Skip to content

Commit 350c507

Browse files
hdurand0710oktalz
hdurand0710
authored and
oktalz
committed
MEDIUM: delete certificates through runtime
Creation of certificates through runtime is already done. Adding now the deletion though runtime
1 parent fae6192 commit 350c507

14 files changed

+73
-20
lines changed

‎crs/api/ingress/v1/backend.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ import (
2222

2323
// +genclient
2424
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
25-
// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.15-0.20241106115115-75c12953fe1f"
25+
// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.16-0.20250120132445-428abe2a833d"
2626

2727
// Backend is a specification for a Backend resource
2828
type Backend struct {

‎crs/api/ingress/v1/defaults.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ import (
2222

2323
// +genclient
2424
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
25-
// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.15-0.20241106115115-75c12953fe1f"
25+
// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.16-0.20250120132445-428abe2a833d"
2626

2727
// Defaults is a specification for a Defaults resource
2828
type Defaults struct {

‎crs/api/ingress/v1/global.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ import (
2222

2323
// +genclient
2424
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
25-
// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.15-0.20241106115115-75c12953fe1f"
25+
// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.16-0.20250120132445-428abe2a833d"
2626
// +kubebuilder:validation:XValidation:rule="!has(self.spec.config.default_path)", message="spec.config.default_path is set by ingress controller internally"
2727
// +kubebuilder:validation:XValidation:rule="!has(self.spec.config.master__dash__worker)", message="spec.config.master-worker is set by ingress controller internally"
2828
// +kubebuilder:validation:XValidation:rule="!has(self.spec.config.pidfile)", message="spec.config.pidfile is set by ingress controller internally"

‎crs/api/ingress/v1/tcp.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ import (
2323

2424
// +genclient
2525
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
26-
// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.15-0.20241106115115-75c12953fe1f"
26+
// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.16-0.20250120132445-428abe2a833d"
2727

2828
// TCP is a specification for a TCP resource
2929
type TCP struct {

‎crs/definition/ingress.v1.haproxy.org_backends.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
44
metadata:
55
annotations:
66
controller-gen.kubebuilder.io/version: v0.17.0
7-
haproxy.org/client-native: v5.1.15-0.20241106115115-75c12953fe1f
7+
haproxy.org/client-native: v5.1.16-0.20250120132445-428abe2a833d
88
name: backends.ingress.v1.haproxy.org
99
spec:
1010
group: ingress.v1.haproxy.org

‎crs/definition/ingress.v1.haproxy.org_defaults.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
44
metadata:
55
annotations:
66
controller-gen.kubebuilder.io/version: v0.17.0
7-
haproxy.org/client-native: v5.1.15-0.20241106115115-75c12953fe1f
7+
haproxy.org/client-native: v5.1.16-0.20250120132445-428abe2a833d
88
name: defaults.ingress.v1.haproxy.org
99
spec:
1010
group: ingress.v1.haproxy.org

‎crs/definition/ingress.v1.haproxy.org_globals.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
44
metadata:
55
annotations:
66
controller-gen.kubebuilder.io/version: v0.17.0
7-
haproxy.org/client-native: v5.1.15-0.20241106115115-75c12953fe1f
7+
haproxy.org/client-native: v5.1.16-0.20250120132445-428abe2a833d
88
name: globals.ingress.v1.haproxy.org
99
spec:
1010
group: ingress.v1.haproxy.org

‎crs/definition/ingress.v1.haproxy.org_tcps.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
44
metadata:
55
annotations:
66
controller-gen.kubebuilder.io/version: v0.17.0
7-
haproxy.org/client-native: v5.1.15-0.20241106115115-75c12953fe1f
7+
haproxy.org/client-native: v5.1.16-0.20250120132445-428abe2a833d
88
name: tcps.ingress.v1.haproxy.org
99
spec:
1010
group: ingress.v1.haproxy.org

