home/cert-manager
2
0
Fork 0
mirror of https://github.com/wahyd4/cert-manager.git synced 2026-08-09 05:06:38 +10:00
Code Issues Packages Projects Releases Wiki Activity

Set all log levels for info

Browse Source 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
This commit is contained in:
Maartje Eyskens
2020-08-12 10:59:41 +02:00
parent 9dd00905e9
commit fecd0b3518
98 changed files with 10432 additions and 18488 deletions
Download Patch File Download Diff File Expand all files Collapse all files
LICENSES
+3 -5
View File
@@ -10030,8 +10030,6 @@ THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
================================================================================
= vendor/github.com/kr/pretty licensed under: =
The MIT License (MIT)
Copyright 2012 Keith Rarick
Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -10052,7 +10050,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
= vendor/github.com/kr/pretty/License 9d305c2010c6891ee4f3cd42a562f78f
= vendor/github.com/kr/pretty/License 449bfedd81a372635934cf9ce004c0cf
================================================================================
@@ -12985,7 +12983,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
MIT License
Copyright (c) 2012-2018 Mat Ryer and Tyler Bunnell
Copyright (c) 2012-2020 Mat Ryer, Tyler Bunnell and contributors.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
@@ -13005,7 +13003,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
= vendor/github.com/stretchr/testify/LICENSE d4c9e9b2abd3afaebed1524a9a77b937
= vendor/github.com/stretchr/testify/LICENSE 188f01994659f3c0d310612333d2a26f
================================================================================
_artifacts/junit__01.xml
+11
View File
@@ -0,0 +1,11 @@
<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="cert-manager e2e suite" tests="9" failures="0" errors="0" time="254.044">
<testcase name="[cert-manager] CA Injector for mutating webhooks should refuse to inject a CA directly from a secret if the allow-direct-injection annotation is not &#39;true&#39;" classname="cert-manager e2e suite" time="10.29025338"></testcase>
<testcase name="[Conformance] Certificates with issuer type SelfSigned ClusterIssuer should issue a certificate that defines an Email Address" classname="cert-manager e2e suite" time="18.04282027"></testcase>
<testcase name="[Conformance] Certificates with issuer type VaultAppRole ClusterIssuer should issue a certificate that defines a CommonName and URI SAN" classname="cert-manager e2e suite" time="34.076825579"></testcase>
<testcase name="[Conformance] [RBAC] Issuers with namespace admin access should be able to patch issuers" classname="cert-manager e2e suite" time="1.02984015"></testcase>
<testcase name="[Conformance] [RBAC] CertificateRequests with namespace view access shouldn&#39;t be able to delete certificaterequests" classname="cert-manager e2e suite" time="1.031698911"></testcase>
<testcase name="[Conformance] [RBAC] Issuers with namespace admin access should be able to create issuers" classname="cert-manager e2e suite" time="1.01970997"></testcase>
<testcase name="[cert-manager] Vault Issuer CertificateRequest (AppRole) should generate a new certificate valid for the default value (90 days)" classname="cert-manager e2e suite" time="22.70861638"></testcase>
<testcase name="[cert-manager] ACME CertificateRequest (DNS01) With rfc2136 credentials configured should obtain a signed certificate for a wildcard and apex domain" classname="cert-manager e2e suite" time="136.778597221"></testcase>
</testsuite>
_artifacts/junit__02.xml
+9
View File
@@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="cert-manager e2e suite" tests="7" failures="0" errors="0" time="253.981">
<testcase name="[cert-manager] CA Certificate when the CA is the root should generate a signed keypair valid for the default duration (90 days)" classname="cert-manager e2e suite" time="21.795020576"></testcase>
<testcase name="[cert-manager] ACME Certificate (DNS01) With rfc2136 credentials configured should obtain a signed certificate for a wildcard and apex domain" classname="cert-manager e2e suite" time="152.545242316"></testcase>
<testcase name="[Conformance] [RBAC] Certificates with namespace view access should be able to get certificates" classname="cert-manager e2e suite" time="1.050215047"></testcase>
<testcase name="[Conformance] Certificates with issuer type CA ClusterIssuer should issue a certificate that defines a CommonName and URI SAN" classname="cert-manager e2e suite" time="19.041010386"></testcase>
<testcase name="[Conformance] Certificates with issuer type CA ClusterIssuer should issue a certificate that defines a Common Name and IP Address" classname="cert-manager e2e suite" time="17.044077633"></testcase>
<testcase name="[Conformance] Certificates with issuer type VaultAppRole ClusterIssuer should issue a certificate that defines an Email Address" classname="cert-manager e2e suite" time="29.43399184"></testcase>
</testsuite>
_artifacts/junit__03.xml
+12
View File
@@ -0,0 +1,12 @@
<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="cert-manager e2e suite" tests="10" failures="0" errors="0" time="254.005">
<testcase name="[Conformance] Certificates with issuer type SelfSigned ClusterIssuer should issue a certificate that includes arbitrary key usages" classname="cert-manager e2e suite" time="23.38503738"></testcase>
<testcase name="[Conformance] Certificates with issuer type VaultAppRole ClusterIssuer should issue a certificate that defines a 2 distinct DNS Name with one copied to the Common Name" classname="cert-manager e2e suite" time="25.211245069"></testcase>
<testcase name="[Conformance] Certificates with External Account Binding with issuer type ACME HTTP01 ClusterIssuer should issue a basic, defaulted certificate for a single commonName and distinct dnsName defined by an ingress with annotations" classname="cert-manager e2e suite" time="43.546828056"></testcase>
<testcase name="[Conformance] Certificates with issuer type CA Issuer should issue a basic, defaulted certificate for a single Common Name" classname="cert-manager e2e suite" time="20.037462271"></testcase>
<testcase name="[cert-manager] ACME CertificateRequest (HTTP01) should obtain a signed certificate with a single CN from the ACME server" classname="cert-manager e2e suite" time="31.749620887"></testcase>
<testcase name="[Conformance] Certificates with issuer type SelfSigned ClusterIssuer should issue a certificate that defines a 2 distinct DNS Name with one copied to the Common Name" classname="cert-manager e2e suite" time="20.046750718"></testcase>
<testcase name="[Conformance] [RBAC] Issuers with namespace edit access should be able to get issuers" classname="cert-manager e2e suite" time="1.025563553"></testcase>
<testcase name="[cert-manager] CA Injector for validating webhooks should inject the CA data into all CA fields" classname="cert-manager e2e suite" time="17.537273622"></testcase>
<testcase name="[cert-manager] ACME Certificate (HTTP01) should obtain a signed certificate for a long domain using http01 validation" classname="cert-manager e2e suite" time="46.552782024"></testcase>
</testsuite>
_artifacts/junit__04.xml
+16
View File
@@ -0,0 +1,16 @@
<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="cert-manager e2e suite" tests="11" failures="0" errors="0" time="253.972">
<testcase name="[cert-manager] CA Injector for conversion webhooks should inject a CA directly from a secret if the inject-ca-from-secret annotation is present" classname="cert-manager e2e suite" time="0.718972045">
<skipped></skipped>
</testcase>
<testcase name="[Conformance] Certificates with issuer type CA Issuer should issue a certificate that defines a CommonName and URI SAN" classname="cert-manager e2e suite" time="22.117725057"></testcase>
<testcase name="[Conformance] Certificates with issuer type SelfSigned ClusterIssuer should issue a certificate that defines a distinct DNS Name and another distinct Common Name" classname="cert-manager e2e suite" time="17.035649858"></testcase>
<testcase name="[Conformance] Certificates with issuer type SelfSigned ClusterIssuer should issue a certificate that defines a DNS Name and sets a duration" classname="cert-manager e2e suite" time="16.087249007"></testcase>
<testcase name="[Conformance] Certificates with issuer type ACME HTTP01 ClusterIssuer should issue an ECDSA, defaulted certificate for a single distinct dnsName" classname="cert-manager e2e suite" time="54.060657401"></testcase>
<testcase name="[cert-manager] ACME Certificate (HTTP01) should obtain a signed ecdsa certificate with a single CN from the ACME server" classname="cert-manager e2e suite" time="47.542538252"></testcase>
<testcase name="[cert-manager] CA Injector for validating webhooks should inject the apiserver CA if the inject-apiserver-ca annotation is present" classname="cert-manager e2e suite" time="4.532619485"></testcase>
<testcase name="[cert-manager] Vault ClusterIssuer CertificateRequest (AppRole) should generate a new certificate with Vault configured maximum TTL duration (90 days) when requested duration is greater than TTL" classname="cert-manager e2e suite" time="13.81146897"></testcase>
<testcase name="[cert-manager] CA Certificate when the CA is an issuer should generate a signed keypair" classname="cert-manager e2e suite" time="22.058098593"></testcase>
<testcase name="[cert-manager] Vault Issuer Certificate (AppRole) should generate a new certificate valid for the default value (90 days)" classname="cert-manager e2e suite" time="22.943591749"></testcase>
<testcase name="[Conformance] Certificates with issuer type VaultAppRole Issuer should issue a certificate that defines a distinct DNS Name and another distinct Common Name" classname="cert-manager e2e suite" time="30.312338003"></testcase>
</testsuite>
_artifacts/junit__05.xml
+18
View File
@@ -0,0 +1,18 @@
<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="cert-manager e2e suite" tests="16" failures="0" errors="0" time="254.026">
<testcase name="[cert-manager] Self Signed Certificate should correctly encode a certificate&#39;s private key based on the key encoding" classname="cert-manager e2e suite" time="25.254576045"></testcase>
<testcase name="[cert-manager] Vault ClusterIssuer CertificateRequest (AppRole) should generate a new certificate with a warning event when renewBefore is bigger than the duration" classname="cert-manager e2e suite" time="20.919952637"></testcase>
<testcase name="[cert-manager] ACME Certificate (HTTP01) should obtain a signed certificate with a single CN from the ACME server" classname="cert-manager e2e suite" time="45.565189352"></testcase>
<testcase name="[cert-manager] CA CertificateRequest when the CA is the root should be able to obtain an ECDSA key from a RSA backed issuer" classname="cert-manager e2e suite" time="5.570778818"></testcase>
<testcase name="[Conformance] [RBAC] Certificates with namespace edit access should be able to delete certificates" classname="cert-manager e2e suite" time="1.024680154"></testcase>
<testcase name="[Conformance] Certificates with issuer type CA ClusterIssuer should issue another certificate with the same private key if the existing certificate and CertificateRequest are deleted" classname="cert-manager e2e suite" time="15.057095025"></testcase>
<testcase name="[Conformance] [RBAC] Issuers with namespace view access shouldn&#39;t be able to create issuers" classname="cert-manager e2e suite" time="1.023784333"></testcase>
<testcase name="[Conformance] [RBAC] Issuers with namespace admin access should be able to list issuers" classname="cert-manager e2e suite" time="1.028816948"></testcase>
<testcase name="[Conformance] [RBAC] Certificates with namespace view access shouldn&#39;t be able to update certificates" classname="cert-manager e2e suite" time="1.031242502"></testcase>
<testcase name="[cert-manager] CA Certificate when the CA is a second level issuer should generate a signed keypair" classname="cert-manager e2e suite" time="17.06173827"></testcase>
<testcase name="[cert-manager] CA Certificate when the CA is the root should generate a signed keypair" classname="cert-manager e2e suite" time="16.551020738"></testcase>
<testcase name="[Conformance] [RBAC] CertificateRequests with namespace admin access should be able to list certificaterequests" classname="cert-manager e2e suite" time="1.025703863"></testcase>
<testcase name="[cert-manager] SelfSigned CertificateRequest Self Signed and private key should be able to obtain an ECDSA Certificate backed by a ECSDA key" classname="cert-manager e2e suite" time="5.053577331"></testcase>
<testcase name="[Conformance] [RBAC] Certificates with namespace edit access should be able to update certificates" classname="cert-manager e2e suite" time="1.038477848"></testcase>
<testcase name="[cert-manager] ACME CertificateRequest (HTTP01) should obtain a signed ecdsa certificate with a single CN from the ACME server" classname="cert-manager e2e suite" time="35.552266796"></testcase>
</testsuite>
_artifacts/junit__06.xml
+17
View File
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="cert-manager e2e suite" tests="12" failures="0" errors="0" time="253.979">
<testcase name="[Conformance] [RBAC] CertificateRequests with namespace edit access should be able to get certificaterequests" classname="cert-manager e2e suite" time="1.11075999"></testcase>
<testcase name="[cert-manager] Vault Issuer Certificate (AppRole) should generate a new valid certificate" classname="cert-manager e2e suite" time="33.564226134"></testcase>
<testcase name="[Conformance] Certificates with issuer type SelfSigned Issuer should issue a basic, defaulted certificate for a single distinct DNS Name" classname="cert-manager e2e suite" time="17.034705573"></testcase>
<testcase name="[cert-manager] Vault Issuer CertificateRequest (AppRole) should generate a new certificate with a warning event when renewBefore is bigger than the duration" classname="cert-manager e2e suite" time="18.227588556"></testcase>
<testcase name="[Conformance] Certificates with issuer type SelfSigned Issuer should issue a certificate that defines a 2 distinct DNS Name with one copied to the Common Name" classname="cert-manager e2e suite" time="14.036787387"></testcase>
<testcase name="[cert-manager] Vault Issuer Certificate (AppRole with a custom mount path) should generate a new valid certificate" classname="cert-manager e2e suite" time="26.769436737"></testcase>
<testcase name="[Conformance] [RBAC] CertificateRequests with namespace admin access should be able to update certificaterequests" classname="cert-manager e2e suite" time="1.030965994"></testcase>
<testcase name="[cert-manager] CA Injector for conversion webhooks should refuse to inject a CA directly from a secret if the allow-direct-injection annotation is not &#39;true&#39;" classname="cert-manager e2e suite" time="2.528700523">
<skipped></skipped>
</testcase>
<testcase name="[Conformance] Certificates with issuer type VaultAppRole Issuer should issue a basic, defaulted certificate for a single commonName and distinct dnsName defined by an ingress with annotations" classname="cert-manager e2e suite" time="29.739428033"></testcase>
<testcase name="[Conformance] Certificates with issuer type ACME DNS01 ClusterIssuer should issue a certificate which has a wildcard DNS name defined" classname="cert-manager e2e suite" time="84.034286247"></testcase>
<testcase name="[Conformance] [RBAC] CertificateRequests with namespace view access shouldn&#39;t be able to delete collections of certificaterequests" classname="cert-manager e2e suite" time="1.023707372"></testcase>
<testcase name="[Conformance] [RBAC] Issuers with namespace edit access should be able to patch issuers" classname="cert-manager e2e suite" time="1.030021437"></testcase>
</testsuite>
_artifacts/junit__07.xml
+11
View File
@@ -0,0 +1,11 @@
<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="cert-manager e2e suite" tests="9" failures="0" errors="0" time="253.987">
<testcase name="[cert-manager] SelfSigned CertificateRequest Self Signed and private key should generate a signed certificate valid for the default duration (90 days)" classname="cert-manager e2e suite" time="3.827546035"></testcase>
<testcase name="[Conformance] [RBAC] Issuers with namespace admin access should be able to delete issuers" classname="cert-manager e2e suite" time="1.059070849"></testcase>
<testcase name="[Conformance] Certificates with External Account Binding with issuer type ACME DNS01 Issuer should issue a certificate which has a wildcard DNS name defined" classname="cert-manager e2e suite" time="86.068542588"></testcase>
<testcase name="[Conformance] Certificates with issuer type CA ClusterIssuer should issue a basic, defaulted certificate for a single distinct DNS Name" classname="cert-manager e2e suite" time="21.096156445"></testcase>
<testcase name="[Conformance] Certificates with External Account Binding with issuer type ACME HTTP01 ClusterIssuer should issue another certificate with the same private key if the existing certificate and CertificateRequest are deleted" classname="cert-manager e2e suite" time="58.084093213"></testcase>
<testcase name="[cert-manager] CA Injector for mutating webhooks should inject the CA data into all CA fields" classname="cert-manager e2e suite" time="15.038786811"></testcase>
<testcase name="[Conformance] [RBAC] CertificateRequests with namespace view access shouldn&#39;t be able to create certificaterequests" classname="cert-manager e2e suite" time="1.02111527"></testcase>
<testcase name="[Conformance] Certificates with issuer type ACME HTTP01 Issuer should issue a basic, defaulted certificate for a single commonName and distinct dnsName defined by an ingress with annotations" classname="cert-manager e2e suite" time="50.03828653"></testcase>
</testsuite>
_artifacts/junit__08.xml
+13
View File
@@ -0,0 +1,13 @@
<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="cert-manager e2e suite" tests="11" failures="0" errors="0" time="253.964">
<testcase name="[Conformance] [RBAC] CertificateRequests with namespace view access shouldn&#39;t be able to patch certificaterequests" classname="cert-manager e2e suite" time="1.135334298"></testcase>
<testcase name="[Conformance] [RBAC] Issuers with namespace edit access should be able to update issuers" classname="cert-manager e2e suite" time="1.028456148"></testcase>
<testcase name="[cert-manager] Vault ClusterIssuer Certificate (AppRole) should generate a new certificate valid for 35 days" classname="cert-manager e2e suite" time="31.635748026"></testcase>
<testcase name="[cert-manager] Vault Issuer should fail to init with missing Kubernetes Role" classname="cert-manager e2e suite" time="15.459763564"></testcase>
<testcase name="[Conformance] Certificates with issuer type VaultAppRole Issuer should issue a certificate which has a wildcard DNS name defined" classname="cert-manager e2e suite" time="25.111843731"></testcase>
<testcase name="[Conformance] Certificates with External Account Binding with issuer type ACME HTTP01 Issuer should issue another certificate with the same private key if the existing certificate and CertificateRequest are deleted" classname="cert-manager e2e suite" time="84.048371353"></testcase>
<testcase name="[Conformance] Certificates with issuer type CA ClusterIssuer should issue a certificate that defines a DNS Name and sets a duration" classname="cert-manager e2e suite" time="18.04750823"></testcase>
<testcase name="[Conformance] Certificates with issuer type VaultAppRole ClusterIssuer should issue a basic, defaulted certificate for a single commonName and distinct dnsName defined by an ingress with annotations" classname="cert-manager e2e suite" time="26.101786903"></testcase>
<testcase name="[Conformance] Certificates with issuer type SelfSigned Issuer should issue a basic, defaulted certificate for a single commonName and distinct dnsName defined by an ingress with annotations" classname="cert-manager e2e suite" time="14.54499249"></testcase>
<testcase name="[cert-manager] CA Injector for mutating webhooks should inject the apiserver CA if the inject-apiserver-ca annotation is present" classname="cert-manager e2e suite" time="2.032922101"></testcase>
</testsuite>
_artifacts/junit__09.xml
+14
View File
@@ -0,0 +1,14 @@
<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="cert-manager e2e suite" tests="12" failures="0" errors="0" time="253.95">
<testcase name="[Conformance] Certificates with issuer type CA Issuer should issue a certificate that includes arbitrary key usages" classname="cert-manager e2e suite" time="21.344250038"></testcase>
<testcase name="[Conformance] Certificates with issuer type VaultAppRole Issuer should issue an ECDSA, defaulted certificate for a single Common Name" classname="cert-manager e2e suite" time="28.846103221"></testcase>
<testcase name="[cert-manager] ACME Issuer should handle updates to the email field" classname="cert-manager e2e suite" time="5.051676891"></testcase>
<testcase name="[Conformance] Certificates with issuer type SelfSigned Issuer should issue a certificate that defines a DNS Name and sets a duration" classname="cert-manager e2e suite" time="15.037814362"></testcase>
<testcase name="[Conformance] Certificates with issuer type SelfSigned ClusterIssuer should issue an ECDSA, defaulted certificate for a single Common Name" classname="cert-manager e2e suite" time="15.037769945"></testcase>
<testcase name="[Conformance] [RBAC] CertificateRequests with namespace admin access should be able to delete certificaterequests" classname="cert-manager e2e suite" time="1.037282078"></testcase>
<testcase name="[Conformance] Certificates with issuer type SelfSigned ClusterIssuer should issue a basic, defaulted certificate for a single commonName and distinct dnsName defined by an ingress with annotations" classname="cert-manager e2e suite" time="24.553148254"></testcase>
<testcase name="[Conformance] Certificates with issuer type VaultAppRole ClusterIssuer should issue a certificate that defines a DNS Name and sets a duration" classname="cert-manager e2e suite" time="23.957640384"></testcase>
<testcase name="[Conformance] Certificates with issuer type ACME HTTP01 Issuer should issue a basic, defaulted certificate for a single distinct DNS Name" classname="cert-manager e2e suite" time="46.050483852"></testcase>
<testcase name="[Conformance] [RBAC] Issuers with namespace admin access should be able to update issuers" classname="cert-manager e2e suite" time="1.037534777"></testcase>
<testcase name="[Conformance] Certificates with issuer type SelfSigned Issuer should issue an ECDSA, defaulted certificate for a single Common Name" classname="cert-manager e2e suite" time="21.039708841"></testcase>
</testsuite>
_artifacts/junit__10.xml
+14
View File
@@ -0,0 +1,14 @@
<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="cert-manager e2e suite" tests="12" failures="0" errors="0" time="253.931">
<testcase name="[Conformance] Certificates with issuer type VaultAppRole ClusterIssuer should issue a certificate that includes only a URISANs name" classname="cert-manager e2e suite" time="28.63689484"></testcase>
<testcase name="[cert-manager] Vault Issuer CertificateRequest (AppRole with a custom mount path) should generate a new valid certificate" classname="cert-manager e2e suite" time="19.720646726"></testcase>
<testcase name="[Conformance] Certificates with issuer type CA Issuer should issue a certificate that defines an Email Address" classname="cert-manager e2e suite" time="17.056584773"></testcase>
<testcase name="[cert-manager] Vault ClusterIssuer Certificate (AppRole with a custom mount path) should generate a new valid certificate" classname="cert-manager e2e suite" time="40.687180612"></testcase>
