search

knative-extensions / control-protocol

Control protocol to enable interaction between control plane and data plane without redeploy
Apache License 2.0
2 stars 26 forks source link

Certificate rotation for expiration does not reliably work #272

Closed nak3 closed 1 year ago

nak3 commented 1 year ago

Current certificate rotation is inside the reconcile loop.

https://github.com/knative-sandbox/control-protocol/blob/dc4b66fe6d6223a1710f5ae13eb80644172a784e/pkg/certificates/reconciler/certificates.go#L63

But the reconcile loop is not triggered without touching the secret. And unfortunately the certificate secret is not touched automatically even when it is expired.

Side note, the current rotationThreshold is too short.

https://github.com/knative-sandbox/control-protocol/blob/dc4b66fe6d6223a1710f5ae13eb80644172a784e/pkg/certificates/reconciler/certificates.go#L42