Skip to content

Commit 177f74d

Browse files
pacevedompacevedom
committed
USHIFT-6590: Align certificate expiry dates
1 parent ea757c8 commit 177f74d

1 file changed

Lines changed: 45 additions & 30 deletions

File tree

‎pkg/cmd/init.go‎

Lines changed: 45 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,21 @@ func initCerts(cfg *config.Config) (*certchains.CertificateChains, error) {
6161
}
6262

6363
func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
64+
// Anchor certificate expiration to the next day. This forces
65+
// homogenous expiry dates for all certificates with the same validity.
66+
startTime := time.Now()
67+
nextMidnight := time.Date(
68+
startTime.Year(),
69+
startTime.Month(),
70+
startTime.Day()+1,
71+
0, 0, 0, 0,
72+
startTime.Location(),
73+
)
74+
alignValidity := func(baseValidity time.Duration) time.Duration {
75+
targetExpiration := nextMidnight.Add(baseValidity)
76+
return time.Until(targetExpiration)
77+
}
78+
6479
_, svcNet, err := net.ParseCIDR(cfg.Network.ServiceNetwork[0])
6580
if err != nil {
6681
return nil, err
@@ -97,33 +112,33 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
97112
certchains.NewCertificateSigner(
98113
"kube-control-plane-signer",
99114
cryptomaterial.KubeControlPlaneSignerCertDir(certsDir),
100-
cryptomaterial.ShortLivedCertificateValidity,
115+
alignValidity(cryptomaterial.ShortLivedCertificateValidity),
101116
).WithClientCertificates(
102117
&certchains.ClientCertificateSigningRequestInfo{
103118
CSRMeta: certchains.CSRMeta{
104119
Name: "kube-controller-manager",
105-
Validity: cryptomaterial.ShortLivedCertificateValidity,
120+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
106121
},
107122
UserInfo: &user.DefaultInfo{Name: "system:kube-controller-manager"},
108123
},
109124
&certchains.ClientCertificateSigningRequestInfo{
110125
CSRMeta: certchains.CSRMeta{
111126
Name: "kube-scheduler",
112-
Validity: cryptomaterial.ShortLivedCertificateValidity,
127+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
113128
},
114129
UserInfo: &user.DefaultInfo{Name: "system:kube-scheduler"},
115130
},
116131
&certchains.ClientCertificateSigningRequestInfo{
117132
CSRMeta: certchains.CSRMeta{
118133
Name: "cluster-policy-controller",
119-
Validity: cryptomaterial.ShortLivedCertificateValidity,
134+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
120135
},
121136
UserInfo: &user.DefaultInfo{Name: "system:kube-controller-manager"},
122137
},
123138
&certchains.ClientCertificateSigningRequestInfo{
124139
CSRMeta: certchains.CSRMeta{
125140
Name: "route-controller-manager",
126-
Validity: cryptomaterial.ShortLivedCertificateValidity,
141+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
127142
},
128143
UserInfo: serviceaccount.UserInfo("openshift-route-controller-manager", "route-controller-manager-sa", ""),
129144
}),
@@ -132,12 +147,12 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
132147
certchains.NewCertificateSigner(
133148
"kube-apiserver-to-kubelet-signer",
134149
cryptomaterial.KubeAPIServerToKubeletSignerCertDir(certsDir),
135-
cryptomaterial.ShortLivedCertificateValidity,
150+
alignValidity(cryptomaterial.ShortLivedCertificateValidity),
136151
).WithClientCertificates(
137152
&certchains.ClientCertificateSigningRequestInfo{
138153
CSRMeta: certchains.CSRMeta{
139154
Name: "kube-apiserver-to-kubelet-client",
140-
Validity: cryptomaterial.ShortLivedCertificateValidity,
155+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
141156
},
142157
UserInfo: &user.DefaultInfo{Name: "system:kube-apiserver", Groups: []string{"kube-master"}},
143158
}),
@@ -146,19 +161,19 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
146161
certchains.NewCertificateSigner(
147162
"admin-kubeconfig-signer",
148163
cryptomaterial.AdminKubeconfigSignerDir(certsDir),
149-
cryptomaterial.LongLivedCertificateValidity,
164+
alignValidity(cryptomaterial.LongLivedCertificateValidity),
150165
).WithClientCertificates(
151166
&certchains.ClientCertificateSigningRequestInfo{
152167
