Commit Graph

85 Commits

Author SHA1 Message Date
James Munnelly
81f22fd49c Upgrade k8s.io dependencies to v0.23.1
Signed-off-by: James Munnelly <jmunnelly@apple.com>
2021-12-17 16:27:47 +00:00
joshvanl
d5503c2ed2 Change certificates controller to no longer error for a Certificate that
no longer exists

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
2021-11-30 15:13:14 +00:00
Maël Valais
e4f981da66 Revert "memory leak: clean up scheduler goroutine on cert deletion"
This reverts commit 641960b6. The reason we decided to revert this is
that we are unsure about the implications of adding the
scheduledWorkQueue.Forget call. The new Forget call is left untested,
and it makes us nervous not to know exactly if it works as intended.

The "Forget" memory leak that we are reverting now is the cause of a
tiny fraction of the overall memory leakage that was fixed in the PR
in the scheduler itself.  Reverting this means that some goroutines will
be leaked, but only when a Certificate gets removed and never recreated
with the same name.

Signed-off-by: Maël Valais <mael@vls.dev>
2021-07-28 19:19:39 +02:00
Maël Valais
641960b666 memory leak: clean up scheduler goroutine on certificate deletion
Signed-off-by: Maël Valais <mael@vls.dev>
2021-07-23 16:57:10 +02:00
Maël Valais
98bf0b6478
DataForCertificate: explain what the "current" and "next" CRs are used for
Signed-off-by: Maël Valais <mael@vls.dev>
2021-07-05 13:32:32 +02:00
irbekrm
feb62b1fe5 Make the back off period const public
Signed-off-by: irbekrm <irbekrm@gmail.com>
2021-06-22 06:37:07 +01:00
irbekrm
e6b748047d Remove the default renewBefore value
Signed-off-by: irbekrm <irbekrm@gmail.com>
2021-06-11 10:03:12 +01:00
Ashley Davis
219a620871
static analysis fixes
pkg/ctl/scheme.go:17:1: package comment should be of the form "Package ctl ..."
pkg/issuer/acme/dns/acmedns/acmedns.go:43:2: var accountJson should be accountJSON
pkg/issuer/acme/dns/acmedns/acmedns.go:50:43: func parameter accountJson should be accountJSON
pkg/controller/certificates/trigger/policies/policies.go:57:1: comment on exported type Chain should be of the form "Chain ..." (with optional leading article)
pkg/controller/ingress-shim/sync.go:36:2: package "github.com/jetstack/cert-manager/pkg/logs" is being imported more than once (ST1019)
pkg/controller/ingress-shim/sync.go:37:2: other import of "github.com/jetstack/cert-manager/pkg/logs"

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
2021-05-21 12:04:11 +01:00
Ashley Davis
c67c2c4f47
static analysis: pkg/controller
fixes the following issues:

pkg/controller/acmeorders/util.go:84:6 deadcode `hashChallenge` is unused
pkg/controller/certificaterequests/approver/approver.go:72:14 staticcheck SA4021: x = append(y) is equivalent to x = y
pkg/controller/certificaterequests/vault/vault_test.go:535:21 errcheck Error return value of `controller.Register` is not checked
pkg/controller/certificates/trigger/policies/policies.go:121:26 gosimple S1039: unnecessary use of fmt.Sprintf
pkg/controller/clusterissuers/sync_test.go:55:12 errcheck Error return value of `c.Register` is not checked
pkg/controller/ingress-shim/sync.go:301:2 gosimple S1005: unnecessary assignment to the blank identifier

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
2021-05-21 12:03:47 +01:00
irbekrm
17728b8437
Handle cert renewal when renewalBefore slightly less than cert duration correctly
Signed-off-by: irbekrm <irbekrm@gmail.com>
2021-05-21 12:03:47 +01:00
irbekrm
a42771b7e4 Adds a bunch of comments for exported types
Signed-off-by: irbekrm <irbekrm@gmail.com>
2021-05-19 10:19:43 +01:00
Richard Wall
6c544dafa0 Simplify the return statement
pkg/controller/certificates/trigger/trigger_controller_test.go:257:12: if block ends with a return statement, so drop this else and outdent its block

