Helper
secretsLister corelisters.SecretLister
podsLister corelisters.PodLister
@ -76,10 +70,8 @@ type solver interface {
}
// New returns a new ACME issuer interface for the given issuer.
func New(issuer v1alpha1.GenericIssuer,
client kubernetes.Interface,
cmClient clientset.Interface,
recorder record.EventRecorder,
func New(ctx *controller.Context,
issuer v1alpha1.GenericIssuer,
resourceNamespace string,
acmeHTTP01SolverImage string,
secretsLister corelisters.SecretLister,
@ -103,24 +95,17 @@ func New(issuer v1alpha1.GenericIssuer,
}
a := &Acme{
// TODO: helper *should* be instantiated with the ClusterResourceNamespace,
// whereas here we are instantiating it with the actual namespace that should
// be used to discover resources.
// This is okay in this instance, as we construct a dedicated Helper per Issuer
// and we also construct a dedicated 'Acme' per issuer too.
// With the ACME order changes, this line will change appropriately.
helper: acme.NewHelper(secretsLister, resourceNamespace),
issuer: issuer,
client: client,
cmClient: cmClient,
recorder: recorder,
Context: ctx,
helper: acme.NewHelper(secretsLister, ctx.ClusterResourceNamespace),
issuer: issuer,
secretsLister: secretsLister,
podsLister: podsLister,
servicesLister: servicesLister,
ingressLister: ingressLister,
dnsSolver: dns.NewSolver(issuer, client, secretsLister, resourceNamespace, ambientCreds, dns01Nameservers),
httpSolver: http.NewSolver(issuer, client, podsLister, servicesLister, ingressLister, acmeHTTP01SolverImage),
dnsSolver: dns.NewSolver(issuer, ctx.Client, secretsLister, resourceNamespace, ambientCreds, dns01Nameservers),
httpSolver: http.NewSolver(issuer, ctx.Client, podsLister, servicesLister, ingressLister, acmeHTTP01SolverImage),
issuerResourcesNamespace: resourceNamespace,
}
return a, nil
@ -143,7 +128,7 @@ func (a *Acme) createOrder(ctx context.Context, cl client.Interface, crt *v1alph
}
order, err = cl.CreateOrder(ctx, order)
if err != nil {
a.recorder.Eventf(crt, corev1.EventTypeWarning, "ErrCreateOrder", "Error creating order: %v", err)
a.Recorder.Eventf(crt, corev1.EventTypeWarning, "ErrCreateOrder", "Error creating order: %v", err)
return nil, err
}
@ -164,7 +149,7 @@ func (a *Acme) solverFor(challengeType string) (solver, error) {
// Register this Issuer with the issuer factory
func init() {
issuer.Register(issuer.IssuerACME, func(i v1alpha1.GenericIssuer, ctx *issuer.Context) (issuer.Interface, error) {
controller.RegisterIssuer(controller.IssuerACME, func(ctx *controller.Context, i v1alpha1.GenericIssuer) (issuer.Interface, error) {
issuerResourcesNamespace := i.GetObjectMeta().Namespace
if issuerResourcesNamespace == "" {
issuerResourcesNamespace = ctx.ClusterResourceNamespace
@ -181,12 +166,10 @@ func init() {
}
return New(
ctx,
i,
ctx.Client,
ctx.CMClient,
ctx.Recorder,
issuerResourcesNamespace,
ctx.ACMEHTTP01SolverImage,
ctx.ACMEOptions.HTTP01SolverImage,
ctx.KubeSharedInformerFactory.Core().V1().Secrets().Lister(),
ctx.KubeSharedInformerFactory.Core().V1().Pods().Lister(),
ctx.KubeSharedInformerFactory.Core().V1().Services().Lister(),