<testcase name="[Conformance] Certificates with issuer type VaultAppRole ClusterIssuer should issue a basic, defaulted certificate for a single Common Name" classname="cert-manager e2e suite" time="26.312560407"></testcase>
<testcase name="[Conformance] Certificates with issuer type VaultAppRole Issuer should issue another certificate with the same private key if the existing certificate and CertificateRequest are deleted" classname="cert-manager e2e suite" time="41.335649056"></testcase>
<testcase name="[cert-manager] Vault Issuer Certificate (AppRole) should generate a new certificate valid for 35 days" classname="cert-manager e2e suite" time="29.211250397"></testcase>
<testcase name="[cert-manager] Vault Issuer should fail to init with missing Vault Token" classname="cert-manager e2e suite" time="9.90800354"></testcase>
<testcase name="[cert-manager] Self Signed Certificate should generate a signed keypair valid for the default duration (90 days)" classname="cert-manager e2e suite" time="15.556856545"></testcase>
<testcase name="[Conformance] Certificates with issuer type CA Issuer should issue a basic, defaulted certificate for a single distinct DNS Name" classname="cert-manager e2e suite" time="18.030562623"></testcase>
<testcase name="[cert-manager] ACME Issuer should fail to register an ACME account" classname="cert-manager e2e suite" time="2.528414722"></testcase>
</testsuite>
cmd/cainjector/BUILD.bazel
-1
View File
@@ -11,7 +11,6 @@ go_library(
"//cmd/cainjector/app:go_default_library",
"//pkg/logs:go_default_library",
"//pkg/util/cmd:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
"@io_k8s_sigs_controller_runtime//:go_default_library",
],
)
cmd/cainjector/main.go
+7 -5
View File
@@ -18,20 +18,21 @@ package main
import (
"flag"
"os"
"k8s.io/klog/v2"
ctrl "sigs.k8s.io/controller-runtime"
"github.com/jetstack/cert-manager/cmd/cainjector/app"
"github.com/jetstack/cert-manager/pkg/logs"
logf "github.com/jetstack/cert-manager/pkg/logs"
utilcmd "github.com/jetstack/cert-manager/pkg/util/cmd"
)
func main() {
logs.InitLogs(flag.CommandLine)
defer logs.FlushLogs()
ctrl.SetLogger(logs.Log)
logf.InitLogs(flag.CommandLine)
defer logf.FlushLogs()
ctrl.SetLogger(logf.Log)
stopCh := utilcmd.SetupSignalHandler()
cmd := app.NewCommandStartInjectorController(os.Stdout, os.Stderr, stopCh)
@@ -39,6 +40,7 @@ func main() {
flag.CommandLine.Parse([]string{})
if err := cmd.Execute(); err != nil {
klog.Fatal(err)
logf.Log.V(logs.ErrorLevel).Error(err, "")
os.Exit(1)
}
}
cmd/controller/BUILD.bazel
-1
View File
@@ -11,7 +11,6 @@ go_library(
"//cmd/controller/app:go_default_library",
"//pkg/logs:go_default_library",
"//pkg/util/cmd:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
],
)
cmd/controller/app/BUILD.bazel
-1
View File
@@ -46,7 +46,6 @@ go_library(
"@io_k8s_client_go//tools/leaderelection:go_default_library",
"@io_k8s_client_go//tools/leaderelection/resourcelock:go_default_library",
"@io_k8s_client_go//tools/record:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
"@io_k8s_utils//clock:go_default_library",
],
)
cmd/controller/app/controller.go
+11 -12
View File
@@ -35,7 +35,6 @@ import (
"k8s.io/client-go/tools/leaderelection"
"k8s.io/client-go/tools/leaderelection/resourcelock"
"k8s.io/client-go/tools/record"
"k8s.io/klog/v2"
"k8s.io/utils/clock"
"github.com/jetstack/cert-manager/cmd/controller/app/options"
@@ -78,13 +77,13 @@ func Run(opts *options.ControllerOptions, stopCh <-chan struct{}) {
// only run a controller if it's been enabled
if !util.Contains(opts.EnabledControllers, n) {
log.Info("not starting controller as it's disabled")
log.V(logf.InfoLevel).Info("not starting controller as it's disabled")
continue
}
// don't run clusterissuers controller if scoped to a single namespace
if ctx.Namespace != "" && n == clusterissuers.ControllerName {
log.Info("not starting controller as cert-manager has been scoped to a single namespace")
log.V(logf.InfoLevel).Info("not starting controller as cert-manager has been scoped to a single namespace")
continue
}
@@ -96,23 +95,23 @@ func Run(opts *options.ControllerOptions, stopCh <-chan struct{}) {
}
go func(n string, fn controller.Interface) {
defer wg.Done()
log.Info("starting controller")
log.V(logf.DebugLevel).Info("starting controller")
workers := 5
err := fn.Run(workers, stopCh)
if err != nil {
log.Error(err, "error starting controller")
log.V(logf.WarnLevel).Error(err, "error starting controller")
os.Exit(1)
}
}(n, iface)
}
log.V(4).Info("starting shared informer factories")
log.V(logf.DebugLevel).Info("starting shared informer factories")
ctx.SharedInformerFactory.Start(stopCh)
ctx.KubeSharedInformerFactory.Start(stopCh)
wg.Wait()
log.Info("control loops exited")
log.V(logf.InfoLevel).Info("control loops exited")
ctx.Metrics.Shutdown(metricsServer)
os.Exit(0)
}
@@ -122,10 +121,10 @@ func Run(opts *options.ControllerOptions, stopCh <-chan struct{}) {
return
}
log.Info("starting leader election")
log.V(logf.InfoLevel).Info("starting leader election")
leaderElectionClient, err := kubernetes.NewForConfig(rest.AddUserAgent(kubeCfg, "leader-election"))
if err != nil {
log.Error(err, "error creating leader election client")
log.V(logf.ErrorLevel).Error(err, "error creating leader election client")
os.Exit(1)
}
@@ -185,9 +184,9 @@ func buildControllerContext(ctx context.Context, stopCh <-chan struct{}, opts *o
// Add cert-manager types to the default Kubernetes Scheme so Events can be
// logged properly
intscheme.AddToScheme(scheme.Scheme)
log.V(4).Info("creating event broadcaster")
log.V(logf.DebugLevel).Info("creating event broadcaster")
eventBroadcaster := record.NewBroadcaster()
eventBroadcaster.StartLogging(klog.V(4).Infof)
eventBroadcaster.StartLogging(log.V(logf.DebugLevel).Info)
eventBroadcaster.StartRecordingToSink(&corev1.EventSinkImpl{Interface: cl.CoreV1().Events("")})
recorder := eventBroadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: controllerAgentName})
@@ -271,7 +270,7 @@ func startLeaderElection(ctx context.Context, opts *options.ControllerOptions, l
Callbacks: leaderelection.LeaderCallbacks{
OnStartedLeading: run,
OnStoppedLeading: func() {
log.Info("leader election lost")
log.V(logf.ErrorLevel).Info("leader election lost")
os.Exit(1)
},
},
cmd/controller/app/start.go
+1 -1
View File
@@ -71,7 +71,7 @@ to renew certificates at an appropriate time before expiry.`,
return fmt.Errorf("error validating options: %s", err)
}
logf.Log.Info("starting controller", "version", util.AppVersion, "git-commit", util.AppGitCommit)
logf.Log.V(logf.InfoLevel).Info("starting controller", "version", util.AppVersion, "git-commit", util.AppGitCommit)
o.RunCertManagerController(stopCh)
return nil
},
cmd/controller/main.go
+3 -3
View File
@@ -18,8 +18,7 @@ package main
import (
"flag"
"k8s.io/klog/v2"
"os"
"github.com/jetstack/cert-manager/cmd/controller/app"
logf "github.com/jetstack/cert-manager/pkg/logs"
@@ -36,6 +35,7 @@ func main() {
flag.CommandLine.Parse([]string{})
if err := cmd.Execute(); err != nil {
klog.Info(err)
logf.Log.V(logf.ErrorLevel).Error(err, "")
os.Exit(1)
}
}
cmd/ctl/pkg/convert/BUILD.bazel
+1 -1
View File
@@ -8,6 +8,7 @@ go_library(
deps = [
"//pkg/apis/certmanager/v1alpha2:go_default_library",
"//pkg/ctl:go_default_library",
"//pkg/logs:go_default_library",
"@com_github_spf13_cobra//:go_default_library",
"@io_k8s_apimachinery//pkg/apis/meta/internalversion:go_default_library",
"@io_k8s_apimachinery//pkg/runtime:go_default_library",
@@ -17,7 +18,6 @@ go_library(
"@io_k8s_cli_runtime//pkg/genericclioptions:go_default_library",
"@io_k8s_cli_runtime//pkg/printers:go_default_library",
"@io_k8s_cli_runtime//pkg/resource:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
"@io_k8s_kubectl//pkg/cmd/util:go_default_library",
"@io_k8s_kubectl//pkg/util/i18n:go_default_library",
"@io_k8s_kubectl//pkg/util/templates:go_default_library",
cmd/ctl/pkg/convert/convert.go
+3 -2
View File
@@ -19,6 +19,8 @@ package convert
import (
"fmt"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/spf13/cobra"
metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
"k8s.io/apimachinery/pkg/runtime"
@@ -28,7 +30,6 @@ import (
"k8s.io/cli-runtime/pkg/genericclioptions"
"k8s.io/cli-runtime/pkg/printers"
"k8s.io/cli-runtime/pkg/resource"
"k8s.io/klog/v2"
cmdutil "k8s.io/kubectl/pkg/cmd/util"
"k8s.io/kubectl/pkg/util/i18n"
"k8s.io/kubectl/pkg/util/templates"
@@ -201,7 +202,7 @@ func asVersionedObject(infos []*resource.Info, forceList bool, specifiedOutputVe
if len(actualVersion.Version) > 0 {
defaultVersionInfo = fmt.Sprintf("Defaulting to %q", actualVersion.Version)
}
klog.V(1).Infof("info: the output version specified is invalid. %s\n", defaultVersionInfo)
logf.Log.V(logf.WarnLevel).Info("info: the output version specified is invalid. %s\n", defaultVersionInfo)
}
return object, nil
cmd/webhook/BUILD.bazel
-1
View File
@@ -11,7 +11,6 @@ go_library(
"//cmd/webhook/app:go_default_library",
"//pkg/logs:go_default_library",
"//pkg/util/cmd:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
],
)
cmd/webhook/app/webhook.go
+3 -3
View File
@@ -42,7 +42,7 @@ func NewServerWithOptions(log logr.Logger, opts options.WebhookOptions) (*server
var source tls.CertificateSource
switch {
case options.FileTLSSourceEnabled(opts):
log.Info("using TLS certificate from local filesystem", "private_key_path", opts.TLSKeyFile, "certificate", opts.TLSCertFile)
log.V(logf.InfoLevel).Info("using TLS certificate from local filesystem", "private_key_path", opts.TLSKeyFile, "certificate", opts.TLSCertFile)
source = &tls.FileCertificateSource{
CertPath: opts.TLSCertFile,
KeyPath: opts.TLSKeyFile,
@@ -54,7 +54,7 @@ func NewServerWithOptions(log logr.Logger, opts options.WebhookOptions) (*server
return nil, err
}
log.Info("using dynamic certificate generating using CA stored in Secret resource", "secret_namespace", opts.DynamicServingCASecretNamespace, "secret_name", opts.DynamicServingCASecretName)
log.V(logf.InfoLevel).Info("using dynamic certificate generating using CA stored in Secret resource", "secret_namespace", opts.DynamicServingCASecretNamespace, "secret_name", opts.DynamicServingCASecretName)
source = &tls.DynamicSource{
DNSNames: opts.DynamicServingDNSNames,
Authority: &authority.DynamicAuthority{
@@ -66,7 +66,7 @@ func NewServerWithOptions(log logr.Logger, opts options.WebhookOptions) (*server
Log: log,
}
default:
log.Info("warning: serving insecurely as tls certificate data not provided")
log.V(logf.WarnLevel).Info("warning: serving insecurely as tls certificate data not provided")
}
return &server.Server{
cmd/webhook/main.go
+3 -3
View File
@@ -18,8 +18,7 @@ package main
import (
"flag"
"k8s.io/klog/v2"
"os"
"github.com/jetstack/cert-manager/cmd/webhook/app"
logf "github.com/jetstack/cert-manager/pkg/logs"
@@ -36,6 +35,7 @@ func main() {
flag.CommandLine.Parse([]string{})
if err := cmd.Execute(); err != nil {
klog.Error(err)
logf.Log.V(logf.ErrorLevel).Error(err, "")
os.Exit(1)
}
}
deploy/crds/crd-certificaterequests.yaml
+368 -506
View File
@@ -12,24 +12,21 @@ metadata:
helm.sh/chart: '{{ template "cert-manager.chart" . }}'
spec:
additionalPrinterColumns:
- JSONPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
priority: 1
type: string
- JSONPath: .status.conditions[?(@.type=="Ready")].message
name: Status
priority: 1
type: string
- JSONPath: .metadata.creationTimestamp
description: CreationTimestamp is a timestamp representing the server time when
this object was created. It is not guaranteed to be set in happens-before order
across separate operations. Clients may not set this value. It is represented
in RFC3339 form and is in UTC.
name: Age
type: date
- JSONPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
priority: 1
type: string
- JSONPath: .status.conditions[?(@.type=="Ready")].message
name: Status
priority: 1
type: string
- JSONPath: .metadata.creationTimestamp
description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
name: Age
type: date
group: cert-manager.io
preserveUnknownFields: false
conversion:
@@ -46,519 +43,384 @@ spec:
listKind: CertificateRequestList
plural: certificaterequests
shortNames:
- cr
- crs
- cr
- crs
singular: certificaterequest
scope: Namespaced
subresources:
status: {}
versions:
- name: v1alpha2
served: true
storage: true
"schema":
"openAPIV3Schema":
description: "A CertificateRequest is used to request a signed certificate
from one of the configured issuers. \n All fields within the CertificateRequest's
`spec` are immutable after creation. A CertificateRequest will either succeed
or fail, as denoted by its `status.state` field. \n A CertificateRequest
is a 'one-shot' resource, meaning it represents a single point in time request
for a certificate and cannot be re-used."
type: object
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Desired state of the CertificateRequest resource.
type: object
required:
- csr
- issuerRef
properties:
csr:
description: The PEM-encoded x509 certificate signing request to be
submitted to the CA for signing.
type: string
format: byte
duration:
description: The requested 'duration' (i.e. lifetime) of the Certificate.
This option may be ignored/overridden by some issuer types.
type: string
isCA:
description: IsCA will request to mark the certificate as valid for
certificate signing when submitting to the issuer. This will automatically
add the `cert sign` usage to the list of `usages`.
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this CertificateRequest. If
the 'kind' field is not set, or set to 'Issuer', an Issuer resource
with the given name in the same namespace as the CertificateRequest
will be used. If the 'kind' field is set to 'ClusterIssuer', a
ClusterIssuer with the provided name will be used. The 'name' field
in this stanza is required at all times. The group field refers
to the API group of the issuer which defaults to 'cert-manager.io'
if empty.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
usages:
description: Usages is the set of x509 usages that are requested for
the certificate. Defaults to `digital signature` and `key encipherment`
if not specified.
type: array
items:
description: 'KeyUsage specifies valid usage contexts for keys.
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
Valid KeyUsage values are as follows: "signing", "digital signature",
"content commitment", "key encipherment", "key agreement", "data
encipherment", "cert sign", "crl sign", "encipher only", "decipher
only", "any", "server auth", "client auth", "code signing", "email
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
sgc"'
- name: v1alpha2
served: true
storage: true
"schema":
"openAPIV3Schema":
description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a 'one-shot' resource, meaning it represents a single point in time request for a certificate and cannot be re-used."
type: object
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Desired state of the CertificateRequest resource.
type: object
required:
- csr
- issuerRef
properties:
csr:
description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing.
type: string
enum:
- signing
- digital signature
- content commitment
- key encipherment
- key agreement
- data encipherment
- cert sign
- crl sign
- encipher only
- decipher only
- any
- server auth
- client auth
- code signing
- email protection
- s/mime
- ipsec end system
- ipsec tunnel
- ipsec user
- timestamping
- ocsp signing
- microsoft sgc
- netscape sgc
status:
description: Status of the CertificateRequest. This is set and managed
automatically.
type: object
properties:
ca:
description: The PEM encoded x509 certificate of the signer, also
known as the CA (Certificate Authority). This is set on a best-effort
basis by different issuers. If not set, the CA is assumed to be
unknown/not available.
type: string
format: byte
certificate:
description: The PEM encoded x509 certificate resulting from the certificate
signing request. If not set, the CertificateRequest has either not
been completed or has failed. More information on failure can be
found by checking the `conditions` field.
type: string
format: byte
conditions:
description: List of status conditions to indicate the status of a
CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
type: array
items:
description: CertificateRequestCondition contains condition information
for a CertificateRequest.
format: byte
duration:
description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types.
type: string
isCA:
description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`.
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this CertificateRequest. If the 'kind' field is not set, or set to 'Issuer', an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer with the provided name will be used. The 'name' field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to 'cert-manager.io' if empty.
type: object
required:
- status
- type
- name
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding
to the last status change of this condition.
group:
description: Group of the resource being referred to.
type: string
format: date-time
message:
description: Message is a human readable description of the
details of the last transition, complementing reason.
kind:
description: Kind of the resource being referred to.
type: string
reason:
description: Reason is a brief machine readable explanation
for the condition's last transition.
name:
description: Name of the resource being referred to.
type: string
status:
description: Status of the condition, one of ('True', 'False',
'Unknown').
type: string
enum:
- "True"
- "False"
- Unknown
type:
description: Type of the condition, known values are ('Ready',
'InvalidRequest').
type: string
failureTime:
description: FailureTime stores the time that this CertificateRequest
failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
- name: v1alpha3
served: true
storage: false
"schema":
"openAPIV3Schema":
description: "A CertificateRequest is used to request a signed certificate
from one of the configured issuers. \n All fields within the CertificateRequest's
`spec` are immutable after creation. A CertificateRequest will either succeed
or fail, as denoted by its `status.state` field. \n A CertificateRequest
is a 'one-shot' resource, meaning it represents a single point in time request
for a certificate and cannot be re-used."
type: object
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Desired state of the CertificateRequest resource.
type: object
required:
- csr
- issuerRef
properties:
csr:
description: The PEM-encoded x509 certificate signing request to be
submitted to the CA for signing.
type: string
format: byte
duration:
description: The requested 'duration' (i.e. lifetime) of the Certificate.
This option may be ignored/overridden by some issuer types.
type: string
isCA:
description: IsCA will request to mark the certificate as valid for
certificate signing when submitting to the issuer. This will automatically
add the `cert sign` usage to the list of `usages`.
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this CertificateRequest. If
the 'kind' field is not set, or set to 'Issuer', an Issuer resource
with the given name in the same namespace as the CertificateRequest
will be used. If the 'kind' field is set to 'ClusterIssuer', a
ClusterIssuer with the provided name will be used. The 'name' field
in this stanza is required at all times. The group field refers
to the API group of the issuer which defaults to 'cert-manager.io'
if empty.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
usages:
description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified.
type: array
items:
description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"'
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
usages:
description: Usages is the set of x509 usages that are requested for
the certificate. Defaults to `digital signature` and `key encipherment`
if not specified.
type: array
items:
description: 'KeyUsage specifies valid usage contexts for keys.
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
Valid KeyUsage values are as follows: "signing", "digital signature",
"content commitment", "key encipherment", "key agreement", "data
encipherment", "cert sign", "crl sign", "encipher only", "decipher
only", "any", "server auth", "client auth", "code signing", "email
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
sgc"'
enum:
- signing
- digital signature
- content commitment
- key encipherment
- key agreement
- data encipherment
- cert sign
- crl sign
- encipher only
- decipher only
- any
- server auth
- client auth
- code signing
- email protection
- s/mime
- ipsec end system
- ipsec tunnel
- ipsec user
- timestamping
- ocsp signing
- microsoft sgc
- netscape sgc
status:
description: Status of the CertificateRequest. This is set and managed automatically.
type: object
properties:
ca:
description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available.
type: string
enum:
- signing
- digital signature
- content commitment
- key encipherment
- key agreement
- data encipherment
- cert sign
- crl sign
- encipher only
- decipher only
- any
- server auth
- client auth
- code signing
- email protection
- s/mime
- ipsec end system
- ipsec tunnel
- ipsec user
- timestamping
- ocsp signing
- microsoft sgc
- netscape sgc
status:
description: Status of the CertificateRequest. This is set and managed
automatically.
type: object
properties:
ca:
description: The PEM encoded x509 certificate of the signer, also
known as the CA (Certificate Authority). This is set on a best-effort
basis by different issuers. If not set, the CA is assumed to be
unknown/not available.
type: string
format: byte
certificate:
description: The PEM encoded x509 certificate resulting from the certificate
signing request. If not set, the CertificateRequest has either not
been completed or has failed. More information on failure can be
found by checking the `conditions` field.
type: string
format: byte
conditions:
description: List of status conditions to indicate the status of a
CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
type: array
items:
description: CertificateRequestCondition contains condition information
for a CertificateRequest.
format: byte
certificate:
description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field.
type: string
format: byte
conditions:
description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
type: array
items:
description: CertificateRequestCondition contains condition information for a CertificateRequest.
type: object
required:
- status
- type
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
type: string
format: date-time
message:
description: Message is a human readable description of the details of the last transition, complementing reason.
type: string
reason:
description: Reason is a brief machine readable explanation for the condition's last transition.
type: string
status:
description: Status of the condition, one of ('True', 'False', 'Unknown').
type: string
enum:
- "True"
- "False"
- Unknown
type:
description: Type of the condition, known values are ('Ready', 'InvalidRequest').
type: string
failureTime:
description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
- name: v1alpha3
served: true
storage: false
"schema":
"openAPIV3Schema":
description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a 'one-shot' resource, meaning it represents a single point in time request for a certificate and cannot be re-used."
type: object
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Desired state of the CertificateRequest resource.
type: object
required:
- csr
- issuerRef
properties:
csr:
description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing.
type: string
format: byte
duration:
description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types.
type: string
isCA:
description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`.