CSRMeta: certchains.CSRMeta{
153168
Name: "admin-kubeconfig-client",
154-
Validity: cryptomaterial.LongLivedCertificateValidity,
169+
Validity: alignValidity(cryptomaterial.LongLivedCertificateValidity),
155170
},
156171
UserInfo: &user.DefaultInfo{Name: "system:admin", Groups: []string{"system:masters"}},
157172
}).WithClientCertificates(
158173
&certchains.ClientCertificateSigningRequestInfo{
159174
CSRMeta: certchains.CSRMeta{
160175
Name: "openshift-observability-client",
161-
Validity: cryptomaterial.ShortLivedCertificateValidity,
176+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
162177
},
163178
UserInfo: &user.DefaultInfo{Name: "openshift-observability-client", Groups: []string{""}},
164179
},
@@ -168,17 +183,17 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
168183
certchains.NewCertificateSigner(
169184
"kubelet-signer",
170185
cryptomaterial.KubeletCSRSignerSignerCertDir(certsDir),
171-
cryptomaterial.ShortLivedCertificateValidity,
186+
alignValidity(cryptomaterial.ShortLivedCertificateValidity),
172187
).WithSubCAs(
173188
certchains.NewCertificateSigner(
174189
"kube-csr-signer",
175190
cryptomaterial.CSRSignerCertDir(certsDir),
176-
cryptomaterial.ShortLivedCertificateValidity,
191+
alignValidity(cryptomaterial.ShortLivedCertificateValidity),
177192
).WithClientCertificates(
178193
&certchains.ClientCertificateSigningRequestInfo{
179194
CSRMeta: certchains.CSRMeta{
180195
Name: "kubelet-client",
181-
Validity: cryptomaterial.ShortLivedCertificateValidity,
196+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
182197
},
183198
// userinfo per https://kubernetes.io/docs/reference/access-authn-authz/node/#overview
184199
UserInfo: &user.DefaultInfo{Name: "system:node:" + cfg.CanonicalNodeName(), Groups: []string{"system:nodes"}},
@@ -187,7 +202,7 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
187202
&certchains.ServingCertificateSigningRequestInfo{
188203
CSRMeta: certchains.CSRMeta{
189204
Name: "kubelet-server",
190-
Validity: cryptomaterial.ShortLivedCertificateValidity,
205+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
191206
},
192207
Hostnames: []string{cfg.Node.HostnameOverride, cfg.Node.NodeIP},
193208
},
@@ -196,12 +211,12 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
196211
certchains.NewCertificateSigner(
197212
"aggregator-signer",
198213
cryptomaterial.AggregatorSignerDir(certsDir),
199-
cryptomaterial.ShortLivedCertificateValidity,
214+
alignValidity(cryptomaterial.ShortLivedCertificateValidity),
200215
).WithClientCertificates(
201216
&certchains.ClientCertificateSigningRequestInfo{
202217
CSRMeta: certchains.CSRMeta{
203218
Name: "aggregator-client",
204-
Validity: cryptomaterial.ShortLivedCertificateValidity,
219+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
205220
},
206221
UserInfo: &user.DefaultInfo{Name: "system:openshift-aggregator"},
207222
},
@@ -213,12 +228,12 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
213228
certchains.NewCertificateSigner(
214229
"service-ca",
215230
cryptomaterial.ServiceCADir(certsDir),
216-
cryptomaterial.LongLivedCertificateValidity,
231+
alignValidity(cryptomaterial.LongLivedCertificateValidity),
217232
).WithServingCertificates(
218233
&certchains.ServingCertificateSigningRequestInfo{
219234
CSRMeta: certchains.CSRMeta{
220235
Name: "route-controller-manager-serving",
221-
Validity: cryptomaterial.ShortLivedCertificateValidity,
236+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
222237
},
223238
Hostnames: []string{
224239
"route-controller-manager.openshift-route-controller-manager.svc",
@@ -230,12 +245,12 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
230245
certchains.NewCertificateSigner(
231246
"ingress-ca",
232247
cryptomaterial.IngressCADir(certsDir),
233-
cryptomaterial.LongLivedCertificateValidity,
248+
alignValidity(cryptomaterial.LongLivedCertificateValidity),
234249
).WithServingCertificates(
235250
&certchains.ServingCertificateSigningRequestInfo{
236251
CSRMeta: certchains.CSRMeta{
237252
Name: "router-default-serving",
