[Backport/v1.28] identity: reload CA root cert channel on file change#1801
Draft
jlojosnegros wants to merge 2 commits intoistio:release-1.28from
Draft
[Backport/v1.28] identity: reload CA root cert channel on file change#1801jlojosnegros wants to merge 2 commits intoistio:release-1.28from
jlojosnegros wants to merge 2 commits intoistio:release-1.28from
Conversation
Introduce RootCertManager (analogous to CrlManager) to watch the CA root cert file for changes using a notify debouncer. When the file changes, a dirty flag (AtomicBool) is set. On the next call to CaClient::fetch_certificate(), the flag is checked and, if set, the TLS gRPC channel is rebuilt using the updated cert before sending the CSR request. If the rebuild fails, the flag is rearmed and the existing channel is reused, so cert renewal continues working despite a transient error. The gRPC channel is now wrapped in a RwLock inside CaClient to allow lazy replacement without blocking concurrent reads. CaClient::new() now accepts a RootCert directly instead of a pre-built cert provider, so it can start the file watcher and retain the data needed to rebuild the channel later. Signed-off-by: Jose Luis Ojosnegros Manchón <jojosneg@redhat.com>
Add notify and notify-debouncer-full needed to watch the CA root file parent folder and hot reload the cert. Add tempfile dependency needed for testing purposes NOTE: Used the versions in main for the three dependencies even if there are newer ones Signed-off-by: Jose Luis Ojosnegros Manchón <jojosneg@redhat.com>
Contributor
|
Skipping CI for Draft Pull Request. |
istio-testing
added
do-not-merge/work-in-progress
|
Hey @jlojosnegros, the backports are automatically created from PR on the master branch by using the label |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #1775 to release-1.28
Everything is almost directly backported.
Note: some dependencies added.