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this CertificateRequest. If the 'kind' field is not set, or set to 'Issuer', an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer with the provided name will be used. The 'name' field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to 'cert-manager.io' if empty.
type: object
required:
- status
- type
- name
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding
to the last status change of this condition.
group:
description: Group of the resource being referred to.
type: string
format: date-time
message:
description: Message is a human readable description of the
details of the last transition, complementing reason.
kind:
description: Kind of the resource being referred to.
type: string
reason:
description: Reason is a brief machine readable explanation
for the condition's last transition.
name:
description: Name of the resource being referred to.
type: string
status:
description: Status of the condition, one of ('True', 'False',
'Unknown').
type: string
enum:
- "True"
- "False"
- Unknown
type:
description: Type of the condition, known values are ('Ready',
'InvalidRequest').
type: string
failureTime:
description: FailureTime stores the time that this CertificateRequest
failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
- name: v1beta1
served: true
storage: false
"schema":
"openAPIV3Schema":
description: "A CertificateRequest is used to request a signed certificate
from one of the configured issuers. \n All fields within the CertificateRequest's
`spec` are immutable after creation. A CertificateRequest will either succeed
or fail, as denoted by its `status.state` field. \n A CertificateRequest
is a 'one-shot' resource, meaning it represents a single point in time request
for a certificate and cannot be re-used."
type: object
required:
- spec
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Desired state of the CertificateRequest resource.
type: object
required:
- issuerRef
- request
properties:
duration:
description: The requested 'duration' (i.e. lifetime) of the Certificate.
This option may be ignored/overridden by some issuer types.
type: string
isCA:
description: IsCA will request to mark the certificate as valid for
certificate signing when submitting to the issuer. This will automatically
add the `cert sign` usage to the list of `usages`.
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this CertificateRequest. If
the 'kind' field is not set, or set to 'Issuer', an Issuer resource
with the given name in the same namespace as the CertificateRequest
will be used. If the 'kind' field is set to 'ClusterIssuer', a
ClusterIssuer with the provided name will be used. The 'name' field
in this stanza is required at all times. The group field refers
to the API group of the issuer which defaults to 'cert-manager.io'
if empty.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
usages:
description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified.
type: array
items:
description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"'
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
request:
description: The PEM-encoded x509 certificate signing request to be
submitted to the CA for signing.
type: string
format: byte
usages:
description: Usages is the set of x509 usages that are requested for
the certificate. Defaults to `digital signature` and `key encipherment`
if not specified.
type: array
items:
description: 'KeyUsage specifies valid usage contexts for keys.
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
Valid KeyUsage values are as follows: "signing", "digital signature",
"content commitment", "key encipherment", "key agreement", "data
encipherment", "cert sign", "crl sign", "encipher only", "decipher
only", "any", "server auth", "client auth", "code signing", "email
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
sgc"'
enum:
- signing
- digital signature
- content commitment
- key encipherment
- key agreement
- data encipherment
- cert sign
- crl sign
- encipher only
- decipher only
- any
- server auth
- client auth
- code signing
- email protection
- s/mime
- ipsec end system
- ipsec tunnel
- ipsec user
- timestamping
- ocsp signing
- microsoft sgc
- netscape sgc
status:
description: Status of the CertificateRequest. This is set and managed automatically.
type: object
properties:
ca:
description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available.
type: string
enum:
- signing
- digital signature
- content commitment
- key encipherment
- key agreement
- data encipherment
- cert sign
- crl sign
- encipher only
- decipher only
- any
- server auth
- client auth
- code signing
- email protection
- s/mime
- ipsec end system
- ipsec tunnel
- ipsec user
- timestamping
- ocsp signing
- microsoft sgc
- netscape sgc
status:
description: Status of the CertificateRequest. This is set and managed
automatically.
type: object
properties:
ca:
description: The PEM encoded x509 certificate of the signer, also
known as the CA (Certificate Authority). This is set on a best-effort
basis by different issuers. If not set, the CA is assumed to be
unknown/not available.
type: string
format: byte
certificate:
description: The PEM encoded x509 certificate resulting from the certificate
signing request. If not set, the CertificateRequest has either not
been completed or has failed. More information on failure can be
found by checking the `conditions` field.
type: string
format: byte
conditions:
description: List of status conditions to indicate the status of a
CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
type: array
items:
description: CertificateRequestCondition contains condition information
for a CertificateRequest.
format: byte
certificate:
description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field.
type: string
format: byte
conditions:
description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
type: array
items:
description: CertificateRequestCondition contains condition information for a CertificateRequest.
type: object
required:
- status
- type
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
type: string
format: date-time
message:
description: Message is a human readable description of the details of the last transition, complementing reason.
type: string
reason:
description: Reason is a brief machine readable explanation for the condition's last transition.
type: string
status:
description: Status of the condition, one of ('True', 'False', 'Unknown').
type: string
enum:
- "True"
- "False"
- Unknown
type:
description: Type of the condition, known values are ('Ready', 'InvalidRequest').
type: string
failureTime:
description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
- name: v1beta1
served: true
storage: false
"schema":
"openAPIV3Schema":
description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a 'one-shot' resource, meaning it represents a single point in time request for a certificate and cannot be re-used."
type: object
required:
- spec
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Desired state of the CertificateRequest resource.
type: object
required:
- issuerRef
- request
properties:
duration:
description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types.
type: string
isCA:
description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`.
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this CertificateRequest. If the 'kind' field is not set, or set to 'Issuer', an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer with the provided name will be used. The 'name' field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to 'cert-manager.io' if empty.
type: object
required:
- status
- type
- name
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding
to the last status change of this condition.
group:
description: Group of the resource being referred to.
type: string
format: date-time
message:
description: Message is a human readable description of the
details of the last transition, complementing reason.
kind:
description: Kind of the resource being referred to.
type: string
reason:
description: Reason is a brief machine readable explanation
for the condition's last transition.
name:
description: Name of the resource being referred to.
type: string
status:
description: Status of the condition, one of ('True', 'False',
'Unknown').
type: string
enum:
- "True"
- "False"
- Unknown
type:
description: Type of the condition, known values are ('Ready',
'InvalidRequest').
type: string
failureTime:
description: FailureTime stores the time that this CertificateRequest
failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
request:
description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing.
type: string
format: byte
usages:
description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified.
type: array
items:
description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"'
type: string
enum:
- signing
- digital signature
- content commitment
- key encipherment
- key agreement
- data encipherment
- cert sign
- crl sign
- encipher only
- decipher only
- any
- server auth
- client auth
- code signing
- email protection
- s/mime
- ipsec end system
- ipsec tunnel
- ipsec user
- timestamping
- ocsp signing
- microsoft sgc
- netscape sgc
status:
description: Status of the CertificateRequest. This is set and managed automatically.
type: object
properties:
ca:
description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available.
type: string
format: byte
certificate:
description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field.
type: string
format: byte
conditions:
description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
type: array
items:
description: CertificateRequestCondition contains condition information for a CertificateRequest.
type: object
required:
- status
- type
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
type: string
format: date-time
message:
description: Message is a human readable description of the details of the last transition, complementing reason.
type: string
reason:
description: Reason is a brief machine readable explanation for the condition's last transition.
type: string
status:
description: Status of the condition, one of ('True', 'False', 'Unknown').
type: string
enum:
- "True"
- "False"
- Unknown
type:
description: Type of the condition, known values are ('Ready', 'InvalidRequest').
type: string
failureTime:
description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
deploy/crds/crd-certificates.yaml
+811 -1145
View File
File diff suppressed because it is too large Load Diff
deploy/crds/crd-challenges.yaml
+2406 -4415
View File
File diff suppressed because it is too large Load Diff
deploy/crds/crd-clusterissuers.yaml
+2988 -5790
View File
File diff suppressed because it is too large Load Diff
deploy/crds/crd-issuers.yaml
+2988 -5787
View File
File diff suppressed because it is too large Load Diff
deploy/crds/crd-orders.yaml
+388 -556
View File
@@ -12,24 +12,21 @@ metadata:
helm.sh/chart: '{{ template "cert-manager.chart" . }}'
spec:
additionalPrinterColumns:
- JSONPath: .status.state
name: State
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
priority: 1
type: string
- JSONPath: .status.reason
name: Reason
priority: 1
type: string
- JSONPath: .metadata.creationTimestamp
description: CreationTimestamp is a timestamp representing the server time when
this object was created. It is not guaranteed to be set in happens-before order
across separate operations. Clients may not set this value. It is represented
in RFC3339 form and is in UTC.
name: Age
type: date
- JSONPath: .status.state
name: State
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
priority: 1
type: string
- JSONPath: .status.reason
name: Reason
priority: 1
type: string
- JSONPath: .metadata.creationTimestamp
description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
name: Age
type: date
group: acme.cert-manager.io
preserveUnknownFields: false
conversion:
@@ -50,565 +47,400 @@ spec:
subresources:
status: {}
versions:
- name: v1alpha2
served: true
storage: true
"schema":
"openAPIV3Schema":
description: Order is a type to represent an Order with an ACME server
type: object
required:
- metadata
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
type: object
required:
- csr
- dnsNames
- issuerRef
properties:
commonName:
description: CommonName is the common name as specified on the DER
encoded CSR. If specified, this value must also be present in `dnsNames`.
This field must match the corresponding field on the DER encoded
CSR.
type: string
csr:
description: Certificate signing request bytes in DER encoding. This
will be used when finalizing the order. This field must be set on
the order.
type: string
format: byte
dnsNames:
description: DNSNames is a list of DNS names that should be included
as part of the Order validation process. This field must match the
corresponding field on the DER encoded CSR.
type: array
items:
- name: v1alpha2
served: true
storage: true
"schema":
"openAPIV3Schema":
description: Order is a type to represent an Order with an ACME server
type: object
required:
- metadata
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
type: object
required:
- csr
- dnsNames
- issuerRef
properties:
commonName:
description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames`. This field must match the corresponding field on the DER encoded CSR.
type: string
issuerRef:
description: IssuerRef references a properly configured ACME-type
Issuer which should be used to create this Order. If the Issuer
does not exist, processing will be retried. If the Issuer is not
an 'ACME' Issuer, an error will be returned and the Order will be
marked as failed.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
csr:
description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order.
type: string
format: byte
dnsNames:
description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
type: array
items:
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
status:
type: object
properties:
authorizations:
description: Authorizations contains data returned from the ACME server
on what authorizations must be completed in order to validate the
DNS names specified on the Order.
type: array
items:
description: ACMEAuthorization contains data returned from the ACME
server on an authorization that must be completed in order validate
a DNS name on an ACME Order resource.
issuerRef:
description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed.
type: object
required:
- url
- name
properties:
challenges:
description: Challenges specifies the challenge types offered
by the ACME server. One of these challenge types will be selected
when validating the DNS name and an appropriate Challenge
resource will be created to perform the ACME challenge process.
type: array
items:
description: Challenge specifies a challenge offered by the
ACME server for an Order. An appropriate Challenge resource
can be created to perform the ACME challenge process.
type: object
required:
- token
- type
- url
properties:
token:
description: Token is the token that must be presented
for this challenge. This is used to compute the 'key'
that must also be presented.
type: string
type:
description: Type is the type of challenge being offered,
e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is
the raw value retrieved from the ACME server. Only 'http-01'
and 'dns-01' are supported by cert-manager, other values
will be ignored.
type: string
url:
description: URL is the URL of this challenge. It can
be used to retrieve additional metadata about the Challenge
from the ACME server.
type: string
identifier:
description: Identifier is the DNS name to be validated as part
of this authorization
group:
description: Group of the resource being referred to.
type: string
initialState:
description: InitialState is the initial state of the ACME authorization
when first fetched from the ACME server. If an Authorization
is already 'valid', the Order controller will not create a
Challenge resource for the authorization. This will occur
when working with an ACME server that enables 'authz reuse'
(such as Let's Encrypt's production endpoint). If not set
and 'identifier' is set, the state is assumed to be pending
and a Challenge will be created.
kind:
description: Kind of the resource being referred to.
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL is the URL of the Authorization that must be
completed
name:
description: Name of the resource being referred to.
type: string
wildcard:
description: Wildcard will be true if this authorization is
for a wildcard DNS name. If this is true, the identifier will
be the *non-wildcard* version of the DNS name. For example,
if '*.example.com' is the DNS name being validated, this field
will be 'true' and the 'identifier' field will be 'example.com'.
type: boolean
certificate:
description: Certificate is a copy of the PEM encoded certificate
for this Order. This field will be populated after the order has
been successfully finalized with the ACME server, and the order
has transitioned to the 'valid' state.
type: string
format: byte
failureTime:
description: FailureTime stores the time that this order failed. This
is used to influence garbage collection and back-off.
type: string
format: date-time
finalizeURL:
description: FinalizeURL of the Order. This is used to obtain certificates
for this order once it has been completed.
type: string
reason:
description: Reason optionally provides more information about a why
the order is in the current state.
type: string
state:
description: State contains the current state of this Order resource.
States 'success' and 'expired' are 'final'
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL of the Order. This will initially be empty when the
resource is first created. The Order controller will populate this
field when the Order is first processed. This field will be immutable
after it is initially set.
type: string
- name: v1alpha3
served: true
storage: false
"schema":
"openAPIV3Schema":
description: Order is a type to represent an Order with an ACME server
type: object
required:
- metadata
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
type: object
required:
- csr
- dnsNames
- issuerRef
properties:
commonName:
description: CommonName is the common name as specified on the DER
encoded CSR. If specified, this value must also be present in `dnsNames`.
This field must match the corresponding field on the DER encoded
CSR.
type: string
csr:
description: Certificate signing request bytes in DER encoding. This
will be used when finalizing the order. This field must be set on
the order.
type: string
format: byte
dnsNames:
description: DNSNames is a list of DNS names that should be included
as part of the Order validation process. This field must match the
corresponding field on the DER encoded CSR.
type: array
items:
status:
type: object
properties:
authorizations:
description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order.
type: array
items:
description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource.
type: object
required:
- url
properties:
challenges:
description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process.
type: array
items:
description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process.
type: object
required:
- token
- type
- url
properties:
token:
description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented.
type: string
type:
description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored.
type: string
url:
description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server.
type: string
identifier:
description: Identifier is the DNS name to be validated as part of this authorization
type: string
initialState:
description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created.
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL is the URL of the Authorization that must be completed
type: string
wildcard:
description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'.
type: boolean
certificate:
description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state.
type: string
issuerRef:
description: IssuerRef references a properly configured ACME-type
Issuer which should be used to create this Order. If the Issuer
does not exist, processing will be retried. If the Issuer is not
an 'ACME' Issuer, an error will be returned and the Order will be
marked as failed.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
format: byte
failureTime:
description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
finalizeURL:
description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed.
type: string
reason:
description: Reason optionally provides more information about a why the order is in the current state.
type: string
state:
description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final'
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set.
type: string
- name: v1alpha3
served: true
storage: false
"schema":
"openAPIV3Schema":
description: Order is a type to represent an Order with an ACME server
type: object
required:
- metadata
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
type: object
required:
- csr
- dnsNames
- issuerRef
properties:
commonName:
description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames`. This field must match the corresponding field on the DER encoded CSR.
type: string
csr:
description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order.
type: string
format: byte
dnsNames:
description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
type: array
items:
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
status:
type: object
properties:
authorizations:
description: Authorizations contains data returned from the ACME server
on what authorizations must be completed in order to validate the
DNS names specified on the Order.
type: array
items:
description: ACMEAuthorization contains data returned from the ACME
server on an authorization that must be completed in order validate
a DNS name on an ACME Order resource.
issuerRef:
description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed.
type: object
required:
- url
- name
properties:
challenges:
description: Challenges specifies the challenge types offered
by the ACME server. One of these challenge types will be selected
when validating the DNS name and an appropriate Challenge
resource will be created to perform the ACME challenge process.
type: array
items:
description: Challenge specifies a challenge offered by the
ACME server for an Order. An appropriate Challenge resource
can be created to perform the ACME challenge process.
type: object
required:
- token
- type
- url
properties:
token:
description: Token is the token that must be presented
for this challenge. This is used to compute the 'key'
that must also be presented.
type: string
type:
description: Type is the type of challenge being offered,
e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is
the raw value retrieved from the ACME server. Only 'http-01'
and 'dns-01' are supported by cert-manager, other values
will be ignored.
type: string
url:
description: URL is the URL of this challenge. It can
be used to retrieve additional metadata about the Challenge
from the ACME server.
type: string
identifier:
description: Identifier is the DNS name to be validated as part
of this authorization
group:
description: Group of the resource being referred to.
type: string
initialState:
description: InitialState is the initial state of the ACME authorization
when first fetched from the ACME server. If an Authorization
is already 'valid', the Order controller will not create a
Challenge resource for the authorization. This will occur
when working with an ACME server that enables 'authz reuse'
(such as Let's Encrypt's production endpoint). If not set
and 'identifier' is set, the state is assumed to be pending
and a Challenge will be created.
kind:
description: Kind of the resource being referred to.
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL is the URL of the Authorization that must be
completed
name:
description: Name of the resource being referred to.
type: string
wildcard:
description: Wildcard will be true if this authorization is
for a wildcard DNS name. If this is true, the identifier will
be the *non-wildcard* version of the DNS name. For example,
if '*.example.com' is the DNS name being validated, this field
will be 'true' and the 'identifier' field will be 'example.com'.
type: boolean
certificate:
description: Certificate is a copy of the PEM encoded certificate
for this Order. This field will be populated after the order has
been successfully finalized with the ACME server, and the order
has transitioned to the 'valid' state.
type: string
format: byte
failureTime:
description: FailureTime stores the time that this order failed. This
is used to influence garbage collection and back-off.
type: string
format: date-time
finalizeURL:
description: FinalizeURL of the Order. This is used to obtain certificates
for this order once it has been completed.
type: string
reason:
description: Reason optionally provides more information about a why
the order is in the current state.
type: string
state:
description: State contains the current state of this Order resource.
States 'success' and 'expired' are 'final'
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL of the Order. This will initially be empty when the
resource is first created. The Order controller will populate this
field when the Order is first processed. This field will be immutable
after it is initially set.
type: string
- name: v1beta1
served: true
storage: false
"schema":
"openAPIV3Schema":
description: Order is a type to represent an Order with an ACME server
type: object
required:
- metadata
- spec
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
type: object
required:
- dnsNames
- issuerRef
- request
properties:
commonName:
description: CommonName is the common name as specified on the DER
encoded CSR. If specified, this value must also be present in `dnsNames`.
This field must match the corresponding field on the DER encoded
CSR.
type: string
dnsNames:
description: DNSNames is a list of DNS names that should be included
as part of the Order validation process. This field must match the
corresponding field on the DER encoded CSR.
type: array
items:
status:
type: object
properties:
authorizations:
description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order.
type: array
items:
description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource.
type: object
required:
- url
properties:
challenges:
description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process.
type: array
items:
description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process.
type: object
required:
- token
- type
- url
properties:
token:
description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented.
type: string
type:
description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored.
type: string
url:
description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server.
type: string
identifier:
description: Identifier is the DNS name to be validated as part of this authorization
type: string
initialState:
description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created.
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL is the URL of the Authorization that must be completed
type: string
wildcard:
description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'.
type: boolean
certificate:
description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state.
type: string
issuerRef:
description: IssuerRef references a properly configured ACME-type
Issuer which should be used to create this Order. If the Issuer
does not exist, processing will be retried. If the Issuer is not
an 'ACME' Issuer, an error will be returned and the Order will be
marked as failed.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
format: byte
failureTime:
description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
finalizeURL:
description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed.
type: string
reason:
description: Reason optionally provides more information about a why the order is in the current state.
type: string
state:
description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final'
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set.
type: string
- name: v1beta1
served: true
storage: false
"schema":
"openAPIV3Schema":
description: Order is a type to represent an Order with an ACME server
type: object
required:
- metadata
- spec
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
type: object
required:
- dnsNames
- issuerRef
- request
properties:
commonName:
description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames`. This field must match the corresponding field on the DER encoded CSR.
type: string
dnsNames:
description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
type: array
items:
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
request:
description: Certificate signing request bytes in DER encoding. This
will be used when finalizing the order. This field must be set on
the order.
type: string
format: byte
status:
type: object
properties:
authorizations:
description: Authorizations contains data returned from the ACME server
on what authorizations must be completed in order to validate the
DNS names specified on the Order.
type: array
items:
description: ACMEAuthorization contains data returned from the ACME
server on an authorization that must be completed in order validate
a DNS name on an ACME Order resource.
issuerRef:
description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed.
type: object
required:
- url
- name
properties:
challenges:
description: Challenges specifies the challenge types offered
by the ACME server. One of these challenge types will be selected
when validating the DNS name and an appropriate Challenge
resource will be created to perform the ACME challenge process.
type: array
items:
description: Challenge specifies a challenge offered by the
ACME server for an Order. An appropriate Challenge resource
can be created to perform the ACME challenge process.
type: object
required:
- token
- type
- url
properties:
token:
description: Token is the token that must be presented
for this challenge. This is used to compute the 'key'
that must also be presented.
type: string
type:
description: Type is the type of challenge being offered,
e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is
the raw value retrieved from the ACME server. Only 'http-01'
and 'dns-01' are supported by cert-manager, other values
will be ignored.
type: string
url:
description: URL is the URL of this challenge. It can
be used to retrieve additional metadata about the Challenge
from the ACME server.
type: string
identifier:
description: Identifier is the DNS name to be validated as part
of this authorization
group:
description: Group of the resource being referred to.
type: string
initialState:
description: InitialState is the initial state of the ACME authorization
when first fetched from the ACME server. If an Authorization
is already 'valid', the Order controller will not create a
Challenge resource for the authorization. This will occur
when working with an ACME server that enables 'authz reuse'
(such as Let's Encrypt's production endpoint). If not set
and 'identifier' is set, the state is assumed to be pending
and a Challenge will be created.
kind:
description: Kind of the resource being referred to.
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL is the URL of the Authorization that must be
completed
name:
description: Name of the resource being referred to.
type: string
wildcard:
description: Wildcard will be true if this authorization is
for a wildcard DNS name. If this is true, the identifier will
be the *non-wildcard* version of the DNS name. For example,
if '*.example.com' is the DNS name being validated, this field
will be 'true' and the 'identifier' field will be 'example.com'.
type: boolean
certificate:
description: Certificate is a copy of the PEM encoded certificate
for this Order. This field will be populated after the order has
been successfully finalized with the ACME server, and the order
has transitioned to the 'valid' state.
type: string
format: byte
failureTime:
description: FailureTime stores the time that this order failed. This
is used to influence garbage collection and back-off.
type: string
format: date-time
finalizeURL:
description: FinalizeURL of the Order. This is used to obtain certificates
for this order once it has been completed.
type: string
reason:
description: Reason optionally provides more information about a why
the order is in the current state.
type: string
state:
description: State contains the current state of this Order resource.
