Closed superfrink closed 7 months ago
@superfrink - Thanks for the PR. When the CA Cert gets renewed it also needs to patch the CRD's which previously was only being done on startup or new CRD's applied to cluster.
I had actually been working on a larger fix to this and just landed it which ensures the CA Cert is renewed and that the CABundle is properly injected in the CRD's when it changes. It also opens up the ability manage it externally via CertManager (which has been requested in the past).
https://github.com/emissary-ingress/emissary/pull/5494
Please feel free to try that out and let me know if you see any issues!
Description
Currently,
emissary-apiext
will create a new webhook key and certificate when one does not exist and does not replace the certificate when it is expired. The change in this PR automatically replaces the key and certificate when it is expired.Related Issues
Fixes https://github.com/emissary-ingress/emissary/issues/4442
Testing
Manual testing by scaling the
emissary-apiext
pods to zero and back up again. First with an expired certificate and second with a not-expired certificate.The new log message:
The log message was not present when scaling up the pods and the certificate expiry date was still valid.
Checklist
[ ] Does my change need to be backported to a previous release?
[ ] I made sure to update
CHANGELOG.md
.Remember, the CHANGELOG needs to mention:
[ ] This is unlikely to impact how Ambassador performs at scale.
Remember, things that might have an impact at scale include:
[ ] My change is adequately tested.
Remember when considering testing:
[ ] I updated
DEVELOPING.md
with any any special dev tricks I had to use to work on this code efficiently.[ ] The changes in this PR have been reviewed for security concerns and adherence to security best practices.