Merge pull request #1378 from DanielMorsing/watchTLS

watch TLS cert file

cmd/webhook/BUILD.bazel

@@ -14,6 +14,7 @@ go_library(
     visibility = ["//visibility:private"],
     deps = [
         "//pkg/apis/certmanager/validation/webhooks:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
         "//vendor/github.com/openshift/generic-admission-server/pkg/cmd:go_default_library",
     ],
 )

cmd/webhook/main.go

@@ -18,7 +18,10 @@ package main
 
 import (
 	"flag"
+	"os"
+	"time"
 
+	"github.com/golang/glog"
 	"github.com/openshift/generic-admission-server/pkg/cmd"
 
 	"github.com/jetstack/cert-manager/pkg/apis/certmanager/validation/webhooks"
@@ -32,9 +35,44 @@ func main() {
 	// Avoid "logging before flag.Parse" errors from glog
 	flag.CommandLine.Parse([]string{})
 
+	// parse the command line flags to pull out the tls-cert-file
+	// argument. This flag will be parsed by code inside cmd.RunAdmissionServer
+	// so no need to pass it through the call stack or have nice errors
+	tlsflagSet := flag.NewFlagSet("tls", flag.ContinueOnError)
+	tlsflagVal := tlsflagSet.String("tls-cert-file", "", "")
+	tlsflagSet.Parse(os.Args[1:])
+	if *tlsflagVal != "" {
+		runfilewatch(*tlsflagVal)
+	}
+
 	cmd.RunAdmissionServer(
 		certHook,
 		issuerHook,
 		clusterIssuerHook,
 	)
 }
+
+func runfilewatch(filename string) {
+	info, err := os.Stat(filename)
+	if err != nil {
+		// missing TLS cert file will get turned into a proper error later
+		return
+	}
+	modtime := info.ModTime()
+	go func() {
+		for {
+			time.Sleep(1 * time.Minute)
+			info, err := os.Stat(filename)
+			if err != nil {
+				continue
+			}
+			if info.ModTime().After(modtime) {
+				// let the k8s scheduler restart us
+				// TODO(dmo): figure out if there's a way to do this with clean
+				// shutdown
+				glog.Info("Detected change in TLS certificate %s. Restarting to pick up new certificate", filename)
+				os.Exit(0)
+			}
+		}
+	}()
+}