starlingx
/
config
Code Issues Proposed changes

First check Root CAs on kube-cert-rotation.sh 

As of now, the script only verifies the validity of leaf certificates
and, if expired, will regenerate them based on K8s/etcd Root CAs.
It doesn't account for the possibility of Root CAs being expired.
It will generate leaf certificates based on Root CAs, even if said
Root CAs are expired.

This change fixes that behaviour by first checking validity of
Root CAs and only allowing leaf certificate renewal if RCAs are
valid.

Test plan:

PASS: Cause Root CAs to expire, run kube-cert-rotation.sh script
      and verify that it fails with an error saying Root CAs are
      expired and leaf certificates are not renewed.
PASS: Ensure to have valid Root CAs, cause leaf certificates
      to expire, run kube-cert-rotation.sh and verify that the
      script executes normally and is able to renew
      the leaf certificates.

Closes-Bug: 2059708

Signed-off-by: Rei Oliveira <Reinildes.JoseMateusOliveira@windriver.com>
Change-Id: I98dfd8d1417754f3c723d8ddd52a856785ffc83b
This commit is contained in:
Rei Oliveira 2024-03-28 14:28:34 -03:00
parent 7ae03957ff
commit 01a5ea0843
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sysinv/sysinv/sysinv/scripts/kube-cert-rotation.sh
View File

@ -177,6 +177,18 @@ RESTART_SYSINV=0
RESTART_CERT_MON=0
RESTART_ETCD=0
# Fist check the validity of the Root CAs in /etc/kubernetes/pki/ca.crt and /etc/etcd/ca.crt
# If they are expired the process should not continue
for CA in /etc/kubernetes/pki/ca.crt /etc/etcd/ca.crt;
do
sudo cat ${CA} | openssl x509 -checkend 0 >/dev/null
RC=$?
if [ ${RC} -eq 1 ]; then
echo "${CA} Root CA is expired. Leaf certificates renewal will not be attempted."
ERR=1
fi
done
# step 1, renew kubernetes certificates
# Renew apiserver certificate
if [ ${ERR} -eq 0 ]; then