@@ -24,7 +24,7 @@ func NewManager(mrcClient MRCClient, serviceCertValidityDuration time.Duration,
2424 return nil , err
2525 }
2626
27- c := & issuer {Issuer : client , ID : clientID , CertificateAuthority : ca }
27+ c := & issuer {Issuer : client , ID : clientID , CertificateAuthority : ca , TrustDomain : mrcs [ 0 ]. Spec . TrustDomain }
2828
2929 m := & Manager {
3030 // The signingIssuer is responsible for signing all newly issued certificates
@@ -59,15 +59,23 @@ func (m *Manager) Start(checkInterval time.Duration, stop <-chan struct{}) {
5959// GetTrustDomain returns the trust domain from the configured signingkey issuer.
6060// Note that the CRD uses a default, so this value will always be set.
6161func (m * Manager ) GetTrustDomain () string {
62- // TODO(4754): implement
63- return ""
62+ m .mu .Lock ()
63+ defer m .mu .Unlock ()
64+ return m .signingIssuer .TrustDomain
6465}
6566
6667func (m * Manager ) checkAndRotate () {
6768 // NOTE: checkAndRotate can reintroduce a certificate that has been released, thereby creating an unbounded cache.
6869 // A certificate can also have been rotated already, leaving the list of issued certs stale, and we re-rotate.
6970 // the latter is not a bug, but a source of inefficiency.
70- for _ , cert := range m .ListIssuedCertificates () {
71+
72+ certs := map [string ]* Certificate {}
73+ m .cache .Range (func (keyIface interface {}, certInterface interface {}) bool {
74+ key := keyIface .(string )
75+ certs [key ] = certInterface .(* Certificate )
76+ return true // continue the iteration
77+ })
78+ for key , cert := range certs {
7179 shouldRotate := cert .ShouldRotate ()
7280
7381 word := map [bool ]string {true : "will" , false : "will not" }[shouldRotate ]
@@ -78,7 +86,14 @@ func (m *Manager) checkAndRotate() {
7886 RenewBeforeCertExpires )
7987
8088 if shouldRotate {
81- newCert , err := m .IssueCertificate (cert .GetCommonName (), m .serviceCertValidityDuration )
89+ opts := []IssueOption {WithValidityPeriod (m .serviceCertValidityDuration )}
90+ // if the key is equal to the common name, then it was issued with FullCNProvided(). This will prevent
91+ // an additional trust domain from being appended. We don't do this in every case, in case the trust domain
92+ // has changed since the last issue.
93+ if key == cert .CommonName .String () {
94+ opts = append (opts , FullCNProvided ())
95+ }
96+ newCert , err := m .IssueCertificate (key , opts ... )
8297 if err != nil {
8398 // TODO(#3962): metric might not be scraped before process restart resulting from this error
8499 log .Error ().Err (err ).Str (errcode .Kind , errcode .GetErrCodeWithMetric (errcode .ErrRotatingCert )).
@@ -97,8 +112,8 @@ func (m *Manager) checkAndRotate() {
97112 }
98113}
99114
100- func (m * Manager ) getFromCache (cn CommonName ) * Certificate {
101- certInterface , exists := m .cache .Load (cn )
115+ func (m * Manager ) getFromCache (key string ) * Certificate {
116+ certInterface , exists := m .cache .Load (key )
102117 if ! exists {
103118 return nil
104119 }
@@ -112,18 +127,24 @@ func (m *Manager) getFromCache(cn CommonName) *Certificate {
112127}
113128
114129// IssueCertificate implements Manager and returns a newly issued certificate from the given client.
115- func (m * Manager ) IssueCertificate (cn CommonName , validityPeriod time. Duration ) (* Certificate , error ) {
130+ func (m * Manager ) IssueCertificate (prefix string , opts ... IssueOption ) (* Certificate , error ) {
116131 var err error
117- cert := m .getFromCache (cn ) // Don't call this while holding the lock
132+ cert := m .getFromCache (prefix ) // Don't call this while holding the lock
133+
134+ options := defaultOptions (m .serviceCertValidityDuration )
135+
136+ for _ , o := range opts {
137+ o (options )
138+ }
118139
119- m .mu .RLock ()
140+ m .mu .Lock ()
120141 validatingIssuer := m .validatingIssuer
121142 signingIssuer := m .signingIssuer
122- m .mu .RUnlock ()
143+ m .mu .Unlock ()
123144
124145 start := time .Now ()
125146 if cert == nil || cert .signingIssuerID != signingIssuer .ID || cert .validatingIssuerID != validatingIssuer .ID {
126- cert , err = signingIssuer .IssueCertificate (cn , validityPeriod )
147+ cert , err = signingIssuer .IssueCertificate (options . formatCN ( prefix , signingIssuer . TrustDomain ), options . validityPeriod )
127148 if err != nil {
128149 return nil , err
129150 }
@@ -138,17 +159,17 @@ func (m *Manager) IssueCertificate(cn CommonName, validityPeriod time.Duration)
138159 cert .validatingIssuerID = validatingIssuer .ID
139160 }
140161
141- m .cache .Store (cn , cert )
162+ m .cache .Store (prefix , cert )
142163
143164 log .Trace ().Msgf ("It took %s to issue certificate with SerialNumber=%s" , time .Since (start ), cert .GetSerialNumber ())
144165
145166 return cert , nil
146167}
147168
148169// ReleaseCertificate is called when a cert will no longer be needed and should be removed from the system.
149- func (m * Manager ) ReleaseCertificate (cn CommonName ) {
150- log .Trace ().Msgf ("Releasing certificate %s" , cn )
151- m .cache .Delete (cn )
170+ func (m * Manager ) ReleaseCertificate (key string ) {
171+ log .Trace ().Msgf ("Releasing certificate %s" , key )
172+ m .cache .Delete (key )
152173}
153174
154175// ListIssuedCertificates implements CertificateDebugger interface and returns the list of issued certificates.
0 commit comments