Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[internal] Renewal of expiring certs; go hook migration; cert alerts #223

Open
wants to merge 71 commits into
base: main
Choose a base branch
from
Open

[internal] Renewal of expiring certs; go hook migration; cert alerts #223

wants to merge 71 commits into from
+2,764 −1,131

Conversation

astef
Copy link
Member

@astef astef commented Feb 28, 2025 •
edited
Loading

Description

This is combination of three functionalities:

Why do we need it, and what problem does it solve?

  • It will let users know that certificates are going to expire soon in sds-replicated-volume module
  • User will be able to renew certificates manually and safely (turning off/on linstor)
  • We are migrating from deprecated python hooks to Go hooks and modern SDK

What is the expected result?

  • Prometheus alert should become red, once any of the certificates in Secrets is to expire in 30d or less.
  • Go hooks are replacing python hooks
  • Users are able to manually renew certs

Checklist

  • The code is covered by unit tests.
  • e2e tests passed.
  • Documentation updated according to the changes.
  • Changes were tested in the Kubernetes cluster manually.

@astef
label expiring certs
de2649a 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef astef self-assigned this Feb 28, 2025
@astef astef added the enhancement New feature or request label Feb 28, 2025
astef added 7 commits February 28, 2025 11:58
@astef
fix label
8eb0835 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
fix ci
434867a 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
fix image
a7331ca 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
add 1_23 go image
dda72dd 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
add 1_23 go image
2cf481b 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
add alert
727d224 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
some magic spells to make it work
b2d4b49 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
astef and others added 2 commits February 28, 2025 20:08
@astef @AleksZimin
Update monitoring/prometheus-rules/expiring-certs.yaml
951d6a6 
Co-authored-by: Aleksandr Zimin <[email protected]>
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef @AleksZimin
Update monitoring/prometheus-rules/expiring-certs.yaml
77cd9e6 
Co-authored-by: Aleksandr Zimin <[email protected]>
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef astef marked this pull request as ready for review March 3, 2025 08:52
@astef astef changed the title [monitoring] Alert for certificates, which will expire soon [monitoring] Renewal of expiring certs Mar 3, 2025
@astef astef changed the title [monitoring] Renewal of expiring certs [internal] Renewal of expiring certs Mar 3, 2025
@astef astef marked this pull request as draft March 3, 2025 16:44
astef added 12 commits March 4, 2025 10:34
@astef
check all *.crt keys instead of just tls.crt
762721f 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
remove the label, when not expired
83cee8d 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
change startup time
2755e48 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
test
0fbc388 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
fix time to utc
a2007f8 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
fix crontab
91e0b11 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
cron
7871824 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
cron
bcae116 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
do not retry certificate errors
2d6004f 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
debug
dbd5fde 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
fixes
de01c70 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
jq filter
dd37ad8 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
astef added 15 commits March 21, 2025 09:52
@astef
rest of certs
633342f 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
support force flag
a11f622 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
add log
eedecf8 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
add in progress label
0c9f913 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
test
552ccdb 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
debug python hook
fb4dbf4 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
debug python hook 2
bf46b84 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
support patterns in SANs, pkix extensions
f105a70 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
replace spaas certs with go hook
89e0db2 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
remove spaas hook entirely
7d15d64 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
debug
bff8328 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
fix forbidden property
cf963ef 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
playing with magic
18b353b 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
debug
2bc34d1 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
fix
0a19fd7 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef astef force-pushed the astef-cert-hook branch from 209db6c to 0a19fd7 Compare March 26, 2025 13:27
astef added 5 commits March 26, 2025 16:27
@astef
fix
881705c 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
got rid of python hooks; consolidate codebase with module-sdk
068bf89 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
fix b64enc problem
e2982ae 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
fix CA secret double- encoding
ecab5a3 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
extract cert configs to a separate package
5a83077 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef astef changed the title [internal] Renewal of expiring certs [internal] Renewal of expiring certs; go hook migration; cert alerts Apr 1, 2025
astef added 3 commits April 2, 2025 11:04
@astef
fixate
b7376e2 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
refactor
9fc59ce 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef
remove localhost SANs for all but linstor certs
94e2780 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef astef mentioned this pull request Apr 2, 2025
Draft
@astef
change hook filenames
8fe2334 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
@astef astef marked this pull request as ready for review April 3, 2025 07:48
@astef astef requested a review from duckhawk April 3, 2025 07:48
@astef
fix bugs
13444e0 
Signed-off-by: Aleksandr Stefurishin <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@AleksZimin AleksZimin AleksZimin left review comments

@duckhawk duckhawk Awaiting requested review from duckhawk

At least 1 approving review is required to merge this pull request.

Assignees

@astef astef

Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@astef @AleksZimin