Skip to content

Fetch Control-Plane and etcd IPs for certificates renewal when API server is reachable #9907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Jul 18, 2025
Merged

Fetch Control-Plane and etcd IPs for certificates renewal when API server is reachable #9907

merged 2 commits into from
Jul 18, 2025

Conversation

howard-junec
Copy link
Contributor

@howard-junec howard-junec commented Jul 16, 2025 •
edited by panktishah26
Loading

Issue #, if available:

Description of changes:
This PR adds the ability to renew certificates by cluster name, discovering control plane and etcd node IPs using kubectl when the Kubernetes API server is reachable. When the API server is unreachable (which can happen during certificate expiration), it gracefully falls back to prompting users to provide node IPs in the configuration file. This improves user experience by reducing manual configuration steps when possible, while maintaining compatibility with scenarios where the API server is unavailable.

Testing (if applicable):

Documentation added/planned (if applicable):

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@eks-distro-bot
Copy link
Collaborator

Hi @howard-junec. Thanks for your PR.

I'm waiting for a aws member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@eks-distro-bot eks-distro-bot added needs-ok-to-test size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 16, 2025
panktishah26
panktishah26 reviewed Jul 16, 2025
View reviewed changes
pkg/certificates/config.go Outdated

etcdIPs, err := getEtcdIPs(ctx, kubeClient, cluster)
if err != nil {
fmt.Printf("Warning: Failed to get etcd IPs: %v\n", err)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please return an error from here.

pkg/certificates/config.go Outdated
}

func getControlPlaneIPs(ctx context.Context, kubeClient kubernetes.Client, cluster *types.Cluster) ([]string, error) {
fmt.Printf("getControlPlaneIPs \n")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we remove this log line?

pkg/certificates/config.go Outdated
}

for _, machine := range machineList.Items {
if machine.Labels["cluster.x-k8s.io/cluster-name"] == cluster.Name {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we use clusterNameLabel and controlPlaneLabel variable for these labels?
Also, Can we pass these labels as a selector when we make kubeClient.List? Same for external etcd.

@howard-junec howard-junec reopened this Jul 18, 2025
@howard-junec howard-junec changed the title renew by clustername Fetch Control-Panel and etcd IPs for certificates renewal when API server is reachable Jul 18, 2025
@howard-junec howard-junec changed the title Fetch Control-Panel and etcd IPs for certificates renewal when API server is reachable Fetch Control-Planel and etcd IPs for certificates renewal when API server is reachable Jul 18, 2025
@howard-junec howard-junec changed the title Fetch Control-Planel and etcd IPs for certificates renewal when API server is reachable Fetch Control-Plane and etcd IPs for certificates renewal when API server is reachable Jul 18, 2025
@panktishah26
Copy link
Member

/lgtm
/approve

@eks-distro-bot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: panktishah26

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@eks-distro-bot eks-distro-bot merged commit 894f50d into aws:main Jul 18, 2025
15 checks passed
@eks-distro-pr-bot
Copy link
Contributor

@panktishah26: #9907 failed to apply on top of branch "release-0.23":

Applying: renew by clustername
Using index info to reconstruct a base tree...
M	cmd/eksctl-anywhere/cmd/renewcertificates.go
M	pkg/certificates/config.go
Falling back to patching base and 3-way merge...
Auto-merging pkg/certificates/config.go
CONFLICT (content): Merge conflict in pkg/certificates/config.go
Auto-merging cmd/eksctl-anywhere/cmd/renewcertificates.go
CONFLICT (content): Merge conflict in cmd/eksctl-anywhere/cmd/renewcertificates.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 renew by clustername
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-0.23

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@panktishah26
Copy link
Member

/cherry-pick release-0.23

@eks-distro-pr-bot
Copy link
Contributor

@panktishah26: new pull request created: #9963

In response to this:

/cherry-pick release-0.23

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@eks-distro-pr-bot eks-distro-pr-bot mentioned this pull request Jul 29, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@panktishah26 panktishah26 panktishah26 left review comments

Assignees

@panktishah26 panktishah26

Labels
approved lgtm needs-ok-to-test size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@howard-junec @eks-distro-bot @panktishah26 @eks-distro-pr-bot