[Feature] TLS Rotation on ALT Names change (#810)

Author: ajanikow

CHANGELOG.md

@@ -8,6 +8,7 @@
 - Add Topology support
 - Add ARANGODB_ZONE env to Topology Managed pods
 - Add "Random pod names" feature
+- Rotate TLS Secrets on ALT Names change
 
 ## [1.2.3](https://github.com/arangodb/kube-arangodb/tree/1.2.3) (2021-09-24)
 - Update UBI Image to 8.4

pkg/apis/deployment/v1/deployment_member_status_element.go

@@ -0,0 +1,57 @@
+//
+// DISCLAIMER
+//
+// Copyright 2020 ArangoDB GmbH, Cologne, Germany
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Copyright holder is ArangoDB GmbH, Cologne, Germany
+//
+
+package v1
+
+type DeploymentStatusMemberElements []DeploymentStatusMemberElement
+
+// DeploymentStatusMemberElement holds one specific element with group and member status
+type DeploymentStatusMemberElement struct {
+	Group  ServerGroup  `json:"group,omitempty"`
+	Member MemberStatus `json:"member,omitempty"`
+}
+
+func (ds DeploymentStatusMembers) AsList() DeploymentStatusMemberElements {
+	return ds.AsListInGroups(AllServerGroups...)
+}
+
+func (ds DeploymentStatusMembers) AsListInGroups(groups ...ServerGroup) DeploymentStatusMemberElements {
+	var elements []DeploymentStatusMemberElement
+
+	// Always return nil, so no error handling
+	for _, g := range groups {
+		elements = append(elements, ds.AsListInGroup(g)...)
+	}
+
+	return elements
+}
+
+func (ds DeploymentStatusMembers) AsListInGroup(group ServerGroup) DeploymentStatusMemberElements {
+	var r DeploymentStatusMemberElements
+
+	for _, m := range ds.MembersOfGroup(group) {
+		r = append(r, DeploymentStatusMemberElement{
+			Group:  group,
+			Member: m,
+		})
+	}
+
+	return r
+}

pkg/apis/deployment/v1/zz_generated.deepcopy.go

@@ -0,0 +1,57 @@
+//
+// DISCLAIMER
+//
+// Copyright 2020 ArangoDB GmbH, Cologne, Germany
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Copyright holder is ArangoDB GmbH, Cologne, Germany
+//
+
+package v2alpha1
+
+type DeploymentStatusMemberElements []DeploymentStatusMemberElement
+
+// DeploymentStatusMemberElement holds one specific element with group and member status
+type DeploymentStatusMemberElement struct {
+	Group  ServerGroup  `json:"group,omitempty"`
+	Member MemberStatus `json:"member,omitempty"`
+}
+
+func (ds DeploymentStatusMembers) AsList() DeploymentStatusMemberElements {
+	return ds.AsListInGroups(AllServerGroups...)
+}
+
+func (ds DeploymentStatusMembers) AsListInGroups(groups ...ServerGroup) DeploymentStatusMemberElements {
+	var elements []DeploymentStatusMemberElement
+
+	// Always return nil, so no error handling
+	for _, g := range groups {
+		elements = append(elements, ds.AsListInGroup(g)...)
+	}
+
+	return elements
+}
+
+func (ds DeploymentStatusMembers) AsListInGroup(group ServerGroup) DeploymentStatusMemberElements {
+	var r DeploymentStatusMemberElements
+
+	for _, m := range ds.MembersOfGroup(group) {
+		r = append(r, DeploymentStatusMemberElement{
+			Group:  group,
+			Member: m,
+		})
+	}
+
+	return r
+}

pkg/apis/deployment/v2alpha1/deployment_member_status_element.go

@@ -38,18 +38,17 @@ import (
 // removePodFinalizers removes all finalizers from all pods owned by us.
 func (d *Deployment) removePodFinalizers(ctx context.Context, cachedStatus inspectorInterface.Inspector) error {
 	log := d.deps.Log
-	kubecli := d.GetKubeCli()
 
 	if err := cachedStatus.IteratePods(func(pod *core.Pod) error {
-		if err := k8sutil.RemovePodFinalizers(ctx, log, kubecli, pod, pod.GetFinalizers(), true); err != nil {
+		if err := k8sutil.RemovePodFinalizers(ctx, cachedStatus, log, d.PodsModInterface(), pod, pod.GetFinalizers(), true); err != nil {
 			log.Warn().Err(err).Msg("Failed to remove pod finalizers")
 			return err
 		}
 
 		ctxChild, cancel := context.WithTimeout(ctx, k8sutil.GetRequestTimeout())
 		defer cancel()
 
-		if err := kubecli.CoreV1().Pods(pod.GetNamespace()).Delete(ctxChild, pod.GetName(), meta.DeleteOptions{
+		if err := d.PodsModInterface().Delete(ctxChild, pod.GetName(), meta.DeleteOptions{
 			GracePeriodSeconds: util.NewInt64(1),
 		}); err != nil {
 			if !k8sutil.IsNotFound(err) {
@@ -68,10 +67,9 @@ func (d *Deployment) removePodFinalizers(ctx context.Context, cachedStatus inspe
 // removePVCFinalizers removes all finalizers from all PVCs owned by us.
 func (d *Deployment) removePVCFinalizers(ctx context.Context, cachedStatus inspectorInterface.Inspector) error {
 	log := d.deps.Log
-	kubecli := d.GetKubeCli()
 
 	if err := cachedStatus.IteratePersistentVolumeClaims(func(pvc *core.PersistentVolumeClaim) error {
-		if err := k8sutil.RemovePVCFinalizers(ctx, log, kubecli, pvc, pvc.GetFinalizers(), true); err != nil {
+		if err := k8sutil.RemovePVCFinalizers(ctx, cachedStatus, log, d.PersistentVolumeClaimsModInterface(), pvc, pvc.GetFinalizers(), true); err != nil {
 			log.Warn().Err(err).Msg("Failed to remove PVC finalizers")
 			return err
 		}