States 'success' and 'expired' are 'final'
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL of the Order. This will initially be empty when the
resource is first created. The Order controller will populate this
field when the Order is first processed. This field will be immutable
after it is initially set.
type: string
request:
description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order.
type: string
format: byte
status:
type: object
properties:
authorizations:
description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order.
type: array
items:
description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource.
type: object
required:
- url
properties:
challenges:
description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process.
type: array
items:
description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process.
type: object
required:
- token
- type
- url
properties:
token:
description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented.
type: string
type:
description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored.
type: string
url:
description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server.
type: string
identifier:
description: Identifier is the DNS name to be validated as part of this authorization
type: string
initialState:
description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created.
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL is the URL of the Authorization that must be completed
type: string
wildcard:
description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'.
type: boolean
certificate:
description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state.
type: string
format: byte
failureTime:
description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
finalizeURL:
description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed.
type: string
reason:
description: Reason optionally provides more information about a why the order is in the current state.
type: string
state:
description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final'
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set.
type: string
go.mod
+4 -2
View File
@@ -25,7 +25,7 @@ require (
github.com/gorilla/mux v1.6.2
github.com/hashicorp/vault/api v1.0.4
github.com/hashicorp/vault/sdk v0.1.13
github.com/kr/pretty v0.1.0
github.com/kr/pretty v0.2.0
github.com/mattbaird/jsonpatch v0.0.0-20171005235357-81af80346b1a
github.com/miekg/dns v1.1.29
github.com/mitchellh/go-homedir v1.1.0
@@ -36,9 +36,10 @@ require (
github.com/pkg/errors v0.9.1
github.com/prometheus/client_golang v1.0.0
github.com/sergi/go-diff v1.0.0
github.com/smartystreets/assertions v1.0.0 // indirect
github.com/spf13/cobra v1.0.0
github.com/spf13/pflag v1.0.5
github.com/stretchr/testify v1.5.1
github.com/stretchr/testify v1.6.1
golang.org/x/crypto v0.0.0-20200423211502-4bdfaf469ed5
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
@@ -46,6 +47,7 @@ require (
google.golang.org/api v0.4.0
gopkg.in/ini.v1 v1.52.0 // indirect
gopkg.in/yaml.v2 v2.3.0
gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c // indirect
k8s.io/api v0.18.5
k8s.io/apiextensions-apiserver v0.18.5
k8s.io/apimachinery v0.18.5
go.sum
+9
View File
@@ -336,6 +336,8 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxv
github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
github.com/kr/pretty v0.2.0 h1:s5hAObm+yFO5uHYt5dYjxi2rXrsnmRpJx4OYvIWUaQs=
github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
@@ -459,6 +461,8 @@ github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4
github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
github.com/smartystreets/assertions v1.0.0 h1:UVQPSSmc3qtTi+zPPkCXvZX9VvW/xT/NsRvKfwY81a8=
github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a h1:pa8hGb/2YqsZKovtsgrwcDH1RZhVbTKCjLp47XpqCDs=
github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
github.com/soheilhy/cmux v0.1.4 h1:0HKaf1o97UwFjHH9o5XsHUOF+tqmdA7KEzXLpiyaw0E=
@@ -488,6 +492,8 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8 h1:ndzgwNDnKIqyCvHTXaCqh9KlOWKvBry6nuXMJmonVsE=
github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
@@ -685,6 +691,9 @@ gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v3 v3.0.0-20190905181640-827449938966 h1:B0J02caTR6tpSJozBJyiAzT6CtBzjclw4pgm9gg8Ys0=
gopkg.in/yaml.v3 v3.0.0-20190905181640-827449938966/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c h1:grhR+C34yXImVGp7EzNk+DTIk+323eIUWOmEevy6bDo=
gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
hack/build/repos.bzl
+8 -8
View File
@@ -1118,8 +1118,8 @@ def go_repositories():
build_file_generation = "on",
build_file_proto_mode = "disable",
importpath = "github.com/kr/pretty",
sum = "h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=",
version = "v0.1.0",
sum = "h1:s5hAObm+yFO5uHYt5dYjxi2rXrsnmRpJx4OYvIWUaQs=",
version = "v0.2.0",
)
go_repository(
name = "com_github_kr_pty",
@@ -1551,8 +1551,8 @@ def go_repositories():
build_file_generation = "on",
build_file_proto_mode = "disable",
importpath = "github.com/smartystreets/assertions",
sum = "h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=",
version = "v0.0.0-20180927180507-b2de0cb4f26d",
sum = "h1:UVQPSSmc3qtTi+zPPkCXvZX9VvW/xT/NsRvKfwY81a8=",
version = "v1.0.0",
)
go_repository(
name = "com_github_smartystreets_goconvey",
@@ -1631,8 +1631,8 @@ def go_repositories():
build_file_generation = "on",
build_file_proto_mode = "disable",
importpath = "github.com/stretchr/testify",
sum = "h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=",
version = "v1.5.1",
sum = "h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=",
version = "v1.6.1",
)
go_repository(
name = "com_github_tent_http_link_go",
@@ -2240,8 +2240,8 @@ def go_repositories():
build_file_generation = "on",
build_file_proto_mode = "disable",
importpath = "gopkg.in/yaml.v3",
sum = "h1:B0J02caTR6tpSJozBJyiAzT6CtBzjclw4pgm9gg8Ys0=",
version = "v3.0.0-20190905181640-827449938966",
sum = "h1:grhR+C34yXImVGp7EzNk+DTIk+323eIUWOmEevy6bDo=",
version = "v3.0.0-20200605160147-a5ece683394c",
)
go_repository(
name = "com_github_docopt_docopt_go",
pkg/acme/client/middleware/BUILD.bazel
+2 -1
View File
@@ -7,7 +7,8 @@ go_library(
visibility = ["//visibility:public"],
deps = [
"//pkg/acme/client:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
"//pkg/logs:go_default_library",
"@com_github_go_logr_logr//:go_default_library",
"@org_golang_x_crypto//acme:go_default_library",
],
)
pkg/acme/client/middleware/logger.go
+22 -17
View File
@@ -20,10 +20,11 @@ import (
"context"
"time"
"github.com/go-logr/logr"
"golang.org/x/crypto/acme"
"k8s.io/klog/v2"
"github.com/jetstack/cert-manager/pkg/acme/client"
logf "github.com/jetstack/cert-manager/pkg/logs"
)
const (
@@ -31,18 +32,22 @@ const (
)
func NewLogger(baseCl client.Interface) client.Interface {
return &Logger{baseCl: baseCl}
return &Logger{
baseCl: baseCl,
log: logf.Log.WithName("acme-middleware"),
}
}
// Logger is a glog based logging middleware for an ACME client
type Logger struct {
baseCl client.Interface
log logr.Logger
}
var _ client.Interface = &Logger{}
func (l *Logger) AuthorizeOrder(ctx context.Context, id []acme.AuthzID, opt ...acme.OrderOption) (*acme.Order, error) {
klog.Infof("Calling CreateOrder")
l.log.V(logf.InfoLevel).Info("Calling CreateOrder")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -51,7 +56,7 @@ func (l *Logger) AuthorizeOrder(ctx context.Context, id []acme.AuthzID, opt ...a
}
func (l *Logger) GetOrder(ctx context.Context, url string) (*acme.Order, error) {
klog.Infof("Calling GetOrder")
l.log.V(logf.InfoLevel).Info("Calling GetOrder")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -60,7 +65,7 @@ func (l *Logger) GetOrder(ctx context.Context, url string) (*acme.Order, error)
}
func (l *Logger) FetchCert(ctx context.Context, url string, bundle bool) ([][]byte, error) {
klog.Infof("Calling GetCertificate")
l.log.V(logf.InfoLevel).Info("Calling GetCertificate")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -69,7 +74,7 @@ func (l *Logger) FetchCert(ctx context.Context, url string, bundle bool) ([][]by
}
func (l *Logger) WaitOrder(ctx context.Context, url string) (*acme.Order, error) {
klog.Infof("Calling WaitOrder")
l.log.V(logf.InfoLevel).Info("Calling WaitOrder")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -78,7 +83,7 @@ func (l *Logger) WaitOrder(ctx context.Context, url string) (*acme.Order, error)
}
func (l *Logger) CreateOrderCert(ctx context.Context, finalizeURL string, csr []byte, bundle bool) (der [][]byte, certURL string, err error) {
klog.Infof("Calling FinalizeOrder")
l.log.V(logf.InfoLevel).Info("Calling FinalizeOrder")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -87,7 +92,7 @@ func (l *Logger) CreateOrderCert(ctx context.Context, finalizeURL string, csr []
}
func (l *Logger) Accept(ctx context.Context, chal *acme.Challenge) (*acme.Challenge, error) {
klog.Infof("Calling AcceptChallenge")
l.log.V(logf.InfoLevel).Info("Calling AcceptChallenge")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -96,7 +101,7 @@ func (l *Logger) Accept(ctx context.Context, chal *acme.Challenge) (*acme.Challe
}
func (l *Logger) GetChallenge(ctx context.Context, url string) (*acme.Challenge, error) {
klog.Infof("Calling GetChallenge")
l.log.V(logf.InfoLevel).Info("Calling GetChallenge")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -105,7 +110,7 @@ func (l *Logger) GetChallenge(ctx context.Context, url string) (*acme.Challenge,
}
func (l *Logger) GetAuthorization(ctx context.Context, url string) (*acme.Authorization, error) {
klog.Infof("Calling GetAuthorization")
l.log.V(logf.InfoLevel).Info("Calling GetAuthorization")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -114,7 +119,7 @@ func (l *Logger) GetAuthorization(ctx context.Context, url string) (*acme.Author
}
func (l *Logger) WaitAuthorization(ctx context.Context, url string) (*acme.Authorization, error) {
klog.Infof("Calling WaitAuthorization")
l.log.V(logf.InfoLevel).Info("Calling WaitAuthorization")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -123,7 +128,7 @@ func (l *Logger) WaitAuthorization(ctx context.Context, url string) (*acme.Autho
}
func (l *Logger) Register(ctx context.Context, a *acme.Account, prompt func(tosURL string) bool) (*acme.Account, error) {
klog.Infof("Calling CreateAccount")
l.log.V(logf.InfoLevel).Info("Calling CreateAccount")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -132,7 +137,7 @@ func (l *Logger) Register(ctx context.Context, a *acme.Account, prompt func(tosU
}
func (l *Logger) GetReg(ctx context.Context, url string) (*acme.Account, error) {
klog.Infof("Calling GetAccount")
l.log.V(logf.InfoLevel).Info("Calling GetAccount")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -141,17 +146,17 @@ func (l *Logger) GetReg(ctx context.Context, url string) (*acme.Account, error)
}
func (l *Logger) HTTP01ChallengeResponse(token string) (string, error) {
klog.Infof("Calling HTTP01ChallengeResponse")
l.log.V(logf.InfoLevel).Info("Calling HTTP01ChallengeResponse")
return l.baseCl.HTTP01ChallengeResponse(token)
}
func (l *Logger) DNS01ChallengeRecord(token string) (string, error) {
klog.Infof("Calling DNS01ChallengeRecord")
l.log.V(logf.InfoLevel).Info("Calling DNS01ChallengeRecord")
return l.baseCl.DNS01ChallengeRecord(token)
}
func (l *Logger) Discover(ctx context.Context) (acme.Directory, error) {
klog.Infof("Calling Discover")
l.log.V(logf.InfoLevel).Info("Calling Discover")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
@@ -160,7 +165,7 @@ func (l *Logger) Discover(ctx context.Context) (acme.Directory, error) {
}
func (l *Logger) UpdateReg(ctx context.Context, a *acme.Account) (*acme.Account, error) {
klog.Infof("Calling UpdateAccount")
l.log.V(logf.InfoLevel).Info("Calling UpdateAccount")
ctx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
pkg/acme/webhook/cmd/BUILD.bazel
+1 -1
View File
@@ -8,9 +8,9 @@ go_library(
deps = [
"//pkg/acme/webhook:go_default_library",
"//pkg/acme/webhook/cmd/server:go_default_library",
"//pkg/logs:go_default_library",
"@io_k8s_apiserver//pkg/server:go_default_library",
"@io_k8s_component_base//logs:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
],
)
pkg/acme/webhook/cmd/cmd.go
+3 -3
View File
@@ -21,13 +21,12 @@ import (
"os"
"runtime"
"k8s.io/klog/v2"
genericapiserver "k8s.io/apiserver/pkg/server"
"k8s.io/component-base/logs"
"github.com/jetstack/cert-manager/pkg/acme/webhook"
"github.com/jetstack/cert-manager/pkg/acme/webhook/cmd/server"
logf "github.com/jetstack/cert-manager/pkg/logs"
)
func RunWebhookServer(groupName string, hooks ...webhook.Solver) {
@@ -43,6 +42,7 @@ func RunWebhookServer(groupName string, hooks ...webhook.Solver) {
cmd := server.NewCommandStartWebhookServer(os.Stdout, os.Stderr, stopCh, groupName, hooks...)
cmd.Flags().AddGoFlagSet(flag.CommandLine)
if err := cmd.Execute(); err != nil {
klog.Fatal(err)
logf.Log.V(logf.ErrorLevel).Error(err, "")
os.Exit(1)
}
}
pkg/api/util/BUILD.bazel
+1 -1
View File
@@ -14,8 +14,8 @@ go_library(
deps = [
"//pkg/apis/certmanager/v1alpha2:go_default_library",
"//pkg/apis/meta/v1:go_default_library",
"//pkg/logs:go_default_library",
"@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
"@io_k8s_utils//clock:go_default_library",
],
)
pkg/api/util/conditions.go
+7 -7
View File
@@ -18,11 +18,11 @@ package util
import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/klog/v2"
"k8s.io/utils/clock"
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
logf "github.com/jetstack/cert-manager/pkg/logs"
)
// Clock is defined as a package var so it can be stubbed out during tests.
@@ -78,7 +78,7 @@ func SetIssuerCondition(i cmapi.GenericIssuer, conditionType cmapi.IssuerConditi
if cond.Status == status {
newCondition.LastTransitionTime = cond.LastTransitionTime
} else {
klog.Infof("Found status change for Issuer %q condition %q: %q -> %q; setting lastTransitionTime to %v", i.GetObjectMeta().Name, conditionType, cond.Status, status, nowTime.Time)
logf.Log.V(logf.InfoLevel).Info("Found status change for Issuer %q condition %q: %q -> %q; setting lastTransitionTime to %v", i.GetObjectMeta().Name, conditionType, cond.Status, status, nowTime.Time)
}
// Overwrite the existing condition
@@ -89,7 +89,7 @@ func SetIssuerCondition(i cmapi.GenericIssuer, conditionType cmapi.IssuerConditi
// If we've not found an existing condition of this type, we simply insert
// the new condition into the slice.
i.GetStatus().Conditions = append(i.GetStatus().Conditions, newCondition)
klog.Infof("Setting lastTransitionTime for Issuer %q condition %q to %v", i.GetObjectMeta().Name, conditionType, nowTime.Time)
logf.Log.V(logf.InfoLevel).Info("Setting lastTransitionTime for Issuer %q condition %q to %v", i.GetObjectMeta().Name, conditionType, nowTime.Time)
}
// CertificateHasCondition will return true if the given Certificate has a
@@ -159,7 +159,7 @@ func SetCertificateCondition(crt *cmapi.Certificate, conditionType cmapi.Certifi
if cond.Status == status {
newCondition.LastTransitionTime = cond.LastTransitionTime
} else {
klog.Infof("Found status change for Certificate %q condition %q: %q -> %q; setting lastTransitionTime to %v", crt.Name, conditionType, cond.Status, status, nowTime.Time)
logf.Log.V(logf.InfoLevel).Info("Found status change for Certificate %q condition %q: %q -> %q; setting lastTransitionTime to %v", crt.Name, conditionType, cond.Status, status, nowTime.Time)
}
// Overwrite the existing condition
@@ -170,7 +170,7 @@ func SetCertificateCondition(crt *cmapi.Certificate, conditionType cmapi.Certifi
// If we've not found an existing condition of this type, we simply insert
// the new condition into the slice.
crt.Status.Conditions = append(crt.Status.Conditions, newCondition)
klog.Infof("Setting lastTransitionTime for Certificate %q condition %q to %v", crt.Name, conditionType, nowTime.Time)
logf.Log.V(logf.InfoLevel).Info("Setting lastTransitionTime for Certificate %q condition %q to %v", crt.Name, conditionType, nowTime.Time)
}
// RemoteCertificateCondition will remove any condition with this condition type
@@ -219,7 +219,7 @@ func SetCertificateRequestCondition(cr *cmapi.CertificateRequest, conditionType
if cond.Status == status {
newCondition.LastTransitionTime = cond.LastTransitionTime
} else {
klog.Infof("Found status change for CertificateRequest %q condition %q: %q -> %q; setting lastTransitionTime to %v", cr.Name, conditionType, cond.Status, status, nowTime.Time)
logf.Log.V(logf.InfoLevel).Info("Found status change for CertificateRequest %q condition %q: %q -> %q; setting lastTransitionTime to %v", cr.Name, conditionType, cond.Status, status, nowTime.Time)
}
// Overwrite the existing condition
@@ -230,7 +230,7 @@ func SetCertificateRequestCondition(cr *cmapi.CertificateRequest, conditionType
// If we've not found an existing condition of this type, we simply insert
// the new condition into the slice.
cr.Status.Conditions = append(cr.Status.Conditions, newCondition)
klog.Infof("Setting lastTransitionTime for CertificateRequest %q condition %q to %v", cr.Name, conditionType, nowTime.Time)
logf.Log.V(logf.InfoLevel).Info("Setting lastTransitionTime for CertificateRequest %q condition %q to %v", cr.Name, conditionType, nowTime.Time)
}
// CertificateRequestHasCondition will return true if the given
pkg/controller/acmechallenges/sync.go
+2 -2
View File
@@ -333,7 +333,7 @@ func (c *controller) syncChallengeStatus(ctx context.Context, cl acmecl.Interfac
func (c *controller) acceptChallenge(ctx context.Context, cl acmecl.Interface, ch *cmacme.Challenge) error {
log := logf.FromContext(ctx, "acceptChallenge")
log.Info("accepting challenge with ACME server")
log.V(logf.DebugLevel).Info("accepting challenge with ACME server")
// We manually construct an ACME challenge here from our own internal type
// to save additional round trips to the ACME server.
acmeChal := &acmeapi.Challenge{
@@ -350,7 +350,7 @@ func (c *controller) acceptChallenge(ctx context.Context, cl acmecl.Interface, c
return handleError(ch, err)
}
log.Info("waiting for authorization for domain")
log.V(logf.DebugLevel).Info("waiting for authorization for domain")
authorization, err := cl.WaitAuthorization(ctx, ch.Spec.AuthzURL)
if err != nil {
log.Error(err, "error waiting for authorization")
pkg/controller/acmeorders/sync.go
+19 -19
View File
@@ -50,7 +50,7 @@ func (c *controller) Sync(ctx context.Context, o *cmacme.Order) (err error) {
dbg.Info("skipping updating resource as new status == existing status")
return
}
log.Info("updating Order resource status")
log.V(logf.DebugLevel).Info("updating Order resource status")
_, updateErr := c.cmClient.AcmeV1alpha2().Orders(o.Namespace).UpdateStatus(context.TODO(), o, metav1.UpdateOptions{})
if updateErr != nil {
log.Error(err, "failed to update status")
@@ -71,10 +71,10 @@ func (c *controller) Sync(ctx context.Context, o *cmacme.Order) (err error) {
switch {
case o.Status.URL == "":
log.Info("Creating new ACME order as status.url is not set")
log.V(logf.DebugLevel).Info("Creating new ACME order as status.url is not set")
return c.createOrder(ctx, cl, o)
case o.Status.FinalizeURL == "":
log.Info("Updating Order status as status.finalizeURL is not set")
log.V(logf.DebugLevel).Info("Updating Order status as status.finalizeURL is not set")
_, err := c.updateOrderStatus(ctx, cl, o)
if acmeErr, ok := err.(*acmeapi.Error); ok {
if acmeErr.StatusCode >= 400 && acmeErr.StatusCode < 500 {
@@ -86,17 +86,17 @@ func (c *controller) Sync(ctx context.Context, o *cmacme.Order) (err error) {
}
return err
case anyAuthorizationsMissingMetadata(o):
log.Info("Fetching Authorizations from ACME server as status.authorizations contains unpopulated authorizations")
log.V(logf.DebugLevel).Info("Fetching Authorizations from ACME server as status.authorizations contains unpopulated authorizations")
return c.fetchMetadataForAuthorizations(ctx, o, cl)
case acme.IsFailureState(o.Status.State):
log.Info("Doing nothing as Order is in a failed state")
log.V(logf.DebugLevel).Info("Doing nothing as Order is in a failed state")
// if the Order is failed there's nothing left for us to do, return nil
return nil
case o.Status.State == cmacme.Valid && o.Status.Certificate == nil:
log.Info("Order is in a Valid state but the Certificate data is empty, fetching existing Certificate")
log.V(logf.DebugLevel).Info("Order is in a Valid state but the Certificate data is empty, fetching existing Certificate")
return c.fetchCertificateData(ctx, cl, o)
case o.Status.State == cmacme.Valid && len(o.Status.Certificate) > 0:
log.Info("Order has already been completed, cleaning up any owned Challenge resources")
log.V(logf.DebugLevel).Info("Order has already been completed, cleaning up any owned Challenge resources")
// if the Order is valid and the certificate data has been set, clean
// up any owned Challenge resources and do nothing
return c.deleteAllChallenges(o)
@@ -123,10 +123,10 @@ func (c *controller) Sync(ctx context.Context, o *cmacme.Order) (err error) {
switch {
case needToCreateChallenges:
log.Info("Creating additional Challenge resources to complete Order")
log.V(logf.DebugLevel).Info("Creating additional Challenge resources to complete Order")
return c.createRequiredChallenges(o, requiredChallenges)
case needToDeleteChallenges:
log.Info("Deleting leftover Challenge resources no longer required by Order")
log.V(logf.DebugLevel).Info("Deleting leftover Challenge resources no longer required by Order")
return c.deleteLeftoverChallenges(o, requiredChallenges)
}
@@ -140,13 +140,13 @@ func (c *controller) Sync(ctx context.Context, o *cmacme.Order) (err error) {
switch {
case o.Status.State == cmacme.Ready:
log.Info("Finalizing Order as order state is 'Ready'")
log.V(logf.DebugLevel).Info("Finalizing Order as order state is 'Ready'")
return c.finalizeOrder(ctx, cl, o)
case anyChallengesFailed(challenges):
// TODO (@munnerz): instead of waiting for the ACME server to mark this
// Order as failed, we could just mark the Order as failed as there is
// no way that we will attempt and continue the order anyway.
log.Info("Update Order status as at least one Challenge has failed")
log.V(logf.InfoLevel).Info("Update Order status as at least one Challenge has failed")
_, err := c.updateOrderStatus(ctx, cl, o)
if acmeErr, ok := err.(*acmeapi.Error); ok {
if acmeErr.StatusCode >= 400 && acmeErr.StatusCode < 500 {
@@ -160,7 +160,7 @@ func (c *controller) Sync(ctx context.Context, o *cmacme.Order) (err error) {
// anyChallengesFailed(challenges) == false is already implied by the above
// case, but explicitly check it here in case anything changes in future.
case !anyChallengesFailed(challenges) && allChallengesFinal(challenges):
log.Info("All challenges are in a final state, updating order state")
log.V(logf.DebugLevel).Info("All challenges are in a final state, updating order state")
_, err := c.updateOrderStatus(ctx, cl, o)
if acmeErr, ok := err.(*acmeapi.Error); ok {
if acmeErr.StatusCode >= 400 && acmeErr.StatusCode < 500 {
@@ -173,7 +173,7 @@ func (c *controller) Sync(ctx context.Context, o *cmacme.Order) (err error) {
return err
}
log.Info("No action taken")
log.V(logf.DebugLevel).Info("No action taken")
return nil
}
@@ -184,13 +184,13 @@ func (c *controller) createOrder(ctx context.Context, cl acmecl.Interface, o *cm
if o.Status.URL != "" {
return fmt.Errorf("refusing to recreate a new order for Order %q. Please create a new Order resource to initiate a new order", o.Name)
}
log.Info("order URL not set, submitting Order to ACME server")
log.V(logf.DebugLevel).Info("order URL not set, submitting Order to ACME server")
identifierSet := sets.NewString(o.Spec.DNSNames...)
if o.Spec.CommonName != "" {
identifierSet.Insert(o.Spec.CommonName)
}
log.Info("build set of domains for Order", "domains", identifierSet.List())
log.V(logf.DebugLevel).Info("build set of domains for Order", "domains", identifierSet.List())
authzIDs := acmeapi.DomainIDs(identifierSet.List()...)
