Andrey Smirnov c3b2429ce9

fix: suppress spurious Kubernetes API server cert updates ...

With the last changes, `kube-apiserver` certificates are generated based
on the assigned `NodeAdresses`, machine configuration, etc. Whenver the
certificate is regenerated, `kube-apiserver` is reloaded to pick up the
new cert.

With Virtual IP enabled, Virtual IP address is included into the
certificate from the beginning as it is specified in the machine
configuration, but as virtual IP moves between the nodes this causes
`NodeAddresses` update, which triggers the controller, generates new
certs and reloads `kube-apiserver` at bad time (right after VIP got
moved). Even though the cert generated is identical to the previous one,
the API server reload makes it unavailable for 30-90 seconds.

This change extracts `CertSANs` as a separate resource so that its
updates are suppressed if the CertSANs sources change, but the final
list stays the same, and in turn prevents final certificate from being
updated.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

2021-09-09 00:31:54 +03:00

..

api_test.go

feat: reimplement apid certificate generation on top of COSI

2021-06-23 13:07:00 -07:00

api.go

chore: use vtprotobuf compiled marshaling in Talos API

2021-08-09 08:42:13 -07:00

cert_sans.go

fix: suppress spurious Kubernetes API server cert updates

2021-09-09 00:31:54 +03:00

condition.go

feat: reimplement apid certificate generation on top of COSI

2021-06-23 13:07:00 -07:00

etcd.go

feat: split etcd certificates to peer/client

2021-06-23 13:26:48 -07:00

kubernetes.go

feat: use COSI RD's sensitivity for RBAC

2021-06-21 14:05:06 -07:00

root.go

feat: reimplement apid certificate generation on top of COSI

2021-06-23 13:07:00 -07:00

secrets_test.go

fix: suppress spurious Kubernetes API server cert updates

2021-09-09 00:31:54 +03:00

secrets.go

chore: re-import talos-systems/os-runtime as cosi-project/runtime

2021-04-12 07:44:24 -07:00