Signed-off-by: Richard Wall <richard.wall@jetstack.io>
2021-05-04 14:57:20 +01:00
Maël Valais
8f5a094b0c trigger-controller: PR comment: failure mode -> failure state
Cf. https://github.com/jetstack/cert-manager/pull/3444#pullrequestreview-629189131

Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 19:14:49 +02:00
Maël Valais
181d4ee281 DataForCertificate: typo certitificate -> certificate
Signed-off-by: Maël Valais <mael@vls.dev>
2021-04-06 19:06:21 +02:00
Maël Valais
a7486d5025 DataForCertificate: "Failure" CR condition -> "Failed"
Signed-off-by: Maël Valais <mael@vls.dev>
2021-04-06 18:58:31 +02:00
Maël Valais
2361f355aa DataForCertificate: PR comment: certificate -> cert-manager certificate
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:44:26 +02:00
Maël Valais
de0de24aad DataForCertificate: PR comment: mode -> state
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:42:17 +02:00
Maël Valais
c875518da1 DataForCertificate: PR comment: mismatch -> does not match
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:34:18 +02:00
Maël Valais
8b41ec1d54 DataForCertificate: PR comment: distinguish X.509 vs. Kubernetes cert
The cert-manager team tends to use the word "certificate" for two very
different contexts:

1. sometimes, we use the word "certificate" to refer to a X.509
   certificate (a blob of ASN.1-encoded data and then PEM-formated);
2. and sometimes we refer to "certificate" as one item of the Kubernetes
   custom resource /apis/cert-manager.io/v1/certificates.

This commit makes sure the reader understands that we are talking about
the Kubernetes object here.

Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:25:48 +02:00
Maël Valais
a724f1ce31 DataForCertificate: PR comment: mismatches is a noun
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:09:59 +02:00
Maël Valais
c1d722b116 DataForCertificate: fix diagrams' Failed conditions
Signed-off-by: Maël Valais <mael@vls.dev>
2021-04-06 18:09:59 +02:00
Maël Valais
6c9477439c trigger-controller: hint people to look at gatherer.go diagrams
Signed-off-by: Maël Valais <mael@vls.dev>
2021-04-06 18:09:59 +02:00
Maël Valais
497f561ef7 DataForCertificate: hint people to look at gatherer.go diagrams
Signed-off-by: Maël Valais <mael@vls.dev>
2021-04-06 18:09:59 +02:00
Maël Valais
068a1c466f DataForCertificate: better wording for the "error returned"
Signed-off-by: Maël Valais <mael@vls.dev>
2021-04-06 18:09:59 +02:00
Maël Valais
f588d4138a DataForCertificate: explain what the "current" and "next" CRs are used for
Signed-off-by: Maël Valais <mael@vls.dev>
2021-04-06 18:09:47 +02:00
Maël Valais
a1a43b6784 DataForCertificate: PR comment: explain why we return a "duplicate CR" err
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:09:29 +02:00
Maël Valais
450d27f5d0 trigger-controller: PR comment: and -> if there is
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:09:28 +02:00
Maël Valais
c1bf35f4ed trigger-controller: further comments on shouldBackoffReissuingOnFailure
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Irbe Krumina <irbekrm@gmail.com>
2021-04-06 18:09:28 +02:00
Maël Valais
a2bbdb7c51 DataForCertificate: explain what is the "next" certificate request
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:09:28 +02:00
Maël Valais
27f258cf3c trigger-controller: PR comment: use a single "fixedClock"
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Irbe Krumina <irbekrm@gmail.com>
2021-04-06 18:09:28 +02:00
Maël Valais
36c2cc4d3b trigger-controller: PR comment: explain what "if nextCR != nil" is about
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Irbe Krumina <irbekrm@gmail.com>
2021-04-06 18:09:28 +02:00
Maël Valais
85128f26ce trigger-controller: PR comment: rephrase log about skipping issuance
The log message:

    multiple CertificateRequests found for the 'next' revision 2,
    skipping issuance until no more duplicate.

can be better phrased as:

    multiple CertificateRequests are found for the 'next' revision 2,
    issuance is skipped until there are no more duplicates.

Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:09:28 +02:00
Maël Valais
05c1fb9fc2 trigger-controller: reissue on mismatch using NextRevisionRequest
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:09:28 +02:00
Maël Valais
eb6d1399fc DataForCertificate: the func now fetches NextRevisionRequest
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:09:27 +02:00
Maël Valais
9305766ff2 trigger-controller: add two unit tests to showcase #3250
Note that I had initially made createCryptoBundle public since I found
it inconvenient to have to pass a testing.T when we know that we should
never be  failing inside this func (I mean, the failure  zould not be due
to a wrong test case).

After a comment from Maartje, I realize that I could just use an anonymous
function for that purpose.

Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-04-06 18:09:27 +02:00
jetstack-bot
7946df1da7
Merge pull request #3788 from maelvls/refactor-trigger-unit-tests
Refactor trigger-controller unit tests
2021-03-25 11:41:36 +00:00
Maël Valais
7e21f730cc PR comment: typo: "the following are" instead of "is"
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Jake Sanders <i@am.so-aweso.me>
2021-03-25 09:07:45 +01:00
Maël Valais
fe3617a41c PR comment: a sentence starts with a capital letter and ends with a dot
Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
2021-03-24 19:19:34 +01:00
joshvanl
dd0b2bf510 Standardise the name of controllers so there is consistency across the
project

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
2021-03-23 16:08:59 +00:00
Maël Valais
71e707387a trigger-controller: refactor test, inject gatherer and policychain
Injecting the whole Gatherer struct was not necessary for testing
since DataForCertificate is now fully unit-tested. With that, we
can mock the Gatherer.Evaluate function. Since there is no reason
to inject a full Gatherer object into the trigger controller, I chose
to inject a simple policies.Func. I named the function "shouldReissue"
since this is exactly what this function does.

I also refactored the test cases to use the same gen.Certificate
that we use in the rest of the codebase.

Signed-off-by: Maël Valais <mael@vls.dev>
2021-03-23 13:55:11 +01:00
Maël Valais
cdb6c16c6d trigger-controller: log a msg when cert must be reissued
Signed-off-by: Maël Valais <mael@vls.dev>
2021-03-21 16:45:58 +01:00
irbekrm
0047174891 Update PR after rebase
Signed-off-by: irbekrm <irbekrm@gmail.com>
2021-03-15 09:00:07 +00:00
irbekrm
a89133b637 Better wording and wrap long comment lines.
Co-authored-by: Maël Valais <mael@vls.dev>
Signed-off-by: irbekrm <irbekrm@gmail.com>
2021-03-15 08:48:23 +00:00
irbekrm
245d0f5c27 Pass DefaultRenewBefore into trigger controller
Signed-off-by: irbekrm <irbekrm@gmail.com>
2021-03-15 08:48:02 +00:00
irbekrm
8d5059b13e Updates Trigger controller integration tests
Signed-off-by: irbekrm <irbekrm@gmail.com>
2021-03-15 08:47:42 +00:00
irbekrm
9e7cd99ea8 CurrentCertificateNearingExpiry looks at x509 cert to determine renewal time
Signed-off-by: irbekrm <irbekrm@gmail.com>
2021-03-15 08:44:14 +00:00
jetstack-bot
9f343ec581
Merge pull request #3475 from maelvls/unit-test-dataforcertificate
DataForCertificate: add unit tests
2021-03-09 18:13:51 +00:00
joshvanl
39a50a1903 Updates unit certificate controller tests to include ObservedGeneration
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
2021-03-04 17:04:09 +00:00
Maël Valais
34c07a71ce DataForCertificate: force core/v1 informer to create the indexer
Signed-off-by: Maël Valais <mael@vls.dev>
2021-03-04 17:20:50 +01:00
Maël Valais
ac325bf4e0 PR comment: spelling
Signed-off-by: Maël Valais <mael@vls.dev>
2021-03-04 17:20:50 +01:00