// create a new order with the acme server
acmeOrder, err := cl.AuthorizeOrder(ctx, authzIDs)
@@ -205,7 +205,7 @@ func (c *controller) createOrder(ctx context.Context, cl acmecl.Interface, o *cm
if err != nil {
return fmt.Errorf("error creating new order: %v", err)
}
log.Info("submitted Order to ACME server")
log.V(logf.DebugLevel).Info("submitted Order to ACME server")
o.Status.URL = acmeOrder.URI
o.Status.FinalizeURL = acmeOrder.FinalizeURL
@@ -221,7 +221,7 @@ func (c *controller) updateOrderStatus(ctx context.Context, cl acmecl.Interface,
return nil, fmt.Errorf("internal error: order URL not set")
}
log.Info("Fetching Order metadata from ACME server")
log.V(logf.DebugLevel).Info("Fetching Order metadata from ACME server")
acmeOrder, err := cl.GetOrder(ctx, o.Status.URL)
if err != nil {
return nil, err
@@ -432,7 +432,7 @@ func (c *controller) finalizeOrder(ctx context.Context, cl acmecl.Interface, o *
var derBytes []byte
block, _ := pem.Decode(o.Spec.CSR)
if block == nil {
log.Info("failed to parse CSR as PEM data, attempting to treat CSR as DER encoded for compatibility reasons")
log.V(logf.DebugLevel).Info("failed to parse CSR as PEM data, attempting to treat CSR as DER encoded for compatibility reasons")
derBytes = o.Spec.CSR
} else {
derBytes = block.Bytes
@@ -511,7 +511,7 @@ func (c *controller) fetchCertificateData(ctx context.Context, cl acmecl.Interfa
return err
}
if acmeOrder == nil {
log.Info("Failed to fetch Order from ACME server as it no longer exists. Not retrying.")
log.V(logf.WarnLevel).Info("Failed to fetch Order from ACME server as it no longer exists. Not retrying.")
return nil
}
pkg/controller/cainjector/controller.go
+3 -3
View File
@@ -147,7 +147,7 @@ func (r *genericInjectReconciler) Reconcile(req ctrl.Request) (ctrl.Result, erro
dataSource, err := r.caDataSourceFor(log, metaObj)
if err != nil {
log.V(4).Info("failed to determine ca data source for injectable")
log.V(logf.WarnLevel).Info("failed to determine ca data source for injectable")
return ctrl.Result{}, nil
}
@@ -157,7 +157,7 @@ func (r *genericInjectReconciler) Reconcile(req ctrl.Request) (ctrl.Result, erro
return ctrl.Result{}, err
}
if caData == nil {
log.Info("could not find any ca data in data source for target")
log.V(logf.WarnLevel).Info("could not find any ca data in data source for target")
return ctrl.Result{}, nil
}
@@ -169,7 +169,7 @@ func (r *genericInjectReconciler) Reconcile(req ctrl.Request) (ctrl.Result, erro
log.Error(err, "unable to update target object with new CA data")
return ctrl.Result{}, err
}
log.V(1).Info("updated object")
log.V(logf.InfoLevel).Info("updated object")
return ctrl.Result{}, nil
}
pkg/controller/cainjector/setup.go
+3 -1
View File
@@ -19,6 +19,8 @@ package cainjector
import (
"io/ioutil"
logf "github.com/jetstack/cert-manager/pkg/logs"
admissionreg "k8s.io/api/admissionregistration/v1beta1"
apiext "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
"k8s.io/apimachinery/pkg/api/meta"
@@ -71,7 +73,7 @@ func registerAllInjectors(mgr ctrl.Manager, sources ...caDataSource) error {
if !meta.IsNoMatchError(err) || !setup.injector.IsAlpha() {
return err
}
ctrl.Log.Info("unable to register injector which is still in an alpha phase."+
ctrl.Log.V(logf.WarnLevel).Info("unable to register injector which is still in an alpha phase."+
" Enable the feature on the API server in order to use this injector",
"injector", setup.resourceName)
}
pkg/controller/cainjector/sources.go
+6 -4
View File
@@ -19,6 +19,8 @@ package cainjector
import (
"context"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/go-logr/logr"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -91,7 +93,7 @@ func (c *certificateDataSource) Configured(log logr.Logger, metaObj metav1.Objec
if !ok {
return false
}
log.Info("Extracting CA from Certificate resource", "certificate", certNameRaw)
log.V(logf.DebugLevel).Info("Extracting CA from Certificate resource", "certificate", certNameRaw)
return true
}
@@ -123,7 +125,7 @@ func (c *certificateDataSource) ReadCA(ctx context.Context, log logr.Logger, met
}
owner := OwningCertForSecret(&secret)
if owner == nil || *owner != certName {
log.Info("refusing to target secret not owned by certificate", "owner", metav1.GetControllerOf(&secret))
log.V(logf.WarnLevel).Info("refusing to target secret not owned by certificate", "owner", metav1.GetControllerOf(&secret))
return nil, nil
}
@@ -173,7 +175,7 @@ func (c *secretDataSource) Configured(log logr.Logger, metaObj metav1.Object) bo
if !ok {
return false
}
log.Info("Extracting CA from Secret resource", "secret", secretNameRaw)
log.V(logf.DebugLevel).Info("Extracting CA from Secret resource", "secret", secretNameRaw)
return true
}
@@ -196,7 +198,7 @@ func (c *secretDataSource) ReadCA(ctx context.Context, log logr.Logger, metaObj
}
if secret.Annotations == nil || secret.Annotations[cmapi.AllowsInjectionFromSecretAnnotation] != "true" {
log.Info("Secret resource does not allow direct injection - refusing to inject CA")
log.V(logf.WarnLevel).Info("Secret resource does not allow direct injection - refusing to inject CA")
return nil, nil
}
pkg/controller/certificaterequests/acme/acme.go
+4 -4
View File
@@ -101,7 +101,7 @@ func (a *ACME) Sign(ctx context.Context, cr *v1alpha2.CertificateRequest, issuer
a.reporter.Failed(cr, err, "InvalidOrder", message)
log.V(4).Info(fmt.Sprintf("%s: %s", message, err))
log.V(logf.DebugLevel).Info(fmt.Sprintf("%s: %s", message, err))
return nil, nil
}
@@ -134,7 +134,7 @@ func (a *ACME) Sign(ctx context.Context, cr *v1alpha2.CertificateRequest, issuer
message := fmt.Sprintf("Created Order resource %s/%s",
expectedOrder.Namespace, expectedOrder.Name)
a.reporter.Pending(cr, nil, "OrderCreated", message)
log.V(4).Info(message)
log.V(logf.DebugLevel).Info(message)
return nil, nil
}
@@ -183,7 +183,7 @@ func (a *ACME) Sign(ctx context.Context, cr *v1alpha2.CertificateRequest, issuer
return nil, a.acmeClientV.Orders(order.Namespace).Delete(context.TODO(), order.Name, metav1.DeleteOptions{})
}
log.Info("certificate issued")
log.V(logf.InfoLevel).Info("certificate issued")
return &issuerpkg.IssueResponse{
Certificate: order.Status.Certificate,
@@ -195,7 +195,7 @@ func (a *ACME) Sign(ctx context.Context, cr *v1alpha2.CertificateRequest, issuer
fmt.Sprintf("Waiting on certificate issuance from order %s/%s: %q",
expectedOrder.Namespace, order.Name, order.Status.State))
log.Info("acme Order resource is not in a ready state, waiting...")
log.V(logf.DebugLevel).Info("acme Order resource is not in a ready state, waiting...")
return nil, nil
}
pkg/controller/certificaterequests/ca/ca.go
+1 -1
View File
@@ -121,7 +121,7 @@ func (c *CA) Sign(ctx context.Context, cr *cmapi.CertificateRequest, issuerObj c
return nil, err
}
log.Info("certificate issued")
log.V(logf.DebugLevel).Info("certificate issued")
return &issuerpkg.IssueResponse{
Certificate: certPEM,
pkg/controller/certificaterequests/controller.go
+1 -1
View File
@@ -164,7 +164,7 @@ func (c *Controller) Register(ctx *controllerpkg.Context) (workqueue.RateLimitin
c.reporter = util.NewReporter(c.clock, c.recorder)
c.cmClient = ctx.CMClient
c.log.Info("new certificate request controller registered",
c.log.V(logf.DebugLevel).Info("new certificate request controller registered",
"type", c.issuerType)
return c.queue, mustSync, nil
pkg/controller/certificaterequests/selfsigned/selfsigned.go
+1 -1
View File
@@ -159,7 +159,7 @@ func (s *SelfSigned) Sign(ctx context.Context, cr *cmapi.CertificateRequest, iss
return nil, nil
}
log.Info("self signed certificate issued")
log.V(logf.DebugLevel).Info("self signed certificate issued")
// We set the CA to the returned certificate here since this is self signed.
return &issuer.IssueResponse{
pkg/controller/certificaterequests/sync.go
+1 -1
View File
@@ -96,7 +96,7 @@ func (c *Controller) Sync(ctx context.Context, cr *v1alpha2.CertificateRequest)
if issuerType != c.issuerType {
c.log.WithValues(
logf.RelatedResourceKindKey, issuerType,
).V(5).Info("issuer reference type does not match controller resource kind, ignoring")
).V(logf.DebugLevel).Info("issuer reference type does not match controller resource kind, ignoring")
return nil
}
pkg/controller/certificaterequests/vault/vault.go
+1 -1
View File
@@ -96,7 +96,7 @@ func (v *Vault) Sign(ctx context.Context, cr *v1alpha2.CertificateRequest, issue
return nil, nil
}
log.Info("certificate issued")
log.V(logf.DebugLevel).Info("certificate issued")
return &issuer.IssueResponse{
Certificate: certPem,
pkg/controller/certificaterequests/venafi/venafi.go
+1 -1
View File
@@ -161,7 +161,7 @@ func (v *Venafi) Sign(ctx context.Context, cr *cmapi.CertificateRequest, issuerO
}
}
log.Info("certificate issued")
log.V(logf.DebugLevel).Info("certificate issued")
return &issuerpkg.IssueResponse{
Certificate: certPem,
pkg/controller/certificates/BUILD.bazel
+1
View File
@@ -13,6 +13,7 @@ go_library(
"//pkg/apis/certmanager/v1alpha2:go_default_library",
"//pkg/client/listers/certmanager/v1alpha2:go_default_library",
"//pkg/controller:go_default_library",
"//pkg/logs:go_default_library",
"//pkg/util:go_default_library",
"//pkg/util/pki:go_default_library",
"//pkg/util/predicate:go_default_library",
pkg/controller/certificates/informers.go
+2 -1
View File
@@ -18,6 +18,7 @@ package certificates
import (
"github.com/go-logr/logr"
logf "github.com/jetstack/cert-manager/pkg/logs"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/labels"
"k8s.io/apimachinery/pkg/runtime"
@@ -40,7 +41,7 @@ func EnqueueCertificatesForResourceUsingPredicates(log logr.Logger, queue workqu
return func(obj interface{}) {
s, ok := obj.(metav1.Object)
if !ok {
log.Info("Non-Object type resource passed to EnqueueCertificatesForSecretUsingPredicates")
log.V(logf.DebugLevel).Info("Non-Object type resource passed to EnqueueCertificatesForSecretUsingPredicates")
return
}
pkg/controller/certificates/issuing/issuing_controller.go
+4 -4
View File
@@ -227,7 +227,7 @@ func (c *controller) ProcessItem(ctx context.Context, key string) error {
cond := apiutil.GetCertificateRequestCondition(req, cmapi.CertificateRequestConditionReady)
if cond == nil {
log.V(4).Info("CertificateRequest does not have Ready condition, waiting...")
log.V(logf.DebugLevel).Info("CertificateRequest does not have Ready condition, waiting...")
return nil
}
@@ -244,7 +244,7 @@ func (c *controller) ProcessItem(ctx context.Context, key string) error {
return err
}
if len(requestViolations) > 0 {
log.Info("CertificateRequest does not match Certificate, waiting for keymanager controller")
log.V(logf.DebugLevel).Info("CertificateRequest does not match Certificate, waiting for keymanager controller")
return nil
}
@@ -276,7 +276,7 @@ func (c *controller) ProcessItem(ctx context.Context, key string) error {
}
// CertificateRequest is not in a final state so do nothing.
log.V(4).Info("CertificateRequest not in final state, waiting...", "reason", cond.Reason)
log.V(logf.DebugLevel).Info("CertificateRequest not in final state, waiting...", "reason", cond.Reason)
return nil
}
@@ -285,7 +285,7 @@ func (c *controller) failIssueCertificate(ctx context.Context, log logr.Logger,
nowTime := metav1.NewTime(c.clock.Now())
crt.Status.LastFailureTime = &nowTime
log.Info("CertificateRequest in failed state so retrying issuance later")
log.V(logf.DebugLevel).Info("CertificateRequest in failed state so retrying issuance later")
var reason, message string
condition := apiutil.GetCertificateRequestCondition(req, cmapi.CertificateRequestConditionReady)
pkg/controller/certificates/keymanager/keymanager_controller.go
+1 -1
View File
@@ -171,7 +171,7 @@ func (c *controller) ProcessItem(ctx context.Context, key string) error {
log.V(logf.DebugLevel).Info("Creating new nextPrivateKeySecretName Secret because no existing Secret found")
return c.createAndSetNextPrivateKey(ctx, crt)
default:
log.Info("Certificate with unknown certificate.spec.privateKey.rotationPolicy value", "rotation_policy", rotationPolicy)
log.V(logf.WarnLevel).Info("Certificate with unknown certificate.spec.privateKey.rotationPolicy value", "rotation_policy", rotationPolicy)
return nil
}
}
pkg/controller/certificates/requestmanager/requestmanager_controller.go
+1 -1
View File
@@ -193,7 +193,7 @@ func (c *controller) ProcessItem(ctx context.Context, key string) error {
// TODO: we should handle this case better, but for now do nothing to
// avoid getting into loops where we keep creating multiple requests
// and deleting them again.
log.Info("Multiple matching CertificateRequest resources exist, delete one of them. This is likely an error and should be reported on the issue tracker!")
log.V(logf.ErrorLevel).Info("Multiple matching CertificateRequest resources exist, delete one of them. This is likely an error and should be reported on the issue tracker!")
return nil
}
pkg/controller/certificates/trigger/trigger_controller.go
+2 -2
View File
@@ -159,7 +159,7 @@ func (c *controller) ProcessItem(ctx context.Context, key string) error {
now := c.clock.Now()
retryAfter := crt.Status.LastFailureTime.Add(retryAfterLastFailure)
if now.Before(retryAfter) {
log.Info("Not re-issuing certificate as an attempt has been made in the last hour", "retry_after", retryAfter)
log.V(logf.DebugLevel).Info("Not re-issuing certificate as an attempt has been made in the last hour", "retry_after", retryAfter)
c.scheduleRecheckOfCertificateIfRequired(log, key, retryAfter.Sub(now))
return nil
}
@@ -209,7 +209,7 @@ func (c *controller) scheduleRecheckOfCertificateIfRequired(log logr.Logger, key
return
}
log.Info("scheduling renewal", "duration_until_renewal", durationUntilRenewalTime.String())
log.V(logf.DebugLevel).Info("scheduling renewal", "duration_until_renewal", durationUntilRenewalTime.String())
c.scheduledWorkQueue.Add(key, durationUntilRenewalTime)
}
pkg/controller/controller.go
+3 -3
View File
@@ -122,7 +122,7 @@ func (c *controller) Run(workers int, stopCh <-chan struct{}) error {
}
<-stopCh
log.Info("shutting down queue as workqueue signaled shutdown")
log.V(logf.WarnLevel).Info("shutting down queue as workqueue signaled shutdown")
c.queue.ShutDown()
log.V(logf.DebugLevel).Info("waiting for workers to exit...")
wg.Wait()
@@ -149,7 +149,7 @@ func (b *controller) worker(ctx context.Context) {
return
}
log := log.WithValues("key", key)
log.Info("syncing item")
log.V(logf.DebugLevel).Info("syncing item")
// Increase sync count for this controller
b.metrics.IncrementSyncCallCount(b.name)
@@ -159,7 +159,7 @@ func (b *controller) worker(ctx context.Context) {
b.queue.AddRateLimited(obj)
return
}
log.Info("finished processing work item")
log.V(logf.DebugLevel).Info("finished processing work item")
b.queue.Forget(obj)
}()
}
pkg/controller/helper.go
+4 -4
View File
@@ -22,7 +22,7 @@ import (
"time"
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
"github.com/jetstack/cert-manager/pkg/logs"
logf "github.com/jetstack/cert-manager/pkg/logs"
)
func (o IssuerOptions) ResourceNamespace(iss cmapi.GenericIssuer) string {
@@ -53,13 +53,13 @@ var now = time.Now
// CalculateDurationUntilRenew calculates how long cert-manager should wait to
// until attempting to renew this certificate resource.
func (o IssuerOptions) CalculateDurationUntilRenew(ctx context.Context, cert *x509.Certificate, crt *cmapi.Certificate) time.Duration {
log := logs.FromContext(ctx, "CalculateDurationUntilRenew")
log := logf.FromContext(ctx, "CalculateDurationUntilRenew")
// validate if the certificate received was with the issuer configured
// duration. If not we generate an event to warn the user of that fact.
certDuration := cert.NotAfter.Sub(cert.NotBefore)
if crt.Spec.Duration != nil && certDuration < crt.Spec.Duration.Duration {
log.Info("requested certificate validity period differs from period given on returned certificate", "requested_duration", crt.Spec.Duration.Duration, "actual_duration", certDuration)
log.V(logf.InfoLevel).Info("requested certificate validity period differs from period given on returned certificate", "requested_duration", crt.Spec.Duration.Duration, "actual_duration", certDuration)
// TODO Use the message as the reason in a 'renewal status' condition
}
@@ -74,7 +74,7 @@ func (o IssuerOptions) CalculateDurationUntilRenew(ctx context.Context, cert *x5
// If not we notify with an event that we will renew the certificate
// before (certificate duration / 3) of its expiration duration.
if renewBefore > certDuration {
log.Info("certificate renewal duration was changed to fit inside the received certificate validity duration from issuer.")
log.V(logf.InfoLevel).Info("certificate renewal duration was changed to fit inside the received certificate validity duration from issuer.")
