Configuration Structure For Certificate Renewal (Part 1 of the certificate renewal command feature) #9780

howard-junec · 2025-06-03T21:48:23Z

Issue #, if available:

Description of changes:
This PR includes add core configuration structures and validation for the certificate renewal command. This includes:

RenewalConfig structure for cluster and node configuration
Config file parsing and validation logic
Basic command framework for certificate renewal

This is part 1 of the certificate renewal feature, focusing on configuration handling. The actual certificate renewal implementation will follow in a separate PR.

The command now supports input config file
Example:

Using config file: eksctl anywhere renew certificates [--config <file-path>] [--component <etcd|control-plane>]:
user can renew certificates by:

eksctl anywhere renew certificates --config config.yaml (renew by the config file)
eksctl anywhere renew certificates --config config.yaml --component etcd (only renew etcd)
eksctl anywhere renew certificates --config config.yaml --component control-plane (only renew control-plane)

Example Config file:

clusterName: my-cluster 
controlPlane: 
  nodes: 
  - 100.000.0.11 
  - 100.000.0.12 
  - 100.000.0.13 
  os: ubuntu # rhel or bottlerocket 
  sshKey: /path/to/ssh/private-key 
  sshUser: ec2-user 
etcd: 
  nodes: 
  - 100.000.0.14 
  - 100.000.0.15 
  - 100.000.0.16 
  os: ubuntu # rhels or bottlerocket 
  sshKey: /path/to/ssh/private-key 
  sshUser: ec2-user

Testing (if applicable):

Documentation added/planned (if applicable):

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

…wal command

eks-distro-bot · 2025-06-03T21:48:35Z

Hi @howard-junec. Thanks for your PR.

I'm waiting for a aws member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

panktishah26

Thank you for this PR. Great work!!

panktishah26 · 2025-06-05T17:18:53Z

cmd/eksctl-anywhere/cmd/renew.go

+var renewCmd = &cobra.Command{
+	Use:   "renew",
+	Short: "renew resources",
+	Long:  "Use eksctl anywhere renew to renew resources, such as clusters",


Suggested change

Long: "Use eksctl anywhere renew to renew resources, such as clusters",

Long: "Use eksctl anywhere renew to renew cluster resources",

panktishah26 · 2025-06-05T17:24:11Z

cmd/eksctl-anywhere/cmd/renewcertificates.go

+var renewCertificatesCmd = &cobra.Command{
+	Use:   "certificates",
+	Short: "Renew certificates for cluster components",
+	Long: `Renew certificates for etcd and control plane nodes in EKS Anywhere cluster.


Let's not add these details in the command description. We should add it in our docs.

Suggested change

Long: `Renew certificates for etcd and control plane nodes in EKS Anywhere cluster.

Long: `Renew external ETCD and control plane certificates.

panktishah26 · 2025-06-05T17:24:36Z

cmd/eksctl-anywhere/cmd/renewcertificates.go

+
+var renewCertificatesCmd = &cobra.Command{
+	Use:   "certificates",
+	Short: "Renew certificates for cluster components",


Suggested change

Short: "Renew certificates for cluster components",

Short: "Renew certificates",

panktishah26 · 2025-06-05T17:29:47Z

cmd/eksctl-anywhere/cmd/renewcertificates.go

+	renewCmd.AddCommand(renewCertificatesCmd)
+
+	renewCertificatesCmd.Flags().StringVarP(&rc.configFile, "config", "f", "", "Config file containing node and SSH information")
+	renewCertificatesCmd.Flags().StringVarP(&rc.clusterName, "cluster-name", "n", "", "Name of the cluster to renew certificates for")


For now, can we focus on a scenario where certificates are already expired? The reason is we would have to take ssh-key for control plane and external etcd both. In this case, I would want to see if we can use the same config file as an input to avoid confusion.

panktishah26 · 2025-06-05T17:30:32Z

cmd/eksctl-anywhere/cmd/renewcertificates.go

+	renewCertificatesCmd.Flags().StringVarP(&rc.configFile, "config", "f", "", "Config file containing node and SSH information")
+	renewCertificatesCmd.Flags().StringVarP(&rc.clusterName, "cluster-name", "n", "", "Name of the cluster to renew certificates for")
+	renewCertificatesCmd.Flags().StringVarP(&rc.component, "component", "c", "", "Component to renew certificates for (etcd or control-plane). If not specified, renews both.")
+	renewCertificatesCmd.Flags().StringVar(&rc.sshKey, "ssh-key", "", "SSH private key file (required when using --cluster-name)")


Can we remove this to focus on already expired certificates?

