Monitor EKS Anywhere cluster certificates #9815
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #9815 +/- ##
==========================================
+ Coverage 69.85% 69.90% +0.04%
==========================================
Files 675 676 +1
Lines 50321 50442 +121
==========================================
+ Hits 35152 35260 +108
- Misses 13361 13375 +14
+ Partials 1808 1807 -1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
47083bf to
1d6243a
Compare
pkg/api/v1alpha1/cluster_types.go
Outdated
| // ClusterCertificateInfo contains information about certificate expiration for cluster components. | ||
| type ClusterCertificateInfo struct { | ||
| // Component defines the machine name. | ||
| Component string `json:"component"` |
There was a problem hiding this comment.
Should we call it machine instead of component to make it more specific and less ambiguous in the status?
pkg/certificates/scanner.go
Outdated
| } | ||
| } | ||
|
|
||
| if len(machines) == 0 { |
There was a problem hiding this comment.
When will we hit this condition?
1d6243a to
2a7cc00
Compare
|
/lgtm |
|
/lgtm |
| defer conn.Close() | ||
|
|
||
| certs := conn.ConnectionState().PeerCertificates | ||
| if len(certs) == 0 { |
There was a problem hiding this comment.
When/why would we ever run into this situation?
There was a problem hiding this comment.
I can only think of a scenario when during an upgrade, there might be a brief moment when certificates aren't available yet.
|
/lgtm |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: panktishah26 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/cherry-pick release-0.23 |
|
@panktishah26: new pull request created: #9854 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Description of changes:
Currently if we want to monitor cluster's control plane and external etcd certificates, we follow these steps https://anywhere.eks.amazonaws.com/docs/clustermgmt/certificate-management/manual-steps-renew-certs/
This PR adds a way to monitor cluster certificates from EKS-A cluster object.
The status field will have expiresInDays for each control plane and external etcd machine.
Testing (if applicable):
Documentation added/planned (if applicable):
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.