‎go.mod

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ require (
1010
github.com/google/go-cmp v0.6.0
1111
github.com/google/renameio v1.0.1
1212
github.com/haproxytech/client-native/v3 v3.1.2-0.20230607075433-231591da68ed
13-
github.com/haproxytech/client-native/v5 v5.1.15-0.20241106115115-75c12953fe1f
13+
github.com/haproxytech/client-native/v5 v5.1.16-0.20250120132445-428abe2a833d
1414
github.com/jessevdk/go-flags v1.4.0
1515
github.com/pires/go-proxyproto v0.8.0
1616
github.com/prometheus/client_golang v1.20.5
@@ -78,6 +78,7 @@ require (
7878
golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 // indirect
7979
golang.org/x/net v0.34.0 // indirect
8080
golang.org/x/oauth2 v0.25.0 // indirect
81+
golang.org/x/sync v0.10.0 // indirect
8182
golang.org/x/sys v0.29.0 // indirect
8283
golang.org/x/term v0.28.0 // indirect
8384
golang.org/x/text v0.21.0 // indirect

‎go.sum

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
7272
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
7373
github.com/haproxytech/client-native/v3 v3.1.2-0.20230607075433-231591da68ed h1:qjKxpoe4wYQmpGrrooqau88Fgusy9VQfulpXghBDqx8=
7474
github.com/haproxytech/client-native/v3 v3.1.2-0.20230607075433-231591da68ed/go.mod h1:xRVluo27FAjK4ag33+jUfpnNf9olXQlTRHUl3VMvq98=
75-
github.com/haproxytech/client-native/v5 v5.1.15-0.20241106115115-75c12953fe1f h1:v0eQBUs3g70gPHWpP4xBb7wP1qLSs3OCFdDTP/vGbww=
76-
github.com/haproxytech/client-native/v5 v5.1.15-0.20241106115115-75c12953fe1f/go.mod h1:dhwpFkOsWxJRtwNs+LTJtsUTf9pX3uWHKKip9loIK3c=
75+
github.com/haproxytech/client-native/v5 v5.1.16-0.20250120132445-428abe2a833d h1:CSIkA9flJLOYabKfDR7DUJ8qL+SkWh1rqXXjBqctWn4=
76+
github.com/haproxytech/client-native/v5 v5.1.16-0.20250120132445-428abe2a833d/go.mod h1:/ms7QkqUYwCBm31zYl/qT/0r/TBDRt60pusERVZ2j0Q=
7777
github.com/haproxytech/go-logger v1.1.0 h1:HgGtYaI1ApkvbQdsm7f9AzQQoxTB7w37criTflh7IQE=
7878
github.com/haproxytech/go-logger v1.1.0/go.mod h1:OekUd8HCb7ubxMplzHUPBTHNxZmddOWfOjWclZsqIeM=
7979
github.com/jessevdk/go-flags v1.4.0 h1:4IU2WS7AumrZ/40jfhf4QVDMsQwqA7VEHozFRrGARJA=
@@ -178,6 +178,8 @@ golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbht
178178
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
179179
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
180180
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
181+
golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
182+
golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
181183
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
182184
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
183185
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

‎pkg/handler/refresh.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ func (handler Refresh) Update(k store.K8s, h haproxy.HAProxy, a annotations.Anno
3232
}
3333
// Certs
3434
if cleanCrts {
35-
h.RefreshCerts()
35+
h.RefreshCerts(h.HAProxyClient)
3636
}
3737
// Rules
3838
h.RefreshRules(h.HAProxyClient)

‎pkg/haproxy/api/api.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,11 +102,17 @@ type HAProxyClient interface { //nolint:interfacebloat
102102
UserListDeleteAll() error
103103
UserListExistsByGroup(group string) (bool, error)
104104
UserListCreateByGroup(group string, userPasswordMap map[string][]byte) error
105+
Cert
106+
}
107+
108+
type Cert interface {
105109
CertEntryCreate(filename string) error
106110
CertEntrySet(filename string, payload []byte) error
107111
CertEntryCommit(filename string) error
108112
CertEntryAbort(filename string) error
109113
CrtListEntryAdd(crtList string, entry runtime.CrtListEntry) error
114+
CrtListEntryDelete(crtList, filename string, linenumber *int64) error
115+
CertEntryDelete(filename string) error
110116
}
111117

