01a5ea0843
As of now, the script only verifies the validity of leaf certificates and, if expired, will regenerate them based on K8s/etcd Root CAs. It doesn't account for the possibility of Root CAs being expired. It will generate leaf certificates based on Root CAs, even if said Root CAs are expired. This change fixes that behaviour by first checking validity of Root CAs and only allowing leaf certificate renewal if RCAs are valid. Test plan: PASS: Cause Root CAs to expire, run kube-cert-rotation.sh script and verify that it fails with an error saying Root CAs are expired and leaf certificates are not renewed. PASS: Ensure to have valid Root CAs, cause leaf certificates to expire, run kube-cert-rotation.sh and verify that the script executes normally and is able to renew the leaf certificates. Closes-Bug: 2059708 Signed-off-by: Rei Oliveira <Reinildes.JoseMateusOliveira@windriver.com> Change-Id: I98dfd8d1417754f3c723d8ddd52a856785ffc83b |
||
---|---|---|
.. | ||
.eggs | ||
contrib | ||
doc/source | ||
etc/sysinv | ||
scripts | ||
sysinv | ||
tools | ||
.coveragerc | ||
.gitignore | ||
.stestr.conf | ||
CONTRIBUTING.rst | ||
HACKING.rst | ||
LICENSE | ||
MANIFEST.in | ||
README.rst | ||
babel.cfg | ||
openstack-common.conf | ||
pylint.rc | ||
requirements.txt | ||
setup.cfg | ||
setup.py | ||
test-requirements.txt | ||
tox.ini | ||
upper-constraints.txt |
README.rst
Placeholder to allow setup.py to work. Removing this requires modifying the setup.py manifest.