Owls 91143 - Move internal certificate initialization logic to operator initalization #2486
Conversation
operator/src/main/java/oracle/kubernetes/operator/steps/InitializeInternalIdentityStep.java
Show resolved
Hide resolved
| KeyPair keyPair = createKeyPair(); | ||
| String key = convertToPEM(keyPair.getPrivate()); | ||
| writeToFile(key, new File(INTERNAL_CERTIFICATE_KEY)); | ||
| X509Certificate cert = SelfSignedCertGenerator.generate(keyPair, SHA_256_WITH_RSA, COMMON_NAME, 3650); |
There was a problem hiding this comment.
Should we represent some of the key/cert parameters as statics, e.g. 3650 as CERTIFICATE_VALIDITY_DAYS ?
| Writer wr = Files.newBufferedWriter(path.toPath()); | ||
| wr.write(content); | ||
| wr.flush(); | ||
| wr.close(); |
There was a problem hiding this comment.
Same... Please use try-with-resources
|
@ankedia, the existing behavior is that the operator generates an internal certificate on start-up if the certificate and key don't already exist. That is, the key and certificate will be generated the first time that the operator is started. If the operator is killed and restarted then the operator will use the values already present in the config map and secret. Similarly, if the operator is upgraded then the operator will use the existing key and certificate. I can't tell if the proposed code preserves this behavior. |
operator/src/main/java/oracle/kubernetes/operator/utils/SelfSignedCertUtils.java
Show resolved
Hide resolved
… and the config map if they already exist.
…uncycastle lib or IOException.
Changes to move the internal certificate initialization logic from bash script to the java code and with the rest of the operator's initialization. The key pair and certificate are generated using
bouncycastlelibrary. If the operator secret is created by thehelm install, it'll be replaced with the new data containing the operator's internal key. Otherwise, a new secret will be created. The integration test run results are at - https://build.weblogick8s.org:8443/job/weblogic-kubernetes-operator-kind-new/5819/ (I'm rerunning the failed test).