pkg/tlsutil: impl the case where CA exist but App secret doesn't
@@ -152,7 +152,8 @@ func (scg *SDKCertGenerator) GenerateCert(cr runtime.Object, service *v1.Service
if err != nil {
return nil, nil, nil, err
}
- appSecret, err := getAppSecretInCluster(scg.KubeClient, ToAppSecretName(k, n, config.CertName), ns)
+ appSecretName := ToAppSecretName(k, n, config.CertName)
+ appSecret, err := getAppSecretInCluster(scg.KubeClient, appSecretName, ns)
if err != nil {
return nil, nil, nil, err
}
@@ -169,7 +170,27 @@ func (scg *SDKCertGenerator) GenerateCert(cr runtime.Object, service *v1.Service
} else if hasAppSecret && !hasCASecretAndConfigMap {
return nil, nil, nil, ErrCANotFound
} else if !hasAppSecret && hasCASecretAndConfigMap {
- // TODO
+ caKey, err := parsePEMEncodedPrivateKey(caSecret.Data[TLSCACertKey])
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ caCert, err := parsePEMEncodedCert([]byte(caConfigMap.Data[TLSCACertKey]))
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ key, err := newPrivateKey()
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ cert, err := newSignedCertificate(config, service, key, caCert, caKey)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ appSecret, err := scg.KubeClient.CoreV1().Secrets(ns).Create(toTLSSecret(key, cert, appSecretName, ns))
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ return appSecret, caConfigMap, caSecret, nil
} else {
// TODO
}