// TODO Use the message as the reason in a 'renewal status' condition
// We will renew 1/3 before the expiration date.
renewBefore = certDuration / 3
pkg/controller/ingress-shim/sync.go
+9 -8
View File
@@ -34,18 +34,19 @@ import (
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
"github.com/jetstack/cert-manager/pkg/logs"
logf "github.com/jetstack/cert-manager/pkg/logs"
utilerrors "k8s.io/apimachinery/pkg/util/errors"
)
var ingressGVK = extv1beta1.SchemeGroupVersion.WithKind("Ingress")
func (c *controller) Sync(ctx context.Context, ing *extv1beta1.Ingress) error {
log := logs.WithResource(logs.FromContext(ctx), ing)
ctx = logs.NewContext(ctx, log)
log := logf.WithResource(logf.FromContext(ctx), ing)
ctx = logf.NewContext(ctx, log)
if !shouldSync(ing, c.defaults.autoCertificateAnnotations) {
log.Info(fmt.Sprintf("not syncing ingress resource as it does not contain a %q or %q annotation",
cmapi.IngressIssuerNameAnnotationKey, cmapi.IngressClusterIssuerNameAnnotationKey))
log.V(logf.DebugLevel).Info("not syncing ingress resource as it does not contain a %q or %q annotation",
cmapi.IngressIssuerNameAnnotationKey, cmapi.IngressClusterIssuerNameAnnotationKey)
return nil
}
@@ -166,20 +167,20 @@ func (c *controller) buildCertificates(ctx context.Context, ing *extv1beta1.Ingr
// does then skip this entry
if existingCrt != nil {
log := logs.WithRelatedResource(log, existingCrt)
log.Info("certificate already exists for ingress resource, ensuring it is up to date")
log.V(logf.DebugLevel).Info("certificate already exists for ingress resource, ensuring it is up to date")
if metav1.GetControllerOf(existingCrt) == nil {
log.Info("certificate resource has no owner. refusing to update non-owned certificate resource for ingress")
log.V(logf.InfoLevel).Info("certificate resource has no owner. refusing to update non-owned certificate resource for ingress")
continue
}
if !metav1.IsControlledBy(existingCrt, ing) {
log.Info("certificate resource is not owned by this ingress. refusing to update non-owned certificate resource for ingress")
log.V(logf.InfoLevel).Info("certificate resource is not owned by this ingress. refusing to update non-owned certificate resource for ingress")
continue
}
if !certNeedsUpdate(existingCrt, crt) {
log.Info("certificate resource is already up to date for ingress")
log.V(logf.DebugLevel).Info("certificate resource is already up to date for ingress")
continue
}
pkg/controller/issuers/sync.go
+1 -1
View File
@@ -80,7 +80,7 @@ func (c *controller) Sync(ctx context.Context, iss *v1alpha2.Issuer) (err error)
err = i.Setup(ctx)
if err != nil {
s := messageErrorInitIssuer + err.Error()
log.Info(s)
log.V(logf.WarnLevel).Info(s)
c.recorder.Event(issuerCopy, v1.EventTypeWarning, errorInitIssuer, s)
return err
}
pkg/issuer/acme/dns/akamai/BUILD.bazel
+2 -1
View File
@@ -10,9 +10,10 @@ go_library(
visibility = ["//visibility:public"],
deps = [
"//pkg/issuer/acme/dns/util:go_default_library",
"//pkg/logs:go_default_library",
"//pkg/util:go_default_library",
"@com_github_go_logr_logr//:go_default_library",
"@com_github_pkg_errors//:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
],
)
pkg/issuer/acme/dns/akamai/akamai.go
+5 -2
View File
@@ -28,7 +28,8 @@ import (
"strings"
"time"
"k8s.io/klog/v2"
"github.com/go-logr/logr"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/jetstack/cert-manager/pkg/issuer/acme/dns/util"
pkgutil "github.com/jetstack/cert-manager/pkg/util"
@@ -46,6 +47,7 @@ type DNSProvider struct {
transport http.RoundTripper
findHostedDomainByFqdn func(string, []string) (string, error)
log logr.Logger
}
// NewDNSProvider returns a DNSProvider instance configured for Akamai.
@@ -56,6 +58,7 @@ func NewDNSProvider(serviceConsumerDomain, clientToken, clientSecret, accessToke
NewEdgeGridAuth(clientToken, clientSecret, accessToken),
http.DefaultTransport,
findHostedDomainByFqdn,
logf.Log.WithName("akamai-dns"),
}, nil
}
@@ -116,7 +119,7 @@ func (a *DNSProvider) setTxtRecord(fqdn string, dns01Record *dns01Record) error
return errors.Wrapf(err, "failed to save zone data for %q", hostedDomain)
}
klog.V(4).Infof("Updated Akamai TXT record for %q on %q using SOA serial of %d", recordName, hostedDomain, newSerial)
a.log.V(logf.DebugLevel).Info("Updated Akamai TXT record for %q on %q using SOA serial of %d", recordName, hostedDomain, newSerial)
return nil
}
pkg/issuer/acme/dns/azuredns/BUILD.bazel
+2 -1
View File
@@ -7,12 +7,13 @@ go_library(
visibility = ["//visibility:public"],
deps = [
"//pkg/issuer/acme/dns/util:go_default_library",
"//pkg/logs:go_default_library",
"@com_github_azure_azure_sdk_for_go//services/dns/mgmt/2017-10-01/dns:go_default_library",
"@com_github_azure_go_autorest_autorest//:go_default_library",
"@com_github_azure_go_autorest_autorest//azure:go_default_library",
"@com_github_azure_go_autorest_autorest_adal//:go_default_library",
"@com_github_azure_go_autorest_autorest_to//:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
"@com_github_go_logr_logr//:go_default_library",
],
)
pkg/issuer/acme/dns/azuredns/azuredns.go
+9 -6
View File
@@ -15,7 +15,8 @@ import (
"fmt"
"strings"
"k8s.io/klog/v2"
"github.com/go-logr/logr"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/Azure/azure-sdk-for-go/services/dns/mgmt/2017-10-01/dns"
"github.com/Azure/go-autorest/autorest"
@@ -32,6 +33,7 @@ type DNSProvider struct {
zoneClient dns.ZonesClient
resourceGroupName string
zoneName string
log logr.Logger
}
// NewDNSProviderCredentials returns a DNSProvider instance configured for the Azure
@@ -63,12 +65,13 @@ func NewDNSProviderCredentials(environment, clientID, clientSecret, subscription
zoneClient: zc,
resourceGroupName: resourceGroupName,
zoneName: zoneName,
log: logf.Log.WithName("azure-dns"),
}, nil
}
func getAuthorization(env azure.Environment, clientID, clientSecret, subscriptionID, tenantID string, ambient bool) (*adal.ServicePrincipalToken, error) {
if clientID != "" {
klog.Info("azuredns authenticating with clientID and secret key")
logf.Log.V(logf.InfoLevel).Info("azuredns authenticating with clientID and secret key")
oauthConfig, err := adal.NewOAuthConfig(env.ActiveDirectoryEndpoint, tenantID)
if err != nil {
return nil, err
@@ -79,7 +82,7 @@ func getAuthorization(env azure.Environment, clientID, clientSecret, subscriptio
}
return spt, nil
}
klog.Info("No ClientID found: authenticating azuredns with managed identity (MSI)")
logf.Log.V(logf.InfoLevel).Info("No ClientID found: authenticating azuredns with managed identity (MSI)")
if !ambient {
return nil, fmt.Errorf("ClientID is not set but neither `--cluster-issuer-ambient-credentials` nor `--issuer-ambient-credentials` are set. These are necessary to enable Azure Managed Identities")
}
@@ -104,7 +107,7 @@ func (c *DNSProvider) Present(domain, fqdn, value string) error {
func (c *DNSProvider) CleanUp(domain, fqdn, value string) error {
z, err := c.getHostedZoneName(fqdn)
if err != nil {
klog.Infof("Error getting hosted zone name for: %s, %v", fqdn, err)
c.log.V(logf.WarnLevel).Info("Error getting hosted zone name for: %s, %v", fqdn, err)
return err
}
@@ -133,7 +136,7 @@ func (c *DNSProvider) createRecord(fqdn, value string, ttl int) error {
z, err := c.getHostedZoneName(fqdn)
if err != nil {
klog.Infof("Error getting hosted zone name for: %s, %v", fqdn, err)
c.log.V(logf.WarnLevel).Info("Error getting hosted zone name for: %s, %v", fqdn, err)
return err
}
@@ -146,7 +149,7 @@ func (c *DNSProvider) createRecord(fqdn, value string, ttl int) error {
*rparams, "", "")
if err != nil {
klog.Infof("Error creating TXT: %s, %v", z, err)
c.log.V(logf.WarnLevel).Info("Error creating TXT: %s, %v", z, err)
return err
}
return nil
pkg/issuer/acme/dns/clouddns/BUILD.bazel
+2 -1
View File
@@ -7,7 +7,8 @@ go_library(
visibility = ["//visibility:public"],
deps = [
"//pkg/issuer/acme/dns/util:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
"//pkg/logs:go_default_library",
"@com_github_go_logr_logr//:go_default_library",
"@org_golang_google_api//dns/v1:go_default_library",
"@org_golang_google_api//option:go_default_library",
"@org_golang_x_net//context:go_default_library",
pkg/issuer/acme/dns/clouddns/clouddns.go
+7 -2
View File
@@ -16,13 +16,16 @@ import (
"os"
"time"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/go-logr/logr"
"golang.org/x/net/context"
"golang.org/x/oauth2/google"
"google.golang.org/api/dns/v1"
"google.golang.org/api/option"
"github.com/jetstack/cert-manager/pkg/issuer/acme/dns/util"
"k8s.io/klog/v2"
)
// DNSProvider is an implementation of the DNSProvider interface.
@@ -31,6 +34,7 @@ type DNSProvider struct {
dns01Nameservers []string
project string
client *dns.Service
log logr.Logger
}
func NewDNSProvider(project string, saBytes []byte, dns01Nameservers []string, ambient bool, hostedZoneName string) (*DNSProvider, error) {
@@ -86,6 +90,7 @@ func NewDNSProviderCredentials(project string, dns01Nameservers []string, hosted
client: svc,
dns01Nameservers: dns01Nameservers,
hostedZoneName: hostedZoneName,
log: logf.Log.WithName("clouddns"),
}, nil
}
@@ -235,7 +240,7 @@ func (c *DNSProvider) getHostedZone(domain string) (string, error) {
}
}
klog.V(5).Infof("No matching public GoogleCloud managed-zone for domain %s, falling back to a private managed-zone", authZone)
c.log.V(logf.DebugLevel).Info("No matching public GoogleCloud managed-zone for domain %s, falling back to a private managed-zone", authZone)
// fall back to first available zone, if none public
return zones.ManagedZones[0].Name, nil
}
pkg/issuer/acme/dns/dns.go
+14 -14
View File
@@ -43,7 +43,7 @@ import (
"github.com/jetstack/cert-manager/pkg/issuer/acme/dns/route53"
"github.com/jetstack/cert-manager/pkg/issuer/acme/dns/util"
webhookslv "github.com/jetstack/cert-manager/pkg/issuer/acme/dns/webhook"
"github.com/jetstack/cert-manager/pkg/logs"
logf "github.com/jetstack/cert-manager/pkg/logs"
)
// solver is the old solver type interface.
@@ -77,15 +77,15 @@ type Solver struct {
// Present performs the work to configure DNS to resolve a DNS01 challenge.
func (s *Solver) Present(ctx context.Context, issuer v1alpha2.GenericIssuer, ch *cmacme.Challenge) error {
log := logs.WithResource(logs.FromContext(ctx, "Present"), ch).WithValues("domain", ch.Spec.DNSName)
ctx = logs.NewContext(ctx, log)
log := logf.WithResource(logf.FromContext(ctx, "Present"), ch).WithValues("domain", ch.Spec.DNSName)
ctx = logf.NewContext(ctx, log)
webhookSolver, req, err := s.prepareChallengeRequest(issuer, ch)
if err != nil && err != errNotFound {
return err
}
if err == nil {
log.Info("presenting DNS01 challenge for domain")
log.V(logf.InfoLevel).Info("presenting DNS01 challenge for domain")
return webhookSolver.Present(req)
}
@@ -99,21 +99,21 @@ func (s *Solver) Present(ctx context.Context, issuer v1alpha2.GenericIssuer, ch
return err
}
log.Info("presenting DNS01 challenge for domain")
log.V(logf.DebugLevel).Info("presenting DNS01 challenge for domain")
return slv.Present(ch.Spec.DNSName, fqdn, ch.Spec.Key)
}
// Check verifies that the DNS records for the ACME challenge have propagated.
func (s *Solver) Check(ctx context.Context, issuer v1alpha2.GenericIssuer, ch *cmacme.Challenge) error {
log := logs.WithResource(logs.FromContext(ctx, "Check"), ch).WithValues("domain", ch.Spec.DNSName)
log := logf.WithResource(logf.FromContext(ctx, "Check"), ch).WithValues("domain", ch.Spec.DNSName)
fqdn, err := util.DNS01LookupFQDN(ch.Spec.DNSName, false, s.DNS01Nameservers...)
if err != nil {
return err
}
log.Info("checking DNS propagation", "nameservers", s.Context.DNS01Nameservers)
log.V(logf.DebugLevel).Info("checking DNS propagation", "nameservers", s.Context.DNS01Nameservers)
ok, err := util.PreCheckDNS(fqdn, ch.Spec.Key, s.Context.DNS01Nameservers,
s.Context.DNS01CheckAuthoritative)
@@ -125,9 +125,9 @@ func (s *Solver) Check(ctx context.Context, issuer v1alpha2.GenericIssuer, ch *c
}
ttl := 60
log.Info("waiting DNS record TTL to allow the DNS01 record to propagate for domain", "ttl", ttl, "fqdn", fqdn)
log.V(logf.DebugLevel).Info("waiting DNS record TTL to allow the DNS01 record to propagate for domain", "ttl", ttl, "fqdn", fqdn)
time.Sleep(time.Second * time.Duration(ttl))
log.Info("ACME DNS01 validation record propagated", "fqdn", fqdn)
log.V(logf.DebugLevel).Info("ACME DNS01 validation record propagated", "fqdn", fqdn)
return nil
}
@@ -135,15 +135,15 @@ func (s *Solver) Check(ctx context.Context, issuer v1alpha2.GenericIssuer, ch *c
// CleanUp removes DNS records which are no longer needed after
// certificate issuance.
func (s *Solver) CleanUp(ctx context.Context, issuer v1alpha2.GenericIssuer, ch *cmacme.Challenge) error {
log := logs.WithResource(logs.FromContext(ctx, "CleanUp"), ch).WithValues("domain", ch.Spec.DNSName)
ctx = logs.NewContext(ctx, log)
log := logf.WithResource(logf.FromContext(ctx, "CleanUp"), ch).WithValues("domain", ch.Spec.DNSName)
ctx = logf.NewContext(ctx, log)
webhookSolver, req, err := s.prepareChallengeRequest(issuer, ch)
if err != nil && err != errNotFound {
return err
}
if err == nil {
log.Info("cleaning up DNS01 challenge")
log.V(logf.DebugLevel).Info("cleaning up DNS01 challenge")
return webhookSolver.CleanUp(req)
}
@@ -179,8 +179,8 @@ func extractChallengeSolverConfig(ch *cmacme.Challenge) (*cmacme.ACMEChallengeSo
// The providerName is the name of an ACME DNS-01 challenge provider as
// specified on the Issuer resource for the Solver.
func (s *Solver) solverForChallenge(ctx context.Context, issuer v1alpha2.GenericIssuer, ch *cmacme.Challenge) (solver, *cmacme.ACMEChallengeSolverDNS01, error) {
log := logs.FromContext(ctx, "solverForChallenge")
dbg := log.V(logs.DebugLevel)
log := logf.FromContext(ctx, "solverForChallenge")
dbg := log.V(logf.DebugLevel)
resourceNamespace := s.ResourceNamespace(issuer)
canUseAmbientCredentials := s.CanUseAmbientCredentials(issuer)
pkg/issuer/acme/dns/rfc2136/BUILD.bazel
+1 -1
View File
@@ -13,13 +13,13 @@ go_library(
"//pkg/apis/acme/v1alpha2:go_default_library",
"//pkg/apis/meta/v1:go_default_library",
"//pkg/internal/apis/certmanager/validation/util:go_default_library",
"//pkg/logs:go_default_library",
"@com_github_miekg_dns//:go_default_library",
"@io_k8s_apiextensions_apiserver//pkg/apis/apiextensions/v1beta1:go_default_library",
"@io_k8s_client_go//informers:go_default_library",
"@io_k8s_client_go//kubernetes:go_default_library",
"@io_k8s_client_go//listers/core/v1:go_default_library",
"@io_k8s_client_go//rest:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
],
)
pkg/issuer/acme/dns/rfc2136/provider.go
+2 -3
View File
@@ -21,8 +21,6 @@ import (
"fmt"
"time"
"k8s.io/klog/v2"
extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
"k8s.io/client-go/informers"
"k8s.io/client-go/kubernetes"
@@ -32,6 +30,7 @@ import (
whapi "github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
cmacme "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha2"
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
logf "github.com/jetstack/cert-manager/pkg/logs"
)
type Solver struct {
@@ -118,7 +117,7 @@ func (s *Solver) loadConfig(cfgJSON extapi.JSON) (*cmacme.ACMEIssuerDNS01Provide
func loadSecretKeySelector(l corelisters.SecretNamespaceLister, sks cmmeta.SecretKeySelector, defaultKey string) ([]byte, error) {
if sks.Name == "" {
klog.Info("rfc2136: secret name not specified")
logf.Log.V(logf.WarnLevel).Info("rfc2136: secret name not specified")
return nil, nil
}
key := defaultKey
pkg/issuer/acme/dns/rfc2136/rfc2136.go
+7 -6
View File
@@ -26,8 +26,9 @@ import (
"strings"
"time"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/miekg/dns"
"k8s.io/klog/v2"
"github.com/jetstack/cert-manager/pkg/internal/apis/certmanager/validation/util"
)
@@ -56,7 +57,7 @@ type DNSProvider struct {
// authentication, leave the TSIG parameters as empty strings.
// nameserver must be a network address in the form "IP" or "IP:port".
func NewDNSProviderCredentials(nameserver, tsigAlgorithm, tsigKeyName, tsigSecret string) (*DNSProvider, error) {
klog.V(5).Infof("Creating RFC2136 Provider")
logf.Log.V(logf.DebugLevel).Info("Creating RFC2136 Provider")
d := &DNSProvider{}
@@ -83,16 +84,16 @@ func NewDNSProviderCredentials(nameserver, tsigAlgorithm, tsigKeyName, tsigSecre
}
d.tsigAlgorithm = tsigAlgorithm
klog.V(5).Infof("DNSProvider nameserver: %s\n", d.nameserver)
klog.V(5).Infof(" tsigAlgorithm: %s\n", d.tsigAlgorithm)
klog.V(5).Infof(" tsigKeyName: %s\n", d.tsigKeyName)
logf.Log.V(logf.DebugLevel).Info("DNSProvider nameserver: %s\n", d.nameserver)
logf.Log.V(logf.DebugLevel).Info(" tsigAlgorithm: %s\n", d.tsigAlgorithm)
logf.Log.V(logf.DebugLevel).Info(" tsigKeyName: %s\n", d.tsigKeyName)
keyLen := len(d.tsigSecret)
mask := make([]rune, keyLen/2)
for i := range mask {
mask[i] = '*'
}
masked := d.tsigSecret[0:keyLen/4] + string(mask) + d.tsigSecret[keyLen/4*3:keyLen]
klog.V(5).Infof(" tsigSecret: %s\n", masked)
logf.Log.V(logf.DebugLevel).Info(" tsigSecret: %s\n", masked)
return d, nil
}
pkg/issuer/acme/dns/route53/BUILD.bazel
+2 -1
View File
@@ -7,6 +7,7 @@ go_library(
visibility = ["//visibility:public"],
deps = [
"//pkg/issuer/acme/dns/util:go_default_library",
"//pkg/logs:go_default_library",
"//pkg/util:go_default_library",
"@com_github_aws_aws_sdk_go//aws:go_default_library",
"@com_github_aws_aws_sdk_go//aws/awserr:go_default_library",
@@ -16,7 +17,7 @@ go_library(
"@com_github_aws_aws_sdk_go//service/route53:go_default_library",
"@com_github_aws_aws_sdk_go//service/sts:go_default_library",
"@com_github_aws_aws_sdk_go//service/sts/stsiface:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
"@com_github_go_logr_logr//:go_default_library",
],
)
pkg/issuer/acme/dns/route53/route53.go
+12 -5
View File
@@ -15,6 +15,10 @@ import (
"strings"
"time"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/go-logr/logr"
"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/awserr"
"github.com/aws/aws-sdk-go/aws/credentials"
@@ -25,7 +29,6 @@ import (
"github.com/aws/aws-sdk-go/service/sts/stsiface"
"github.com/jetstack/cert-manager/pkg/issuer/acme/dns/util"
pkgutil "github.com/jetstack/cert-manager/pkg/util"
"k8s.io/klog/v2"
)
const (
@@ -38,6 +41,7 @@ type DNSProvider struct {
dns01Nameservers []string
client *route53.Route53
hostedZoneID string
log logr.Logger
}
type sessionProvider struct {
@@ -47,6 +51,7 @@ type sessionProvider struct {
Region string
Role string
StsProvider func(*session.Session) stsiface.STSAPI
log logr.Logger
}
func (d *sessionProvider) GetSession() (*session.Session, error) {
@@ -67,12 +72,12 @@ func (d *sessionProvider) GetSession() (*session.Session, error) {
}
if useAmbientCredentials {
klog.V(5).Infof("using ambient credentials")
d.log.V(logf.DebugLevel).Info("using ambient credentials")
// Leaving credentials unset results in a default credential chain being
// used; this chain is a reasonable default for getting ambient creds.
