Documentation
¶
Overview ¶
Package certificate contains the reconciler for the PostgreSQL instance manager secrets
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoServerCertificateHandler = fmt.Errorf("no server certificate handler")
ErrNoServerCertificateHandler is raised when a new server certificate has been detected by the instance reconciler but no handler has been set.
Functions ¶
This section is empty.
Types ¶
type Reconciler ¶
type Reconciler struct {
// contains filtered or unexported fields
}
Reconciler returns a certificate reconciler
func NewReconciler ¶
func NewReconciler(cli client.Client, serverHandler serverCertificateHandler) *Reconciler
NewReconciler creates a new certificate reconciler
func (*Reconciler) EnsureServerCertificateLoaded ¶ added in v1.30.0
func (r *Reconciler) EnsureServerCertificateLoaded(ctx context.Context, cluster *apiv1.Cluster) error
EnsureServerCertificateLoaded makes sure the status-port web server has a server certificate loaded in memory, reading it from its secret when missing. It does not write the on-disk certificate files and does not signal a PostgreSQL reload: those remain the responsibility of RefreshSecrets.
The instance reconciler calls this before the admission guard so the kubelet liveness/readiness/startup probes, served over TLS, keep working even when the cached Cluster fails in-pod validation and the guard short-circuits the rest of the reconcile loop (RefreshSecrets included). Without it GetServerCertificate() stays nil, every probe handshake fails and the pod can never recover.
It short-circuits once a certificate is loaded: the probe server only needs a usable certificate to be present, and ongoing rotation is handled by RefreshSecrets when the cluster is valid. This avoids re-reading the secret on every reconcile, since it is never cached in the instance manager.
func (*Reconciler) RefreshSecrets ¶
RefreshSecrets is called when the PostgreSQL secrets are changed and will refresh the contents of the file inside the Pod, without reloading the actual PostgreSQL instance.
It returns a boolean flag telling if something changed. Usually the invoker will check that flag and reload the PostgreSQL instance it is up.
Source Files