112118
type clientNative struct {

‎pkg/haproxy/api/runtime.go

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,3 +273,19 @@ func (c *clientNative) CrtListEntryAdd(crtList string, entry runtime.CrtListEntr
273273
}
274274
return runtime.AddCrtListEntry(crtList, entry)
275275
}
276+
277+
func (c *clientNative) CrtListEntryDelete(crtList, filename string, linenumber *int64) error {
278+
runtime, err := c.nativeAPI.Runtime()
279+
if err != nil {
280+
return err
281+
}
282+
return runtime.DeleteCrtListEntry(crtList, filename, nil)
283+
}
284+
285+
func (c *clientNative) CertEntryDelete(filename string) error {
286+
runtime, err := c.nativeAPI.Runtime()
287+
if err != nil {
288+
return err
289+
}
290+
return runtime.DeleteCertEntry(filename)
291+
}

‎pkg/haproxy/certs/main.go

Lines changed: 36 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ type Certificates interface {
3535
// Updated returns true if there is any updadted/created certificate
3636
CertsUpdated() bool
3737
// Refresh removes unused certs from HAProxyCertDir
38-
RefreshCerts()
38+
RefreshCerts(api api.HAProxyClient)
3939
// Clean cleans certificates state
4040
CleanCerts()
4141
SetAPI(api api.HAProxyClient)
@@ -215,6 +215,28 @@ func (c *certs) updateRuntime(filename string, payload []byte) (bool, error) {
215215
return updated, nil
216216
}
217217

218+
func (c *certs) deleteRuntime(crtList, filename string) error {
219+
// Only 1 transaction in parallel is possible for now in haproxy
220+
// Keep this mutex for now to ensure that we perform 1 transaction at a time
221+
c.mu.Lock()
222+
defer c.mu.Unlock()
223+
224+
var err error
225+
certFile := path.Join(crtList, filename)
226+
err = c.client.CrtListEntryDelete(crtList, certFile, nil)
227+
if err != nil {
228+
return err
229+
}
230+
utils.GetLogger().Debugf("del ssl crt-list` ok [%s %s]", crtList, certFile)
231+
232+
err = c.client.CertEntryDelete(certFile)
233+
if err != nil {
234+
return err
235+
}
236+
utils.GetLogger().Debugf("del ssl cert` ok [%s]", certFile)
237+
return nil
238+
}
239+
218240
func (c *certs) CleanCerts() {
219241
for i := range c.frontend {
220242
c.frontend[i].inUse = false
@@ -243,11 +265,12 @@ func (c *certs) FrontCertsInUse() bool {
243265
return false
244266
}
245267

246-
func (c *certs) RefreshCerts() {
247-
refreshCerts(c.frontend, env.FrontendDir)
248-
refreshCerts(c.backend, env.BackendDir)
249-
refreshCerts(c.ca, env.CaDir)
250-
refreshCerts(c.TCPCR, env.TCPCRDir)
268+
func (c *certs) RefreshCerts(api api.HAProxyClient) {
269+
c.SetAPI(api)
270+
c.refreshCerts(c.frontend, env.FrontendDir)
271+
c.refreshCerts(c.backend, env.BackendDir)
272+
c.refreshCerts(c.ca, env.CaDir)
273+
c.refreshCerts(c.TCPCR, env.TCPCRDir)
251274
}
252275

253276
func (c *certs) CertsUpdated() (reload bool) {
@@ -262,7 +285,7 @@ func (c *certs) CertsUpdated() (reload bool) {
262285
return reload
263286
}
264287

265-
func refreshCerts(certs map[string]*cert, certDir string) {
288+
func (c *certs) refreshCerts(certs map[string]*cert, certDir string) {
266289
files, err := os.ReadDir(certDir)
267290
if err != nil {
268291
logger.Error(err)
@@ -277,11 +300,16 @@ func refreshCerts(certs map[string]*cert, certDir string) {
277300
certName := strings.Split(filename, ".pem")[0]
278301
crt, crtOk := certs[certName]
279302
if !crtOk || !crt.inUse {
303+
err := c.deleteRuntime(certDir, filename)
304+
if err != nil {
305+
instance.Reload("Runtime delete of cert file '%s' failed : %s", filename, err.Error())
306+
} else {
307+
utils.GetLogger().Debugf("Runtime delete of cert ok [%s]", filename)
308+
}
280309
fs.AddDelayedFunc(filename, func() {
281310
logger.Error(os.Remove(path.Join(certDir, filename)))
282311
})
283312
delete(certs, certName)
284-
instance.Reload("secret %s removed", certName)
285313
}
286314
}
287315
}

0 commit comments

Comments
 (0)