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
} else {
klog.V(5).Infof("not using ambient credentials")
d.log.V(logf.DebugLevel).Info("not using ambient credentials")
sessionOpts.Config.Credentials = credentials.NewStaticCredentials(d.AccessKeyID, d.SecretAccessKey, "")
// also disable 'ambient' region sources
sessionOpts.SharedConfigState = session.SharedConfigDisable
@@ -84,7 +89,7 @@ func (d *sessionProvider) GetSession() (*session.Session, error) {
}
if d.Role != "" {
klog.V(5).Infof("assuming role: %s", d.Role)
d.log.V(logf.DebugLevel).Info("assuming role: %s", d.Role)
stsSvc := d.StsProvider(sess)
result, err := stsSvc.AssumeRole(&sts.AssumeRoleInput{
RoleArn: aws.String(d.Role),
@@ -126,6 +131,7 @@ func newSessionProvider(accessKeyID, secretAccessKey, region, role string, ambie
Region: region,
Role: role,
StsProvider: defaultSTSProvider,
log: logf.Log.WithName("route53-session-provider"),
}, nil
}
@@ -153,6 +159,7 @@ func NewDNSProvider(accessKeyID, secretAccessKey, hostedZoneID, region, role str
client: client,
hostedZoneID: hostedZoneID,
dns01Nameservers: dns01Nameservers,
log: logf.Log.WithName("route53"),
}, nil
}
@@ -192,7 +199,7 @@ func (r *DNSProvider) changeRecord(action, fqdn, value string, ttl int) error {
if err != nil {
if awserr, ok := err.(awserr.Error); ok {
if action == route53.ChangeActionDelete && awserr.Code() == route53.ErrCodeInvalidChangeBatch {
klog.V(5).Infof("ignoring InvalidChangeBatch error: %v", err)
r.log.V(logf.DebugLevel).Info("ignoring InvalidChangeBatch error: %v", err)
// If we try to delete something and get a 'InvalidChangeBatch' that
// means it's already deleted, no need to consider it an error.
return nil
pkg/issuer/acme/dns/util/BUILD.bazel
+1 -1
View File
@@ -9,8 +9,8 @@ go_library(
importpath = "github.com/jetstack/cert-manager/pkg/issuer/acme/dns/util",
visibility = ["//visibility:public"],
deps = [
"//pkg/logs:go_default_library",
"@com_github_miekg_dns//:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
],
)
pkg/issuer/acme/dns/util/wait.go
+9 -8
View File
@@ -16,7 +16,8 @@ import (
"time"
"github.com/miekg/dns"
"k8s.io/klog/v2"
logf "github.com/jetstack/cert-manager/pkg/logs"
)
type preCheckDNSFunc func(fqdn, value string, nameservers []string,
@@ -70,7 +71,7 @@ func updateDomainWithCName(r *dns.Msg, fqdn string) string {
for _, rr := range r.Answer {
if cn, ok := rr.(*dns.CNAME); ok {
if cn.Hdr.Name == fqdn {
klog.Infof("Updating FQDN: %s with its CNAME: %s", fqdn, cn.Target)
logf.Log.V(logf.DebugLevel).Info("Updating FQDN: %s with its CNAME: %s", fqdn, cn.Target)
fqdn = cn.Target
break
}
@@ -120,7 +121,7 @@ func checkAuthoritativeNss(fqdn, value string, nameservers []string) (bool, erro
return false, fmt.Errorf("NS %s returned %s for %s", ns, dns.RcodeToString[r.Rcode], fqdn)
}
klog.V(6).Infof("Looking up TXT records for %q", fqdn)
logf.Log.V(logf.DebugLevel).Info("Looking up TXT records for %q", fqdn)
var found bool
for _, rr := range r.Answer {
if txt, ok := rr.(*dns.TXT); ok {
@@ -158,7 +159,7 @@ func DNSQuery(fqdn string, rtype uint16, nameservers []string, recursive bool) (
if (in != nil && in.Truncated) ||
(err != nil && strings.HasPrefix(err.Error(), "read udp") && strings.HasSuffix(err.Error(), "i/o timeout")) {
klog.V(6).Infof("UDP dns lookup failed, retrying with TCP: %v", err)
logf.Log.V(logf.DebugLevel).Info("UDP dns lookup failed, retrying with TCP: %v", err)
tcp := &dns.Client{Net: "tcp", Timeout: DNSTimeout}
// If the TCP request succeeds, the err will reset to nil
in, _, err = tcp.Exchange(m, ns)
@@ -274,7 +275,7 @@ func matchCAA(caas []*dns.CAA, issuerIDs map[string]bool, iswildcard bool) bool
func lookupNameservers(fqdn string, nameservers []string) ([]string, error) {
var authoritativeNss []string
klog.V(6).Infof("Searching fqdn %q using seed nameservers [%s]", fqdn, strings.Join(nameservers, ", "))
logf.Log.V(logf.DebugLevel).Info("Searching fqdn %q using seed nameservers [%s]", fqdn, strings.Join(nameservers, ", "))
zone, err := FindZoneByFqdn(fqdn, nameservers)
if err != nil {
return nil, fmt.Errorf("Could not determine the zone for %q: %v", fqdn, err)
@@ -292,7 +293,7 @@ func lookupNameservers(fqdn string, nameservers []string) ([]string, error) {
}
if len(authoritativeNss) > 0 {
klog.V(6).Infof("Returning authoritative nameservers [%s]", strings.Join(authoritativeNss, ", "))
logf.Log.V(logf.DebugLevel).Info("Returning authoritative nameservers [%s]", strings.Join(authoritativeNss, ", "))
return authoritativeNss, nil
}
return nil, fmt.Errorf("Could not determine authoritative nameservers for %q", fqdn)
@@ -305,7 +306,7 @@ func FindZoneByFqdn(fqdn string, nameservers []string) (string, error) {
// Do we have it cached?
if zone, ok := fqdnToZone[fqdn]; ok {
fqdnToZoneLock.RUnlock()
klog.V(6).Infof("Returning cached zone record %q for fqdn %q", zone, fqdn)
logf.Log.V(logf.DebugLevel).Info("Returning cached zone record %q for fqdn %q", zone, fqdn)
return zone, nil
}
fqdnToZoneLock.RUnlock()
@@ -341,7 +342,7 @@ func FindZoneByFqdn(fqdn string, nameservers []string) (string, error) {
zone := soa.Hdr.Name
fqdnToZone[fqdn] = zone
klog.V(6).Infof("Returning discovered zone record %q for fqdn %q", zone, fqdn)
logf.Log.V(logf.DebugLevel).Info("Returning discovered zone record %q for fqdn %q", zone, fqdn)
return zone, nil
}
}
pkg/issuer/acme/dns/webhook/BUILD.bazel
+1 -1
View File
@@ -9,12 +9,12 @@ go_library(
"//pkg/acme/webhook/apis/acme/v1alpha1:go_default_library",
"//pkg/apis/acme/v1alpha2:go_default_library",
"//pkg/client/clientset/versioned/scheme:go_default_library",
"//pkg/logs:go_default_library",
"@io_k8s_apiextensions_apiserver//pkg/apis/apiextensions/v1beta1:go_default_library",
"@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
"@io_k8s_apimachinery//pkg/runtime/serializer:go_default_library",
"@io_k8s_apimachinery//pkg/util/errors:go_default_library",
"@io_k8s_client_go//rest:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
],
)
pkg/issuer/acme/dns/webhook/webhook.go
+3 -3
View File
@@ -27,11 +27,11 @@ import (
"k8s.io/apimachinery/pkg/runtime/serializer"
utilerrors "k8s.io/apimachinery/pkg/util/errors"
"k8s.io/client-go/rest"
"k8s.io/klog/v2"
"github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
cmacme "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha2"
"github.com/jetstack/cert-manager/pkg/client/clientset/versioned/scheme"
logf "github.com/jetstack/cert-manager/pkg/logs"
)
type Webhook struct {
@@ -60,7 +60,7 @@ func (r *Webhook) Present(ch *v1alpha1.ChallengeRequest) error {
}
if respPayload.Response.Success && resErr == nil {
klog.Infof("Present call succeeded")
logf.Log.V(logf.InfoLevel).Info("Present call succeeded")
return nil
}
@@ -96,7 +96,7 @@ func (r *Webhook) CleanUp(ch *v1alpha1.ChallengeRequest) error {
}
if respPayload.Response.Success && resErr == nil {
klog.Infof("CleanUp call succeeded")
logf.Log.V(logf.InfoLevel).Info("CleanUp call succeeded")
return nil
}
pkg/issuer/acme/http/ingress.go
+10 -10
View File
@@ -80,7 +80,7 @@ func (s *Solver) ensureIngress(ctx context.Context, ch *cmacme.Challenge, svcNam
if httpDomainCfg.Name != "" {
log := logf.WithRelatedResourceName(log, httpDomainCfg.Name, ch.Namespace, "Ingress")
ctx := logf.NewContext(ctx, log)
log.Info("adding solver paths to existing ingress resource")
log.V(logf.DebugLevel).Info("adding solver paths to existing ingress resource")
return s.addChallengePathToIngress(ctx, ch, svcName)
}
existingIngresses, err := s.getIngressesForChallenge(ctx, ch)
@@ -92,7 +92,7 @@ func (s *Solver) ensureIngress(ctx context.Context, ch *cmacme.Challenge, svcNam
return existingIngresses[0], nil
}
if len(existingIngresses) == 1 && ingressServiceName(existingIngresses[0]) != svcName {
log.Info("service name changed. cleaning up all existing ingresses.")
log.V(logf.DebugLevel).Info("service name changed. cleaning up all existing ingresses.")
err := s.cleanupIngresses(ctx, ch)
if err != nil {
return nil, err
@@ -100,7 +100,7 @@ func (s *Solver) ensureIngress(ctx context.Context, ch *cmacme.Challenge, svcNam
return nil, fmt.Errorf("service name changed, existing challenge solver ingresses found and cleaned up. retrying challenge sync")
}
if len(existingIngresses) > 1 {
log.Info("multiple challenge solver ingresses found for challenge. cleaning up all existing ingresses.")
log.V(logf.InfoLevel).Info("multiple challenge solver ingresses found for challenge. cleaning up all existing ingresses.")
err := s.cleanupIngresses(ctx, ch)
if err != nil {
return nil, err
@@ -108,7 +108,7 @@ func (s *Solver) ensureIngress(ctx context.Context, ch *cmacme.Challenge, svcNam
return nil, fmt.Errorf("multiple existing challenge solver ingresses found and cleaned up. retrying challenge sync")
}
log.Info("creating HTTP01 challenge solver ingress")
log.V(logf.DebugLevel).Info("creating HTTP01 challenge solver ingress")
return s.createIngress(ch, svcName)
}
@@ -276,14 +276,14 @@ func (s *Solver) cleanupIngresses(ctx context.Context, ch *cmacme.Challenge) err
for _, ingress := range ingresses {
log := logf.WithRelatedResource(log, ingress).V(logf.DebugLevel)
log.Info("deleting ingress resource")
log.V(logf.DebugLevel).Info("deleting ingress resource")
err := s.Client.ExtensionsV1beta1().Ingresses(ingress.Namespace).Delete(context.TODO(), ingress.Name, metav1.DeleteOptions{})
if err != nil {
log.Info("failed to delete ingress resource", "error", err)
log.V(logf.WarnLevel).Info("failed to delete ingress resource", "error", err)
errs = append(errs, err)
continue
}
log.Info("successfully deleted ingress resource")
log.V(logf.DebugLevel).Info("successfully deleted ingress resource")
}
return utilerrors.NewAggregate(errs)
}
@@ -299,7 +299,7 @@ func (s *Solver) cleanupIngresses(ctx context.Context, ch *cmacme.Challenge) err
}
log = logf.WithRelatedResource(log, ing)
log.Info("attempting to clean up automatically added solver paths on ingress resource")
log.V(logf.DebugLevel).Info("attempting to clean up automatically added solver paths on ingress resource")
ingPathToDel := solverPathFn(ch.Spec.Token)
var ingRules []extv1beta1.IngressRule
for _, rule := range ing.Spec.Rules {
@@ -319,7 +319,7 @@ func (s *Solver) cleanupIngresses(ctx context.Context, ch *cmacme.Challenge) err
// delete here, delete it
for i, path := range rule.HTTP.Paths {
if path.Path == ingPathToDel {
log.Info("deleting challenge solver path on ingress resource", "host", rule.Host, "path", path.Path)
log.V(logf.DebugLevel).Info("deleting challenge solver path on ingress resource", "host", rule.Host, "path", path.Path)
rule.HTTP.Paths = append(rule.HTTP.Paths[:i], rule.HTTP.Paths[i+1:]...)
}
}
@@ -337,7 +337,7 @@ func (s *Solver) cleanupIngresses(ctx context.Context, ch *cmacme.Challenge) err
return err
}
log.Info("cleaned up all challenge solver paths on ingress resource")
log.V(logf.DebugLevel).Info("cleaned up all challenge solver paths on ingress resource")
return nil
}
pkg/issuer/acme/http/pod.go
+5 -5
View File
@@ -59,7 +59,7 @@ func (s *Solver) ensurePod(ctx context.Context, ch *cmacme.Challenge) (*corev1.P
return existingPods[0], nil
}
if len(existingPods) > 1 {
log.Info("multiple challenge solver pods found for challenge. cleaning up all existing pods.")
log.V(logf.InfoLevel).Info("multiple challenge solver pods found for challenge. cleaning up all existing pods.")
err := s.cleanupPods(ctx, ch)
if err != nil {
return nil, err
@@ -67,7 +67,7 @@ func (s *Solver) ensurePod(ctx context.Context, ch *cmacme.Challenge) (*corev1.P
return nil, fmt.Errorf("multiple existing challenge solver pods found and cleaned up. retrying challenge sync")
}
log.Info("creating HTTP01 challenge solver pod")
log.V(logf.InfoLevel).Info("creating HTTP01 challenge solver pod")
return s.createPod(ch)
}
@@ -115,15 +115,15 @@ func (s *Solver) cleanupPods(ctx context.Context, ch *cmacme.Challenge) error {
var errs []error
for _, pod := range pods {
log := logf.WithRelatedResource(log, pod).V(logf.DebugLevel)
log.Info("deleting pod resource")
log.V(logf.InfoLevel).Info("deleting pod resource")
err := s.Client.CoreV1().Pods(pod.Namespace).Delete(context.TODO(), pod.Name, metav1.DeleteOptions{})
if err != nil {
log.Info("failed to delete pod resource", "error", err)
log.V(logf.WarnLevel).Info("failed to delete pod resource", "error", err)
errs = append(errs, err)
continue
}
log.Info("successfully deleted pod resource")
log.V(logf.InfoLevel).Info("successfully deleted pod resource")
}
return utilerrors.NewAggregate(errs)
pkg/issuer/acme/http/service.go
+5 -5
View File
@@ -44,7 +44,7 @@ func (s *Solver) ensureService(ctx context.Context, ch *cmacme.Challenge) (*core
return existingServices[0], nil
}
if len(existingServices) > 1 {
log.Info("multiple challenge solver services found for challenge. cleaning up all existing services.")
log.V(logf.DebugLevel).Info("multiple challenge solver services found for challenge. cleaning up all existing services.")
err := s.cleanupServices(ctx, ch)
if err != nil {
return nil, err
@@ -52,7 +52,7 @@ func (s *Solver) ensureService(ctx context.Context, ch *cmacme.Challenge) (*core
return nil, fmt.Errorf("multiple existing challenge solver services found and cleaned up. retrying challenge sync")
}
log.Info("creating HTTP01 challenge solver service")
log.V(logf.DebugLevel).Info("creating HTTP01 challenge solver service")
return s.createService(ch)
}
@@ -146,15 +146,15 @@ func (s *Solver) cleanupServices(ctx context.Context, ch *cmacme.Challenge) erro
var errs []error
for _, service := range services {
log := logf.WithRelatedResource(log, service).V(logf.DebugLevel)
log.Info("deleting service resource")
log.V(logf.DebugLevel).Info("deleting service resource")
err := s.Client.CoreV1().Services(service.Namespace).Delete(context.TODO(), service.Name, metav1.DeleteOptions{})
if err != nil {
log.Info("failed to delete pod resource", "error", err)
log.V(logf.WarnLevel).Info("failed to delete pod resource", "error", err)
errs = append(errs, err)
continue
}
log.Info("successfully deleted pod resource")
log.V(logf.DebugLevel).Info("successfully deleted pod resource")
}
return utilerrors.NewAggregate(errs)
}
pkg/issuer/acme/setup.go
+5 -5
View File
@@ -87,7 +87,7 @@ func (a *Acme) Setup(ctx context.Context) error {
pk, err := kube.SecretTLSKeyRef(ctx, a.secretsLister, ns, privateKeySelector.Name, privateKeySelector.Key)
switch {
case apierrors.IsNotFound(err):
log.Info("generating acme account private key")
log.V(logf.InfoLevel).Info("generating acme account private key")
pk, err = a.createAccountPrivateKey(privateKeySelector, ns)
if err != nil {
s := messageAccountRegistrationFailed + err.Error()
@@ -162,7 +162,7 @@ func (a *Acme) Setup(ctx context.Context) error {
a.issuer.GetStatus().ACMEStatus().URI != "" &&
parsedAccountURL.Host == parsedServerURL.Host &&
a.issuer.GetStatus().ACMEStatus().LastRegisteredEmail == a.issuer.GetSpec().ACME.Email {
log.Info("skipping re-verifying ACME account as cached registration " +
log.V(logf.InfoLevel).Info("skipping re-verifying ACME account as cached registration " +
"details look sufficient")
// ensure the cached client in the account registry is up to date
a.accountRegistry.AddClient(httpClient, string(a.issuer.GetUID()), *a.issuer.GetSpec().ACME, rsaPk)
@@ -170,7 +170,7 @@ func (a *Acme) Setup(ctx context.Context) error {
}
if parsedAccountURL.Host != parsedServerURL.Host {
log.Info("ACME server URL host and ACME private key registration " +
log.V(logf.InfoLevel).Info("ACME server URL host and ACME private key registration " +
"host differ. Re-checking ACME account registration")
a.issuer.GetStatus().ACMEStatus().URI = ""
}
@@ -262,7 +262,7 @@ func (a *Acme) Setup(ctx context.Context) error {
return err
}
log.Info("verified existing registration with ACME server")
log.V(logf.InfoLevel).Info("verified existing registration with ACME server")
apiutil.SetIssuerCondition(a.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionTrue, successAccountRegistered, messageAccountRegistered)
a.issuer.GetStatus().ACMEStatus().URI = account.URI
a.issuer.GetStatus().ACMEStatus().LastRegisteredEmail = registeredEmail
@@ -283,7 +283,7 @@ func ensureEmailUpToDate(ctx context.Context, cl client.Interface, acc *acmeapi.
// if they are different, we update the account
if registeredEmail != specEmail {
log.Info("updating ACME account email address", "email", specEmail)
log.V(logf.DebugLevel).Info("updating ACME account email address", "email", specEmail)
emailurl := []string(nil)
if specEmail != "" {
emailurl = []string{fmt.Sprintf("mailto:%s", strings.ToLower(specEmail))}
pkg/issuer/ca/setup.go
+2 -2
View File
@@ -19,7 +19,7 @@ package ca
import (
"context"
"k8s.io/api/core/v1"
v1 "k8s.io/api/core/v1"
apiutil "github.com/jetstack/cert-manager/pkg/api/util"
"github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
@@ -71,7 +71,7 @@ func (c *CA) Setup(ctx context.Context) error {
return nil
}
log.Info("signing CA verified")
log.V(logf.DebugLevel).Info("signing CA verified")
c.Recorder.Event(c.issuer, v1.EventTypeNormal, successKeyPairVerified, messageKeyPairVerified)
apiutil.SetIssuerCondition(c.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionTrue, successKeyPairVerified, messageKeyPairVerified)
pkg/issuer/vault/BUILD.bazel
+1 -1
View File
@@ -15,8 +15,8 @@ go_library(
"//pkg/controller:go_default_library",
"//pkg/internal/vault:go_default_library",
"//pkg/issuer:go_default_library",
"//pkg/logs:go_default_library",
"@io_k8s_client_go//listers/core/v1:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
],
)
pkg/issuer/vault/setup.go
+12 -13
View File
@@ -20,12 +20,11 @@ import (
"context"
"fmt"
"k8s.io/klog/v2"
apiutil "github.com/jetstack/cert-manager/pkg/api/util"
"github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
vaultinternal "github.com/jetstack/cert-manager/pkg/internal/vault"
logf "github.com/jetstack/cert-manager/pkg/logs"
)
const (
@@ -45,7 +44,7 @@ const (
func (v *Vault) Setup(ctx context.Context) error {
if v.issuer.GetSpec().Vault == nil {
klog.Infof("%s: %s", v.issuer.GetObjectMeta().Name, messageVaultConfigRequired)
logf.Log.V(logf.WarnLevel).Info("%s: %s", v.issuer.GetObjectMeta().Name, messageVaultConfigRequired)
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorVault, messageVaultConfigRequired)
return nil
}
@@ -53,7 +52,7 @@ func (v *Vault) Setup(ctx context.Context) error {
// check if Vault server info is specified.
if v.issuer.GetSpec().Vault.Server == "" ||
v.issuer.GetSpec().Vault.Path == "" {
klog.Infof("%s: %s", v.issuer.GetObjectMeta().Name, messageServerAndPathRequired)
logf.Log.V(logf.WarnLevel).Info("%s: %s", v.issuer.GetObjectMeta().Name, messageServerAndPathRequired)
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorVault, messageServerAndPathRequired)
return nil
}
@@ -64,7 +63,7 @@ func (v *Vault) Setup(ctx context.Context) error {
// check if at least one auth method is specified.
if tokenAuth == nil && appRoleAuth == nil && kubeAuth == nil {
klog.Infof("%s: %s", v.issuer.GetObjectMeta().Name, messageAuthFieldsRequired)
logf.Log.V(logf.WarnLevel).Info("%s: %s", v.issuer.GetObjectMeta().Name, messageAuthFieldsRequired)
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorVault, messageAuthFieldsRequired)
return nil
}
@@ -73,28 +72,28 @@ func (v *Vault) Setup(ctx context.Context) error {
if (tokenAuth != nil && appRoleAuth != nil) ||
(tokenAuth != nil && kubeAuth != nil) ||
(appRoleAuth != nil && kubeAuth != nil) {
klog.Infof("%s: %s", v.issuer.GetObjectMeta().Name, messageAuthFieldRequired)
logf.Log.V(logf.WarnLevel).Info("%s: %s", v.issuer.GetObjectMeta().Name, messageAuthFieldRequired)
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorVault, messageAuthFieldRequired)
return nil
}
// check if all mandatory Vault Token fields are set.
if tokenAuth != nil && len(tokenAuth.Name) == 0 {
klog.Infof("%s: %s", v.issuer.GetObjectMeta().Name, messageAuthFieldRequired)
logf.Log.V(logf.WarnLevel).Info("%s: %s", v.issuer.GetObjectMeta().Name, messageAuthFieldRequired)
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorVault, messageAuthFieldRequired)
return nil
}
// check if all mandatory Vault appRole fields are set.
if appRoleAuth != nil && (len(appRoleAuth.RoleId) == 0 || len(appRoleAuth.SecretRef.Name) == 0) {
klog.Infof("%s: %s", v.issuer.GetObjectMeta().Name, messageAuthFieldRequired)
logf.Log.V(logf.WarnLevel).Info("%s: %s", v.issuer.GetObjectMeta().Name, messageAuthFieldRequired)
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorVault, messageAuthFieldRequired)
return nil
}
// check if all mandatory Vault Kubernetes fields are set.
