From 10b56dcfe86b7c1e3e0252fb25f7bba46c888743 Mon Sep 17 00:00:00 2001 From: JrCs <90z7oey02@sneakemail.com> Date: Wed, 6 Jun 2018 13:24:15 +0200 Subject: [PATCH 1/4] Vault issuer MUST USE the vault 'sign' endpoint --- docs/tutorials/vault/creating-vault-issuers.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/tutorials/vault/creating-vault-issuers.rst b/docs/tutorials/vault/creating-vault-issuers.rst index 1e72a5f73..78d452ed3 100644 --- a/docs/tutorials/vault/creating-vault-issuers.rst +++ b/docs/tutorials/vault/creating-vault-issuers.rst @@ -62,7 +62,8 @@ We can now create a cluster issuer referencing this secret: key: secretId Where *path* is the Vault role path of the PKI backend and *server* is -the Vault server base URL. The Vault appRole credentials are supplied as the +the Vault server base URL. The *path* MUST USE the vault ``sign`` endpoint. +The Vault appRole credentials are supplied as the Vault authentication method using the appRole created in Vault. The secretRef references the Kubernetes secret created previously. More specifically, the field *name* is the Kubernetes secret name and *key* is the name given as the From 1c21b7c32b08b9d9cd2d561b5169af4f1677128e Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Wed, 13 Jun 2018 23:11:55 +0100 Subject: [PATCH 2/4] Update e2e test ACME email Let's encrypt no longer allow use of @example.com emails for ACME accounts. This PR switches us to use a @cert-manager.io email for the ACME account used during e2e tests, as currently the dns01 e2e tests are performed against the let's encrypt staging endpoint due to issues described in https://github.com/letsencrypt/pebble/issues/118 --- test/e2e/certificate/certificate_acme.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/e2e/certificate/certificate_acme.go b/test/e2e/certificate/certificate_acme.go index 476b19fd8..e5c178ae9 100644 --- a/test/e2e/certificate/certificate_acme.go +++ b/test/e2e/certificate/certificate_acme.go @@ -31,7 +31,7 @@ import ( ) const invalidACMEURL = "http://not-a-real-acme-url.com" -const testingACMEEmail = "test@example.com" +const testingACMEEmail = "e2e@cert-manager.io" const testingACMEPrivateKey = "test-acme-private-key" const foreverTestTimeout = time.Second * 60 From f07b062a0a07cdcd0019ae66dc0ced9665b7a21d Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Mon, 18 Jun 2018 01:55:45 +0100 Subject: [PATCH 3/4] issuers: Skip triggering API update if status has not changed --- pkg/controller/clusterissuers/sync.go | 5 +++++ pkg/controller/issuers/sync.go | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/pkg/controller/clusterissuers/sync.go b/pkg/controller/clusterissuers/sync.go index 3b5769d5e..ec8acf530 100644 --- a/pkg/controller/clusterissuers/sync.go +++ b/pkg/controller/clusterissuers/sync.go @@ -2,6 +2,7 @@ package clusterissuers import ( "context" + "reflect" "github.com/golang/glog" "k8s.io/api/core/v1" @@ -26,6 +27,10 @@ func (c *Controller) Sync(ctx context.Context, iss *v1alpha1.ClusterIssuer) (err err = i.Setup(ctx) defer func() { + // TODO: replace this with more efficient comparison? + if reflect.DeepEqual(issuerCopy.Status, iss.Status) { + return + } if saveErr := c.updateIssuerStatus(issuerCopy); saveErr != nil { errs := []error{saveErr} if err != nil { diff --git a/pkg/controller/issuers/sync.go b/pkg/controller/issuers/sync.go index 5a865b5b5..f2d977481 100644 --- a/pkg/controller/issuers/sync.go +++ b/pkg/controller/issuers/sync.go @@ -2,6 +2,7 @@ package issuers import ( "context" + "reflect" "github.com/golang/glog" "k8s.io/api/core/v1" @@ -26,6 +27,10 @@ func (c *Controller) Sync(ctx context.Context, iss *v1alpha1.Issuer) (err error) err = i.Setup(ctx) defer func() { + // TODO: replace this with more efficient comparison? + if reflect.DeepEqual(issuerCopy.Status, iss.Status) { + return + } if saveErr := c.updateIssuerStatus(issuerCopy); saveErr != nil { errs := []error{saveErr} if err != nil { From 09c5b40f0b7de7bd934e0e44b63b7a2da968cf34 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Mon, 25 Jun 2018 10:46:10 +0100 Subject: [PATCH 4/4] Don't return invalid/expired orders in shouldAttemptValidation --- pkg/issuer/acme/prepare.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/issuer/acme/prepare.go b/pkg/issuer/acme/prepare.go index fed36c5f4..1464e7d3f 100644 --- a/pkg/issuer/acme/prepare.go +++ b/pkg/issuer/acme/prepare.go @@ -462,7 +462,7 @@ func (a *Acme) shouldAttemptValidation(ctx context.Context, cl client.Interface, } } - return prepareAttemptWaitPeriod - (time.Now().Sub(condition.LastTransitionTime.Time)), order, nil + return prepareAttemptWaitPeriod - (time.Now().Sub(condition.LastTransitionTime.Time)), nil, nil } return 0, nil, fmt.Errorf("unrecognised existing acme order status: %q", order.Status)