Support rotating certs in running pods instead of restarting them

オープン
  • 何か問題がありますか？
#769 コメント 1 件 リアクション 1 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
35/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
kubernetes, rust
領域
infrastructure, security

調査の方向性

Start by tracing the CSIDriver configuration and the NodePublishVolume implementation, then find where the replace time is computed for the restarter annotation. The issue proposes opt-in per-volume certificate renewal, safe replacement of files in mounted volumes, and retaining restart behavior as a fallback. Done would include renewal on republish without exposing partially written certificates; the issue names no files or tests.

索引モデルが issue の本文から書いたものです。

説明

customer-request

Description

Right now, when a cert from the secret-operator gets close to expiring, the restarter just kills the pod based on the annotation set by secret-op (I think). That works, but it’s annoying for things that are slow to come back up or don't handle restarts well (looking at you, NiFi!), and it means short cert lifetimes come with a lot of restarts.

Some products can already reload certs from disk on their own. For example NiFi does this with nifi.security.autoreload.enabled. For products like that, it’d be nice if we could swap the cert in the volume and let the product take it from there, without forcing an unneeded restart on the pod.

The CSI lifecyle in Kubernetes has a hook for this: if we set requiresRepublish: true on our CSIDriver, the kubelet keeps calling NodePublishVolume for volumes that are already mounted. We can use that to check whether the cert is past its replace time and, if so, issue a new one and write it into the existing volume. We already compute that time for the restarter annotation, so we’d mainly need to keep it somewhere cheap to check, for example in memory with a small file in the volume as a fallback after the driver restarts.

This would have to be opt-in per volume, since products that don’t reload would just keep using the old cert until it expires. We’d probably also keep the restarter annotation as a safety net in case reissuing fails.

Bit of file handling to investigate since we don't want half-written certs being read, so probably need to come up with some symlink or mv magic, but that should be doable.

主要言語
Rust
スター
14
フォーク
8
平均マージ
1日 12時間
マージ済み PR（30日）
9

環境構築

  • Dockerfile・Docker Compose ファイルなし
  • プルリクエストのテンプレートあり
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

stackabletech/secret-operator のほかの issue

stackabletech/secret-operator の issue をすべて見る

似ている issue

Rust の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。