4
pkg/issuer/acme/issue.go
View File

@ -104,7 +104,7 @@ func (a *Acme) obtainCertificate(ctx context.Context, crt *v1alpha1.Certificate)
// TODO: should we also set the FailedValidation status
// condition here so back off can be applied?
crt.UpdateStatusCondition(v1alpha1.CertificateConditionReady, v1alpha1.ConditionFalse, errorIssueError, fmt.Sprintf("Failed to finalize order: %v", err), false)
a.recorder.Eventf(crt, corev1.EventTypeWarning, errorIssueError, "Failed to finalize order: %v", err)
a.Recorder.Eventf(crt, corev1.EventTypeWarning, errorIssueError, "Failed to finalize order: %v", err)
return nil, nil, fmt.Errorf("error getting certificate from acme server: %s", err)
}
@ -114,7 +114,7 @@ func (a *Acme) obtainCertificate(ctx context.Context, crt *v1alpha1.Certificate)
pem.Encode(certBuffer, &pem.Block{Type: "CERTIFICATE", Bytes: cert})
}
a.recorder.Eventf(crt, corev1.EventTypeNormal, successCertObtained, "Obtained certificate from ACME server")
a.Recorder.Eventf(crt, corev1.EventTypeNormal, successCertObtained, "Obtained certificate from ACME server")
glog.Infof("successfully obtained certificate: cn=%q altNames=%+v url=%q", commonName, altNames, orderURL)
// encode the private key and return

4
pkg/issuer/acme/prepare.go
View File

@ -87,7 +87,7 @@ func (a *Acme) Prepare(ctx context.Context, crt *v1alpha1.Certificate) error {
crt.UpdateStatusCondition(v1alpha1.CertificateConditionReady, v1alpha1.ConditionFalse, errorValidateError, fmt.Sprintf("Failed to create new order: %v", err), false)
return err
}
a.recorder.Eventf(crt, corev1.EventTypeNormal, reasonCreateOrder, "Created new ACME order, attempting validation...")
a.Recorder.Eventf(crt, corev1.EventTypeNormal, reasonCreateOrder, "Created new ACME order, attempting validation...")
}
// attempt to present/validate the order
@ -492,7 +492,7 @@ func (a *Acme) acceptChallenge(ctx context.Context, cl client.Interface, crt *v1
}
glog.Infof("Successfully authorized domain %q", authorization.Identifier.Value)
a.recorder.Eventf(crt, corev1.EventTypeNormal, reasonDomainVerified, "Domain %q verified with %q validation", ch.Domain, ch.Type)
a.Recorder.Eventf(crt, corev1.EventTypeNormal, reasonDomainVerified, "Domain %q verified with %q validation", ch.Domain, ch.Type)
return nil
}

6
pkg/issuer/acme/setup.go
View File

@ -59,7 +59,7 @@ func (a *Acme) Setup(ctx context.Context) error {
} else if err != nil {
s := messageAccountVerificationFailed + err.Error()
glog.V(4).Infof("%s: %s", a.issuer.GetObjectMeta().Name, s)
a.recorder.Event(a.issuer, v1.EventTypeWarning, errorAccountVerificationFailed, s)
a.Recorder.Event(a.issuer, v1.EventTypeWarning, errorAccountVerificationFailed, s)
return err
}
@ -69,7 +69,7 @@ func (a *Acme) Setup(ctx context.Context) error {
if err != nil {
s := messageAccountVerificationFailed + err.Error()
glog.V(4).Infof("%s: %s", a.issuer.GetObjectMeta().Name, s)
a.recorder.Event(a.issuer, v1.EventTypeWarning, errorAccountVerificationFailed, s)
a.Recorder.Event(a.issuer, v1.EventTypeWarning, errorAccountVerificationFailed, s)
a.issuer.UpdateStatusCondition(v1alpha1.IssuerConditionReady, v1alpha1.ConditionFalse, errorAccountRegistrationFailed, s)
return err
}
@ -120,7 +120,7 @@ func (a *Acme) createAccountPrivateKey(sel v1alpha1.SecretKeySelector) (*rsa.Pri
return nil, err
}
_, err = a.client.CoreV1().Secrets(a.issuerResourcesNamespace).Create(&v1.Secret{
_, err = a.Client.CoreV1().Secrets(a.issuerResourcesNamespace).Create(&v1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: sel.Name,
Namespace: a.issuerResourcesNamespace,