Merge pull request #6193 from jabellard/leaf-cert-validatity-imp

Add Support to Configure Leaf Certificate Validity Period in Karmada Operator

charts/karmada-operator/crds/operator.karmada.io_karmadas.yaml

@@ -5197,6 +5197,13 @@ spec:
                           referenced.
                         type: string
                     type: object
+                  leafCertValidityDays:
+                    description: |-
+                      LeafCertValidityDays specifies the validity period of leaf certificates (e.g., API Server certificate) in days.
+                      If not specified, the default validity period of 1 year will be used.
+                    format: int32
+                    minimum: 1
+                    type: integer
                 type: object
               featureGates:
                 additionalProperties:

operator/config/crds/operator.karmada.io_karmadas.yaml

@@ -5197,6 +5197,13 @@ spec:
                           referenced.
                         type: string
                     type: object
+                  leafCertValidityDays:
+                    description: |-
+                      LeafCertValidityDays specifies the validity period of leaf certificates (e.g., API Server certificate) in days.
+                      If not specified, the default validity period of 1 year will be used.
+                    format: int32
+                    minimum: 1
+                    type: integer
                 type: object
               featureGates:
                 additionalProperties:

operator/pkg/apis/operator/v1alpha1/type.go

@@ -133,6 +133,12 @@ type CustomCertificate struct {
 	// all components that access the APIServer as clients.
 	// +optional
 	APIServerCACert *LocalSecretReference `json:"apiServerCACert,omitempty"`
+
+	// LeafCertValidityDays specifies the validity period of leaf certificates (e.g., API Server certificate) in days.
+	// If not specified, the default validity period of 1 year will be used.
+	// +kubebuilder:validation:Minimum=1
+	// +optional
+	LeafCertValidityDays *int32 `json:"leafCertValidityDays,omitempty"`
 }
 
 // ImageRegistry represents an image registry as well as the

operator/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go

@@ -114,6 +114,11 @@ func (in *CustomCertificate) DeepCopyInto(out *CustomCertificate) {
 		*out = new(LocalSecretReference)
 		**out = **in
 	}
+	if in.LeafCertValidityDays != nil {
+		in, out := &in.LeafCertValidityDays, &out.LeafCertValidityDays
+		*out = new(int32)
+		**out = **in
+	}
 	return
 }
 

operator/pkg/tasks/init/cert.go

@@ -20,6 +20,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"time"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	clientset "k8s.io/client-go/kubernetes"
@@ -200,5 +201,11 @@ func mutateCertConfig(data InitData, cc *certs.CertConfig) error {
 		}
 	}
 
+	if data.CustomCertificate().LeafCertValidityDays != nil {
+		certValidityDuration := time.Hour * 24 * time.Duration(*data.CustomCertificate().LeafCertValidityDays)
+		notAfter := time.Now().Add(certValidityDuration).UTC()
+		cc.NotAfter = &notAfter
+	}
+
 	return nil
 }