if kubeAuth != nil && (len(kubeAuth.SecretRef.Name) == 0 || len(kubeAuth.Role) == 0) {
klog.Infof("%s: %s", v.issuer.GetObjectMeta().Name, messageAuthFieldRequired)
logf.Log.V(logf.WarnLevel).Info("%s: %s", v.issuer.GetObjectMeta().Name, messageAuthFieldRequired)
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorVault, messageAuthFieldRequired)
return nil
}
@@ -102,7 +101,7 @@ func (v *Vault) Setup(ctx context.Context) error {
client, err := vaultinternal.New(v.resourceNamespace, v.secretsLister, v.issuer)
if err != nil {
s := messageVaultClientInitFailed + err.Error()
klog.V(4).Infof("%s: %s", v.issuer.GetObjectMeta().Name, s)
logf.Log.V(logf.DebugLevel).Info("%s: %s", v.issuer.GetObjectMeta().Name, s)
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorVault, s)
return err
}
@@ -110,18 +109,18 @@ func (v *Vault) Setup(ctx context.Context) error {
health, err := client.Sys().Health()
if err != nil {
s := messageVaultHealthCheckFailed + err.Error()
klog.V(4).Infof("%s: %s", v.issuer.GetObjectMeta().Name, s)
logf.Log.V(logf.DebugLevel).Info("%s: %s", v.issuer.GetObjectMeta().Name, s)
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorVault, s)
return err
}
if !health.Initialized || health.Sealed {
klog.V(4).Infof("%s: %s: health: %v", v.issuer.GetObjectMeta().Name, messageVaultStatusVerificationFailed, health)
logf.Log.V(logf.DebugLevel).Info("%s: %s: health: %v", v.issuer.GetObjectMeta().Name, messageVaultStatusVerificationFailed, health)
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorVault, messageVaultStatusVerificationFailed)
return fmt.Errorf(messageVaultStatusVerificationFailed)
}
klog.Info(messageVaultVerified)
logf.Log.V(logf.DebugLevel).Info(messageVaultVerified)
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionTrue, successVaultVerified, messageVaultVerified)
return nil
}
pkg/issuer/venafi/BUILD.bazel
+2 -1
View File
@@ -15,9 +15,10 @@ go_library(
"//pkg/controller:go_default_library",
"//pkg/issuer:go_default_library",
"//pkg/issuer/venafi/client:go_default_library",
"//pkg/logs:go_default_library",
"@com_github_go_logr_logr//:go_default_library",
"@io_k8s_api//core/v1:go_default_library",
"@io_k8s_client_go//listers/core/v1:go_default_library",
"@io_k8s_klog_v2//:go_default_library",
],
)
pkg/issuer/venafi/setup.go
+4 -5
View File
@@ -20,12 +20,11 @@ import (
"context"
"fmt"
corev1 "k8s.io/api/core/v1"
"k8s.io/klog/v2"
apiutil "github.com/jetstack/cert-manager/pkg/api/util"
"github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
logf "github.com/jetstack/cert-manager/pkg/logs"
corev1 "k8s.io/api/core/v1"
)
func (v *Venafi) Setup(ctx context.Context) error {
@@ -36,7 +35,7 @@ func (v *Venafi) Setup(ctx context.Context) error {
err = client.Ping()
if err != nil {
klog.Infof("Issuer could not connect to endpoint with provided credentials. Issuer failed to connect to endpoint\n")
v.log.V(logf.WarnLevel).Info("Issuer could not connect to endpoint with provided credentials. Issuer failed to connect to endpoint")
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse,
"ErrorPing", fmt.Sprintf("Failed to connect to Venafi endpoint"))
return fmt.Errorf("error verifying Venafi client: %s", err.Error())
@@ -51,7 +50,7 @@ func (v *Venafi) Setup(ctx context.Context) error {
v.Recorder.Eventf(v.issuer, corev1.EventTypeNormal, "Ready", "Verified issuer with Venafi server")
}
klog.Info("Venafi issuer started")
v.log.V(logf.DebugLevel).Info("Venafi issuer started")
apiutil.SetIssuerCondition(v.issuer, v1alpha2.IssuerConditionReady, cmmeta.ConditionTrue, "Venafi issuer started", "Venafi issuer started")
return nil
pkg/issuer/venafi/venafi.go
+5
View File
@@ -17,6 +17,8 @@ limitations under the License.
package venafi
import (
"github.com/go-logr/logr"
logf "github.com/jetstack/cert-manager/pkg/logs"
corelisters "k8s.io/client-go/listers/core/v1"
apiutil "github.com/jetstack/cert-manager/pkg/api/util"
@@ -39,6 +41,8 @@ type Venafi struct {
resourceNamespace string
clientBuilder client.VenafiClientBuilder
log logr.Logger
}
func NewVenafi(ctx *controller.Context, issuer cmapi.GenericIssuer) (issuer.Interface, error) {
@@ -48,6 +52,7 @@ func NewVenafi(ctx *controller.Context, issuer cmapi.GenericIssuer) (issuer.Inte
resourceNamespace: ctx.IssuerOptions.ResourceNamespace(issuer),
clientBuilder: client.New,
Context: ctx,
log: logf.Log.WithName("venafi"),
}, nil
}
pkg/logs/logs.go
-1
View File
@@ -40,7 +40,6 @@ var (
WarnLevel = 1
InfoLevel = 2
DebugLevel = 3
// and the mysterious 4
)
var logFlushFreq = flag.Duration("log-flush-frequency", 5*time.Second, "Maximum number of seconds between log flushes")
pkg/metrics/metrics.go
+6 -4
View File
@@ -29,6 +29,8 @@ import (
"net/http"
"time"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/go-logr/logr"
"github.com/gorilla/mux"
"github.com/prometheus/client_golang/prometheus"
@@ -157,7 +159,7 @@ func (m *Metrics) Start(listenAddress string) (*http.Server, error) {
go func() {
log := m.log.WithValues("address", ln.Addr())
log.Info("listening for connections on")
log.V(logf.InfoLevel).Info("listening for connections on")
if err := server.Serve(ln); err != nil {
log.Error(err, "error running prometheus metrics server")
@@ -174,15 +176,15 @@ func (m *Metrics) IncrementSyncCallCount(controllerName string) {
}
func (m *Metrics) Shutdown(server *http.Server) {
m.log.Info("stopping Prometheus metrics server...")
m.log.V(logf.InfoLevel).Info("stopping Prometheus metrics server...")
ctx, cancel := context.WithTimeout(context.Background(), prometheusMetricsServerShutdownTimeout)
defer cancel()
if err := server.Shutdown(ctx); err != nil {
m.log.Error(err, "prometheus metrics server shutdown failed", err)
m.log.V(logf.ErrorLevel).Error(err, "prometheus metrics server shutdown failed", err)
return
}
m.log.Info("prometheus metrics server gracefully stopped")
m.log.V(logf.InfoLevel).Info("prometheus metrics server gracefully stopped")
}
pkg/webhook/authority/BUILD.bazel
+1
View File
@@ -8,6 +8,7 @@ go_library(
deps = [
"//pkg/apis/certmanager/v1alpha2:go_default_library",
"//pkg/internal/apis/meta:go_default_library",
"//pkg/logs:go_default_library",
"//pkg/util/pki:go_default_library",
"@com_github_go_logr_logr//:go_default_library",
"@io_k8s_api//core/v1:go_default_library",
pkg/webhook/authority/authority.go
+11 -9
View File
@@ -29,6 +29,8 @@ import (
"sync"
"time"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/go-logr/logr"
corev1 "k8s.io/api/core/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -245,7 +247,7 @@ func (d *DynamicAuthority) notifyWatches(newCertData, newPrivateKeyData []byte)
return
}
d.Log.Info("Detected change in CA secret data, notifying watchers...")
d.Log.V(logf.DebugLevel).Info("Detected change in CA secret data, notifying watchers...")
d.watchMutex.Lock()
defer d.watchMutex.Unlock()
@@ -274,7 +276,7 @@ func (d *DynamicAuthority) caRequiresRegeneration(s *corev1.Secret) bool {
pkData := s.Data[corev1.TLSPrivateKeyKey]
certData := s.Data[corev1.TLSCertKey]
if len(caData) == 0 || len(pkData) == 0 || len(certData) == 0 {
d.Log.Info("Missing data in CA secret. Regenerating...")
d.Log.V(logf.InfoLevel).Info("Missing data in CA secret. Regenerating...")
return true
}
// ensure that the ca.crt and tls.crt keys are equal
@@ -293,12 +295,12 @@ func (d *DynamicAuthority) caRequiresRegeneration(s *corev1.Secret) bool {
return true
}
if !x509Cert.IsCA {
d.Log.Info("Stored certificate is not marked as a CA. Regenerating...")
d.Log.V(logf.InfoLevel).Info("Stored certificate is not marked as a CA. Regenerating...")
return true
}
// renew the root CA when the current one is 2/3 of the way through its life
if x509Cert.NotAfter.Sub(time.Now()) < (d.CADuration / 3) {
d.Log.Info("Root CA certificate is nearing expiry. Regenerating...")
d.Log.V(logf.InfoLevel).Info("Root CA certificate is nearing expiry. Regenerating...")
return true
}
return false
@@ -310,7 +312,7 @@ var serialNumberLimit = new(big.Int).Lsh(big.NewInt(1), 128)
// If the provided Secret is nil, a new secret resource will be Created.
// Otherwise, the provided resource will be modified and Updated.
func (d *DynamicAuthority) regenerateCA(ctx context.Context, s *corev1.Secret) error {
d.Log.Info("Generating new root CA")
d.Log.V(logf.DebugLevel).Info("Generating new root CA")
pk, err := pki.GenerateECPrivateKey(384)
if err != nil {
return err
@@ -374,27 +376,27 @@ func (d *DynamicAuthority) regenerateCA(ctx context.Context, s *corev1.Secret) e
if _, err := d.client.Update(ctx, s, metav1.UpdateOptions{}); err != nil {
return err
}
d.Log.Info("Generated new root CA")
d.Log.V(logf.DebugLevel).Info("Generated new root CA")
return nil
}
func (d *DynamicAuthority) handleAdd(obj interface{}) {
ctx := context.Background()
if err := d.ensureCA(ctx); err != nil {
d.Log.Error(err, "error ensuring CA")
d.Log.V(logf.ErrorLevel).Error(err, "error ensuring CA")
}
}
func (d *DynamicAuthority) handleUpdate(_, obj interface{}) {
ctx := context.Background()
if err := d.ensureCA(ctx); err != nil {
d.Log.Error(err, "error ensuring CA")
d.Log.V(logf.ErrorLevel).Error(err, "error ensuring CA")
}
}
func (d *DynamicAuthority) handleDelete(obj interface{}) {
ctx := context.Background()
if err := d.ensureCA(ctx); err != nil {
d.Log.Error(err, "error ensuring CA")
d.Log.V(logf.ErrorLevel).Error(err, "error ensuring CA")
}
}
pkg/webhook/handlers/BUILD.bazel
+1
View File
@@ -37,6 +37,7 @@ go_test(
embed = [":go_default_library"],
deps = [
"//pkg/internal/api/validation:go_default_library",
"//pkg/logs:go_default_library",
"//pkg/webhook/handlers/testdata/apis/testgroup:go_default_library",
"//pkg/webhook/handlers/testdata/apis/testgroup/install:go_default_library",
"//pkg/webhook/handlers/testdata/apis/testgroup/v1:go_default_library",
pkg/webhook/handlers/validation_test.go
+4 -4
View File
@@ -25,12 +25,12 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/types"
"k8s.io/klog/klogr"
"github.com/jetstack/cert-manager/pkg/internal/api/validation"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/jetstack/cert-manager/pkg/webhook/handlers/testdata/apis/testgroup/install"
"github.com/jetstack/cert-manager/pkg/webhook/handlers/testdata/apis/testgroup/v1"
"github.com/jetstack/cert-manager/pkg/webhook/handlers/testdata/apis/testgroup/v2"
v1 "github.com/jetstack/cert-manager/pkg/webhook/handlers/testdata/apis/testgroup/v1"
v2 "github.com/jetstack/cert-manager/pkg/webhook/handlers/testdata/apis/testgroup/v2"
)
func TestRegistryBackedValidator(t *testing.T) {
@@ -39,7 +39,7 @@ func TestRegistryBackedValidator(t *testing.T) {
install.Install(scheme)
install.InstallValidations(registry)
log := klogr.New()
log := logf.Log
c := NewRegistryBackedValidator(log, scheme, registry)
testTypeGVK := &metav1.GroupVersionKind{
Group: v1.SchemeGroupVersion.Group,
pkg/webhook/server/BUILD.bazel
+1
View File
@@ -6,6 +6,7 @@ go_library(
importpath = "github.com/jetstack/cert-manager/pkg/webhook/server",
visibility = ["//visibility:public"],
deps = [
"//pkg/logs:go_default_library",
"//pkg/util/profiling:go_default_library",
"//pkg/webhook/handlers:go_default_library",
"//pkg/webhook/server/tls:go_default_library",
pkg/webhook/server/server.go
+10 -8
View File
@@ -26,6 +26,8 @@ import (
"net/http"
"time"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/go-logr/logr"
admissionv1beta1 "k8s.io/api/admission/v1beta1"
apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
@@ -136,7 +138,7 @@ func (s *Server) Run(stopCh <-chan struct{}) error {
mux := http.NewServeMux()
mux.HandleFunc("/healthz", s.handleHealthz)
mux.HandleFunc("/livez", s.handleLivez)
s.Log.Info("listening for insecure healthz connections", "address", s.HealthzAddr)
s.Log.V(logf.InfoLevel).Info("listening for insecure healthz connections", "address", s.HealthzAddr)
healthzChan = s.startServer(l, internalStopCh, mux)
}
@@ -149,7 +151,7 @@ func (s *Server) Run(stopCh <-chan struct{}) error {
// wrap the listener with TLS if a CertificateSource is provided
if s.CertificateSource != nil {
s.Log.Info("listening for secure connections", "address", s.ListenAddr)
s.Log.V(logf.InfoLevel).Info("listening for secure connections", "address", s.ListenAddr)
certSourceChan = s.startCertificateSource(internalStopCh)
cipherSuites, err := ciphers.TLSCipherSuites(s.CipherSuites)
if err != nil {
@@ -166,7 +168,7 @@ func (s *Server) Run(stopCh <-chan struct{}) error {
PreferServerCipherSuites: true,
})
} else {
s.Log.Info("listening for insecure connections", "address", s.ListenAddr)
s.Log.V(logf.InfoLevel).Info("listening for insecure connections", "address", s.ListenAddr)
}
mux := http.NewServeMux()
@@ -175,7 +177,7 @@ func (s *Server) Run(stopCh <-chan struct{}) error {
mux.HandleFunc("/convert", s.handle(s.convert))
if s.EnablePprof {
profiling.Install(mux)
s.Log.Info("registered pprof handlers")
s.Log.V(logf.InfoLevel).Info("registered pprof handlers")
}
listenerChan := s.startServer(l, internalStopCh, mux)
@@ -196,9 +198,9 @@ func (s *Server) Run(stopCh <-chan struct{}) error {
close(internalStopCh)
shutdown = true
s.Log.Info("waiting for server to shutdown")
s.Log.V(logf.DebugLevel).Info("waiting for server to shutdown")
waitForAll(healthzChan, certSourceChan, listenerChan)
s.Log.Info("server shutdown successfully")
s.Log.V(logf.InfoLevel).Info("server shutdown successfully")
return err
}
@@ -234,7 +236,7 @@ func (s *Server) startServer(l net.Listener, stopCh <-chan struct{}, handle http
s.Log.Error(err, "failed to gracefully shutdown http server")
ch <- err
}
s.Log.Info("shutdown HTTP server gracefully")
s.Log.V(logf.DebugLevel).Info("shutdown HTTP server gracefully")
}
}()
return ch
@@ -339,7 +341,7 @@ func (s *Server) handleHealthz(w http.ResponseWriter, req *http.Request) {
defer req.Body.Close()
if s.CertificateSource != nil && !s.CertificateSource.Healthy() {
s.Log.Info("Health check failed as CertificateSource is unhealthy")
s.Log.V(logf.WarnLevel).Info("Health check failed as CertificateSource is unhealthy")
w.WriteHeader(http.StatusInternalServerError)
return
}
pkg/webhook/server/tls/dynamic_source.go
+8 -6
View File
@@ -24,6 +24,8 @@ import (
"sync"
"time"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/go-logr/logr"
"k8s.io/apimachinery/pkg/util/wait"
crlog "sigs.k8s.io/controller-runtime/pkg/log"
@@ -130,7 +132,7 @@ func (f *DynamicSource) Run(stopCh <-chan struct{}) error {
if !ok {
return true, fmt.Errorf("channel closed")
}
f.Log.Info("Detected root CA rotation - regenerating serving certificates")
f.Log.V(logf.InfoLevel).Info("Detected root CA rotation - regenerating serving certificates")
if err := f.regenerateCertificate(); err != nil {
f.Log.Error(err, "Failed to regenerate serving certificate")
// Return an error here and stop the source running - this case should never
@@ -139,7 +141,7 @@ func (f *DynamicSource) Run(stopCh <-chan struct{}) error {
}
// trigger regeneration if a renewal is required
case <-renewalChan:
f.Log.Info("Serving certificate requires renewal, regenerating")
f.Log.V(logf.InfoLevel).Info("Serving certificate requires renewal, regenerating")
if err := f.regenerateCertificate(); err != nil {
f.Log.Error(err, "Failed to regenerate serving certificate")
// Return an error here and stop the source running - this case should never
@@ -167,7 +169,7 @@ func (f *DynamicSource) Healthy() bool {
// regenerateCertificate will trigger the cached certificate and private key to
// be regenerated by requesting a new certificate from the authority.
func (f *DynamicSource) regenerateCertificate() error {
f.Log.Info("Generating new ECDSA private key")
f.Log.V(logf.DebugLevel).Info("Generating new ECDSA private key")
pk, err := pki.GenerateECPrivateKey(384)
if err != nil {
return err
@@ -182,19 +184,19 @@ func (f *DynamicSource) regenerateCertificate() error {
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
}
f.Log.Info("Signing new serving certificate")
f.Log.V(logf.DebugLevel).Info("Signing new serving certificate")
cert, err := f.Authority.Sign(template)
if err != nil {
return err
}
f.Log.Info("Signed new serving certificate")
f.Log.V(logf.DebugLevel).Info("Signed new serving certificate")
if err := f.updateCertificate(pk, cert); err != nil {
return err
}
f.Log.Info("Updated serving TLS certificate")
f.Log.V(logf.InfoLevel).Info("Updated serving TLS certificate")
return nil
}
pkg/webhook/server/tls/file_source.go
+1 -1
View File
@@ -141,7 +141,7 @@ func (f *FileCertificateSource) updateCertificateFromDisk() error {
f.Log.V(logf.DebugLevel).Info("key and certificate on disk have not changed")
return nil
}
f.Log.Info("detected private key or certificate data on disk has changed. reloading certificate")
f.Log.V(logf.DebugLevel).Info("detected private key or certificate data on disk has changed. reloading certificate")
cert, err := tls.X509KeyPair(certData, keyData)
if err != nil {
test/acme/dns/server/rfc2136.go
+8 -6
View File
@@ -21,6 +21,8 @@ import (
"sync"
"time"
logf "github.com/jetstack/cert-manager/pkg/logs"
"github.com/go-logr/logr"
"github.com/miekg/dns"
)
@@ -50,7 +52,7 @@ func (b *rfc2136Handler) ServeDNS(w dns.ResponseWriter, req *dns.Msg) {
log = log.WithValues("question", question, "opcode", dns.OpcodeToString[req.Opcode])
zone = b.zoneForFQDN(question)
if zone == "" {
log.Info("failed to lookup zone for fqdn")
log.V(logf.WarnLevel).Info("failed to lookup zone for fqdn")
m.Rcode = dns.RcodeServerFailure
return
}
@@ -58,9 +60,9 @@ func (b *rfc2136Handler) ServeDNS(w dns.ResponseWriter, req *dns.Msg) {
}
if t := req.IsTsig(); t != nil {
log.Info("TSIG requested on DNS request")
log.V(logf.DebugLevel).Info("TSIG requested on DNS request")
if w.TsigStatus() == nil {
log.Info("setting TSIG values on response")
log.V(logf.DebugLevel).Info("setting TSIG values on response")
// Validated
m.SetTsig(b.tsigZone, dns.HmacMD5, 300, time.Now().Unix())
}
@@ -72,12 +74,12 @@ func (b *rfc2136Handler) ServeDNS(w dns.ResponseWriter, req *dns.Msg) {
txt := rr.(*dns.TXT)
log := log.WithValues("value", txt.Hdr.Name, "class", dns.ClassToString[rr.Header().Class], "txt", txt.Txt)
if rr.Header().Class == dns.ClassNONE {
log.Info("deleting txt record value due to NONE class")
log.V(logf.DebugLevel).Info("deleting txt record value due to NONE class")
// TODO: can we only delete the named record here somehow?
delete(b.txtRecords, txt.Hdr.Name)
continue
}
log.Info("setting TXT record value")
log.V(logf.DebugLevel).Info("setting TXT record value")
b.txtRecords[txt.Hdr.Name] = txt.Txt
}
}
@@ -95,7 +97,7 @@ func (b *rfc2136Handler) ServeDNS(w dns.ResponseWriter, req *dns.Msg) {
}
for _, rr := range m.Answer {
log.Info("responding", "response", rr.String())
log.V(logf.DebugLevel).Info("responding", "response", rr.String())
}
}
test/acme/dns/server/server.go
+4 -4
View File
@@ -74,11 +74,11 @@ func (b *BasicServer) RunWithAddress(ctx context.Context, listenAddr string) err
}
b.listenAddr = pc.LocalAddr().String()
log = log.WithValues("address", b.listenAddr)
log.Info("listening on UDP port")
log.V(logf.InfoLevel).Info("listening on UDP port")
b.server = &dns.Server{PacketConn: pc, ReadTimeout: time.Hour, WriteTimeout: time.Hour, MsgAcceptFunc: msgAcceptFunc}
if b.EnableTSIG {
log.Info("enabling TSIG support")
log.V(logf.DebugLevel).Info("enabling TSIG support")
b.server.TsigSecret = map[string]string{b.TSIGKeyName: b.TSIGKeySecret}
}
@@ -97,9 +97,9 @@ func (b *BasicServer) RunWithAddress(ctx context.Context, listenAddr string) err
waitLock.Lock()
b.server.NotifyStartedFunc = waitLock.Unlock
go func() {
log.Info("starting DNS server")
log.V(logf.DebugLevel).Info("starting DNS server")
b.server.ActivateAndServe()
log.Info("DNS server exited")
log.V(logf.DebugLevel).Info("DNS server exited")
pc.Close()
}()
waitLock.Lock()