For renewing already expired certificates, do we still want to keep the --component flag, or should we just rely on the config file approach and remove the options for --component etcd and --component control-plane.

let's have component flag.

panktishah26 · 2025-06-05T17:56:46Z

cmd/eksctl-anywhere/cmd/renewcertificates.go

+	return nil
+}
+
+func (rc *renewCertificatesOptions) renewCertificates(cmd *cobra.Command) error {


We would have to change below validations based on taking just a config file as an input.

panktishah26 · 2025-06-05T18:20:21Z

cmd/eksctl-anywhere/cmd/renewcertificates.go

+		cluster.Name = config.ClusterName
+	}
+
+	renewer, err := certificates.NewRenewer()


since these are in a different PR, can we return nil for the scope of this PR?

panktishah26 · 2025-06-05T18:47:38Z

pkg/certificates/config.go

+	}
+
+	if err := validateNodeConfig(&config.ControlPlane, "control plane"); err != nil {
+		return err


Suggested change

return err

return fmt.Errorf("validating control plane %v, err")

panktishah26 · 2025-06-05T18:48:33Z

pkg/certificates/config.go

+		return fmt.Errorf("at least one control plane node is required")
+	}
+
+	if err := validateNodeConfig(&config.ControlPlane, "control plane"); err != nil {


Let's not pass "control plane" or "etcd" as another param for error message. We can do something like below.

panktishah26 · 2025-06-05T18:58:23Z

pkg/certificates/cluster_config.go

let's have this file when we add feature for valid certificates.

panktishah26 · 2025-06-05T22:02:44Z

cmd/eksctl-anywhere/cmd/renewcertificates.go

+
+	config, err := certificates.ParseConfig(rc.configFile)
+	if err != nil {
+		return fmt.Errorf("failed to parse config file: %v", err)


Suggested change

return fmt.Errorf("failed to parse config file: %v", err)

return fmt.Errorf("parsing config file: %v", err)

panktishah26 · 2025-06-05T22:50:16Z

/lgtm

2ez4szliu · 2025-06-06T01:08:46Z

pkg/certificates/config.go

+	if config.OS == "" {
+		return fmt.Errorf("OS is required")
+	}
+	if config.OS != "ubuntu" && config.OS != "rhel" && config.OS != "redhat" && config.OS != "bottlerocket" {


Not sure if we need "rhel", and can we use the OSFamily variables in our code
https://github.com/aws/eks-anywhere/blob/main/pkg/api/v1alpha1/machine_types.go#L8

Yes, I delete the "rhel", and use the OSFamily variables.

2ez4szliu · 2025-06-06T01:21:29Z

pkg/certificates/config.go

+	}
+
+	if _, err := os.Stat(config.SSHKey); err != nil {
+		return fmt.Errorf("SSH key file: %v", err)


Suggested change

return fmt.Errorf("SSH key file: %v", err)

return fmt.Errorf("retrieving SSH key file information: %v", err)

2ez4szliu · 2025-06-06T01:28:15Z

cmd/eksctl-anywhere/cmd/renewcertificates.go

+	renewCmd.AddCommand(renewCertificatesCmd)
+	renewCertificatesCmd.Flags().StringVarP(&rc.configFile, "config", "f", "", "Config file containing node and SSH information")
+	renewCertificatesCmd.Flags().StringVarP(&rc.component, "component", "c", "", "Component to renew certificates for (etcd or control-plane). If not specified, renews both.")
+}


Suggested change

}

if err := renewCertificatesCmd.MarkFlagRequired("config"); err != nil {

log.Fatalf("marking config as required: %s", err)

}

}

so that we don't need to manually check if config is empty

2ez4szliu · 2025-06-06T01:29:05Z

cmd/eksctl-anywhere/cmd/renewcertificates.go

+		return err
+	}
+
+	if rc.configFile == "" {


can be removed after we mark "config" as required

2ez4szliu · 2025-06-06T17:07:50Z

/lgtm

2ez4szliu · 2025-06-06T17:08:56Z

/ok-to-test

eks-distro-bot · 2025-06-06T17:37:18Z

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

codecov · 2025-06-06T17:41:59Z

Codecov Report

Attention: Patch coverage is 8.10811% with 68 lines in your changes missing coverage. Please review.

