67 lines
1.8 KiB
Go
67 lines
1.8 KiB
Go
package rkenodeconfigclient
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"time"
|
|
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
const kubeletCertValidityLimit = time.Hour * 72
|
|
|
|
func kubeletCertificateNeedsRegeneration(ipAddress, currentHostname string, cert tls.Certificate, currentTime time.Time) (bool, error) {
|
|
if len(cert.Certificate) == 0 {
|
|
return true, nil
|
|
}
|
|
|
|
parsedCert, err := x509.ParseCertificate(cert.Certificate[0])
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
if !certificateIncludesHostname(currentHostname, parsedCert) {
|
|
logrus.Tracef("certificate does not include current hostname, requesting new certificate")
|
|
return true, nil
|
|
}
|
|
|
|
if certificateIsExpiring(parsedCert, currentTime) {
|
|
logrus.Tracef("certificate is expiring soon, requesting new certificate")
|
|
return true, nil
|
|
}
|
|
|
|
if !certificateIncludesCurrentIP(ipAddress, parsedCert) {
|
|
logrus.Tracef("certificate does not include current IP address, requesting new certificate")
|
|
return true, nil
|
|
}
|
|
|
|
return false, nil
|
|
}
|
|
|
|
// certificateIsExpiring checks if the passed certificate will expire within
|
|
// the kubeletCertValidityLimit
|
|
func certificateIsExpiring(cert *x509.Certificate, currentTime time.Time) bool {
|
|
return cert.NotAfter.Sub(currentTime) < kubeletCertValidityLimit
|
|
}
|
|
|
|
// certificateIncludesHostname checks that the passed certificate includes
|
|
// the provided hostname in its SAN list
|
|
func certificateIncludesHostname(hostname string, cert *x509.Certificate) bool {
|
|
for _, name := range cert.DNSNames {
|
|
if name == hostname {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// certificateIncludesCurrentIP checks that the passed certificate includes the provided IP address
|
|
func certificateIncludesCurrentIP(ipAddress string, cert *x509.Certificate) bool {
|
|
for _, ip := range cert.IPAddresses {
|
|
if ipAddress == ip.String() {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|