ContainerImage.Pinniped/internal/controller/kubecertagent
Monis Khan 7a812ac5ed
impersonatorconfig: only unload dynamiccert when proxy is disabled
In the upstream dynamiccertificates package, we rely on two pieces
of code:

1. DynamicServingCertificateController.newTLSContent which calls
   - clientCA.CurrentCABundleContent
   - servingCert.CurrentCertKeyContent
2. unionCAContent.VerifyOptions which calls
   - unionCAContent.CurrentCABundleContent

This results in calls to our tlsServingCertDynamicCertProvider and
impersonationSigningCertProvider.  If we Unset these providers, we
subtly break these consumers.  At best this results in test slowness
and flakes while we wait for reconcile loops to converge.  At worst,
it results in actual errors during runtime.  For example, we
previously would Unset the impersonationSigningCertProvider on any
sync loop error (even a transient one caused by a network blip or
a conflict between writes from different replicas of the concierge).
This would cause us to transiently fail to issue new certificates
from the token credential require API.  It would also cause us to
transiently fail to authenticate previously issued client certs
(which results in occasional Unauthorized errors in CI).

Signed-off-by: Monis Khan <mok@vmware.com>
2021-08-16 16:07:46 -04:00
..
mocks Add generated mocks for kubecertagent. 2021-04-26 08:19:45 -06:00
testdata WIP: start replacing the kubecertauthority pkg with a new controller 2020-09-22 17:45:20 -07:00
kubecertagent.go Switch to a slimmer distroless base image. 2021-08-09 15:05:13 -04:00
kubecertagent_test.go impersonatorconfig: only unload dynamiccert when proxy is disabled 2021-08-16 16:07:46 -04:00
legacypodcleaner.go Add a new "legacy pod cleaner" controller. 2021-04-26 08:19:45 -06:00
legacypodcleaner_test.go Add a new "legacy pod cleaner" controller. 2021-04-26 08:19:45 -06:00
pod_command_executor.go Refactor kube-cert-agent controllers to use a Deployment. 2021-04-26 08:19:45 -06:00