Project coverage is 69.76%. Comparing base (75d66e7) to head (c4233de).
Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/certificates/config.go	0.00%	48 Missing ⚠️
cmd/eksctl-anywhere/cmd/renewcertificates.go	16.66%	19 Missing and 1 partial ⚠️

❌ Your patch status has failed because the patch coverage (8.10%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9780      +/-   ##
==========================================
- Coverage   69.85%   69.76%   -0.10%     
==========================================
  Files         672      675       +3     
  Lines       50165    50239      +74     
==========================================
+ Hits        35045    35051       +6     
- Misses      13329    13396      +67     
- Partials     1791     1792       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

core configuration structures and validation for the certificate rene…

aed3dbc

…wal command

eks-distro-bot added needs-ok-to-test size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 3, 2025

update cluster_config to support ubuntu renew by cluster name

7f3bd53

howard-junec force-pushed the valid-config branch from 4fa0f09 to 7f3bd53 Compare June 4, 2025 21:18

add support for rhel config

37fecd7

eks-distro-bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 5, 2025

panktishah26 reviewed Jun 5, 2025

View reviewed changes

Simplify certificate renewal to use config file approach

972a469

eks-distro-bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jun 5, 2025

panktishah26 reviewed Jun 5, 2025

View reviewed changes

howard-junec added 2 commits June 5, 2025 15:25

return nil for the scope of this PR 1, renew logics are in different PR

6dee7cc

changes to certificates.ParseConfg

dd21f04

eks-distro-bot assigned panktishah26 Jun 5, 2025

eks-distro-bot added the lgtm label Jun 5, 2025

2ez4szliu reviewed Jun 6, 2025

View reviewed changes

use OSFamily variabl,remove config file empty check

c4233de

eks-distro-bot removed the lgtm label Jun 6, 2025

eks-distro-bot assigned 2ez4szliu Jun 6, 2025

eks-distro-bot added the lgtm label Jun 6, 2025

eks-distro-bot added the ok-to-test label Jun 6, 2025

eks-distro-bot removed the needs-ok-to-test label Jun 6, 2025

panktishah26 added the approved label Jun 6, 2025

eks-distro-bot merged commit 0fd1e05 into aws:main Jun 6, 2025
9 of 10 checks passed

	Long: "Use eksctl anywhere renew to renew resources, such as clusters",
	Long: "Use eksctl anywhere renew to renew cluster resources",

	Long: `Renew certificates for etcd and control plane nodes in EKS Anywhere cluster.
	Long: `Renew external ETCD and control plane certificates.

	Short: "Renew certificates for cluster components",
	Short: "Renew certificates",

	return err
	return fmt.Errorf("validating control plane %v, err")

	return fmt.Errorf("failed to parse config file: %v", err)
	return fmt.Errorf("parsing config file: %v", err)

	return fmt.Errorf("SSH key file: %v", err)
	return fmt.Errorf("retrieving SSH key file information: %v", err)

-}
+      if err := renewCertificatesCmd.MarkFlagRequired("config"); err != nil {
+		log.Fatalf("marking config as required: %s", err)
+	}
+}

Configuration Structure For Certificate Renewal (Part 1 of the certificate renewal command feature) #9780

Configuration Structure For Certificate Renewal (Part 1 of the certificate renewal command feature) #9780

Uh oh!

Conversation

howard-junec commented Jun 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eks-distro-bot commented Jun 3, 2025

Uh oh!

panktishah26 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

panktishah26 commented Jun 5, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

2ez4szliu Jun 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

2ez4szliu commented Jun 6, 2025

Uh oh!

2ez4szliu commented Jun 6, 2025

Uh oh!

eks-distro-bot commented Jun 6, 2025

Uh oh!

Uh oh!

codecov bot commented Jun 6, 2025

Codecov Report

Uh oh!

Uh oh!

howard-junec commented Jun 3, 2025 •

edited

Loading

2ez4szliu Jun 6, 2025 •

edited

Loading