238-
Validity: cryptomaterial.ShortLivedCertificateValidity,
253+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
239254
},
240255
Hostnames: []string{
241256
"*.apps." + cfg.DNS.BaseDomain, // wildcard for any additional auto-generated domains
@@ -248,12 +263,12 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
248263
certchains.NewCertificateSigner(
249264
"kube-apiserver-external-signer",
250265
cryptomaterial.KubeAPIServerExternalSigner(certsDir),
251-
cryptomaterial.LongLivedCertificateValidity,
266+
alignValidity(cryptomaterial.LongLivedCertificateValidity),
252267
).WithServingCertificates(
253268
&certchains.ServingCertificateSigningRequestInfo{
254269
CSRMeta: certchains.CSRMeta{
255270
Name: "kube-external-serving",
256-
Validity: cryptomaterial.ShortLivedCertificateValidity,
271+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
257272
},
258273
Hostnames: externalCertNames,
259274
},
@@ -262,12 +277,12 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
262277
certchains.NewCertificateSigner(
263278
"kube-apiserver-localhost-signer",
264279
cryptomaterial.KubeAPIServerLocalhostSigner(certsDir),
265-
cryptomaterial.LongLivedCertificateValidity,
280+
alignValidity(cryptomaterial.LongLivedCertificateValidity),
266281
).WithServingCertificates(
267282
&certchains.ServingCertificateSigningRequestInfo{
268283
CSRMeta: certchains.CSRMeta{
269284
Name: "kube-apiserver-localhost-serving",
270-
Validity: cryptomaterial.ShortLivedCertificateValidity,
285+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
271286
},
272287
Hostnames: []string{
273288
"localhost",
@@ -278,12 +293,12 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
278293
certchains.NewCertificateSigner(
279294
"kube-apiserver-service-network-signer",
280295
cryptomaterial.KubeAPIServerServiceNetworkSigner(certsDir),
281-
cryptomaterial.LongLivedCertificateValidity,
296+
alignValidity(cryptomaterial.LongLivedCertificateValidity),
282297
).WithServingCertificates(
283298
&certchains.ServingCertificateSigningRequestInfo{
284299
CSRMeta: certchains.CSRMeta{
285300
Name: "kube-apiserver-service-network-serving",
286-
Validity: cryptomaterial.ShortLivedCertificateValidity,
301+
Validity: alignValidity(cryptomaterial.ShortLivedCertificateValidity),
287302
},
288303
Hostnames: []string{
289304
"kubernetes",
@@ -308,28 +323,28 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
308323
certchains.NewCertificateSigner(
309324
"etcd-signer",
310325
cryptomaterial.EtcdSignerDir(certsDir),
311-
cryptomaterial.LongLivedCertificateValidity,
326+
alignValidity(cryptomaterial.LongLivedCertificateValidity),
312327
).WithClientCertificates(
313328
&certchains.ClientCertificateSigningRequestInfo{
314329
CSRMeta: certchains.CSRMeta{
315330
Name: "apiserver-etcd-client",
316-
Validity: cryptomaterial.LongLivedCertificateValidity,
331+
Validity: alignValidity(cryptomaterial.LongLivedCertificateValidity),
317332
},
318333
UserInfo: &user.DefaultInfo{Name: "etcd", Groups: []string{"etcd"}},
319334
},
320335
).WithPeerCertificiates(
321336
&certchains.PeerCertificateSigningRequestInfo{
322337
CSRMeta: certchains.CSRMeta{
323338
Name: "etcd-peer",
324-
Validity: cryptomaterial.LongLivedCertificateValidity,
339+
Validity: alignValidity(cryptomaterial.LongLivedCertificateValidity),
325340
},
326341
UserInfo: &user.DefaultInfo{Name: "system:etcd-peer:etcd-client", Groups: []string{"system:etcd-peers"}},
327342
Hostnames: []string{"localhost", cfg.Node.HostnameOverride, cfg.Node.NodeIP},
328343
},
329344
&certchains.PeerCertificateSigningRequestInfo{
330345
CSRMeta: certchains.CSRMeta{
331346
Name: "etcd-serving",
332-
Validity: cryptomaterial.LongLivedCertificateValidity,
347+
Validity: alignValidity(cryptomaterial.LongLivedCertificateValidity),
333348
},
334349
UserInfo: &user.DefaultInfo{Name: "system:etcd-server:etcd-client", Groups: []string{"system:etcd-servers"}},
335350
Hostnames: []string{"localhost", cfg.Node.HostnameOverride, cfg.Node.NodeIP},

0 commit comments

Comments
 (0)