@@ -973,7 +973,7 @@ func init() {

 				},

 				{

 					APIGroups: []string{kapi.GroupName},

-					Verbs:     sets.NewString("get", "create"),

+					Verbs:     sets.NewString("get", "list", "watch", "create", "update"),

 					Resources: sets.NewString("secrets"),

 				},

 			},

@@ -395,6 +395,9 @@ func (c *MasterConfig) RunServiceServingCertController(client *kclientset.Client

 	servingCertController := servingcertcontroller.NewServiceServingCertController(client.Core(), client.Core(), ca, "cluster.local", 2*time.Minute)

 	go servingCertController.Run(1, make(chan struct{}))

+

+	servingCertUpdateController := servingcertcontroller.NewServiceServingCertUpdateController(client.Core(), client.Core(), ca, "cluster.local", 20*time.Minute)

+	go servingCertUpdateController.Run(5, make(chan struct{}))

 }

 // RunImageImportController starts the image import trigger controller process.

deleted file mode 100644

@@ -1,297 +0,0 @@

-package servingcert

-

-import (

-	"errors"

-	"fmt"

-	"strconv"

-	"time"

-

-	"github.com/golang/glog"

-

-	kapi "k8s.io/kubernetes/pkg/api"

-	kapierrors "k8s.io/kubernetes/pkg/api/errors"

-	"k8s.io/kubernetes/pkg/client/cache"

-	kcoreclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/core/unversioned"

-	"k8s.io/kubernetes/pkg/controller"

-	"k8s.io/kubernetes/pkg/controller/framework"

-	"k8s.io/kubernetes/pkg/runtime"

-	utilruntime "k8s.io/kubernetes/pkg/util/runtime"

-	"k8s.io/kubernetes/pkg/util/sets"

-	"k8s.io/kubernetes/pkg/util/wait"

-	"k8s.io/kubernetes/pkg/util/workqueue"

-	"k8s.io/kubernetes/pkg/watch"

-

-	"github.com/openshift/origin/pkg/cmd/server/crypto"

-)

-

-const (

-	// ServingCertSecretAnnotation stores the name of the secret to generate into.

-	ServingCertSecretAnnotation = "service.alpha.openshift.io/serving-cert-secret-name"

-	// ServingCertCreatedByAnnotation stores the of the signer common name.  This could be used later to see if the

-	// services need to have the the serving certs regenerated.  The presence and matching of this annotation prevents

-	// regeneration

-	ServingCertCreatedByAnnotation = "service.alpha.openshift.io/serving-cert-signed-by"

-	// ServingCertErrorAnnotation stores the error that caused cert generation failures.

-	ServingCertErrorAnnotation = "service.alpha.openshift.io/serving-cert-generation-error"

-	// ServingCertErrorNumAnnotation stores how many consecutive errors we've hit.  A value of the maxRetries will prevent

-	// the controller from reattempting until it is cleared.

-	ServingCertErrorNumAnnotation = "service.alpha.openshift.io/serving-cert-generation-error-num"

-	// ServiceUIDAnnotation is an annotation on a secret that indicates which service created it, by UID

-	ServiceUIDAnnotation = "service.alpha.openshift.io/originating-service-uid"

-	// ServiceNameAnnotation is an annotation on a secret that indicates which service created it, by Name to allow reverse lookups on services

-	// for comparison against UIDs

-	ServiceNameAnnotation = "service.alpha.openshift.io/originating-service-name"

-)

-

-// ServiceServingCertController is responsible for synchronizing Service objects stored

-// in the system with actual running replica sets and pods.

-type ServiceServingCertController struct {

-	serviceClient kcoreclient.ServicesGetter

-	secretClient  kcoreclient.SecretsGetter

-

-	// Services that need to be checked

-	queue      workqueue.RateLimitingInterface

-	maxRetries int

-

-	serviceCache      cache.Store

-	serviceController *framework.Controller

-

-	ca         *crypto.CA

-	publicCert string

-	dnsSuffix  string

-

-	// syncHandler does the work. It's factored out for unit testing

-	syncHandler func(serviceKey string) error

-}

-

-// NewServiceServingCertController creates a new ServiceServingCertController.

-// TODO this should accept a shared informer

-func NewServiceServingCertController(serviceClient kcoreclient.ServicesGetter, secretClient kcoreclient.SecretsGetter, ca *crypto.CA, dnsSuffix string, resyncInterval time.Duration) *ServiceServingCertController {

-	sc := &ServiceServingCertController{

-		serviceClient: serviceClient,

-		secretClient:  secretClient,

-

-		queue:      workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter()),

-		maxRetries: 10,

-

-		ca:        ca,

-		dnsSuffix: dnsSuffix,

-	}

-

-	sc.serviceCache, sc.serviceController = framework.NewInformer(

-		&cache.ListWatch{

-			ListFunc: func(options kapi.ListOptions) (runtime.Object, error) {

-				return sc.serviceClient.Services(kapi.NamespaceAll).List(options)

-			},

-			WatchFunc: func(options kapi.ListOptions) (watch.Interface, error) {

-				return sc.serviceClient.Services(kapi.NamespaceAll).Watch(options)

-			},

-		},

-		&kapi.Service{},

-		resyncInterval,

-		framework.ResourceEventHandlerFuncs{

-			AddFunc: func(obj interface{}) {

-				service := obj.(*kapi.Service)

-				glog.V(4).Infof("Adding service %s", service.Name)

-				sc.enqueueService(obj)

-			},

-			UpdateFunc: func(old, cur interface{}) {

-				service := cur.(*kapi.Service)

-				glog.V(4).Infof("Updating service %s", service.Name)

-				// Resync on service object relist.

-				sc.enqueueService(cur)

-			},

-		},

-	)

-

-	sc.syncHandler = sc.syncService

-

-	return sc

-}

-

-// Run begins watching and syncing.

-func (sc *ServiceServingCertController) Run(workers int, stopCh <-chan struct{}) {

-	defer utilruntime.HandleCrash()

-	go sc.serviceController.Run(stopCh)

-	for i := 0; i < workers; i++ {

-		go wait.Until(sc.worker, time.Second, stopCh)

-	}

-

-	<-stopCh

-	glog.Infof("Shutting down service signing cert controller")

-	sc.queue.ShutDown()

-}

-

-func (sc *ServiceServingCertController) enqueueService(obj interface{}) {

-	key, err := controller.KeyFunc(obj)

-	if err != nil {

-		glog.Errorf("Couldn't get key for object %+v: %v", obj, err)

-		return

-	}

-

-	sc.queue.Add(key)

-}

-

-// worker runs a worker thread that just dequeues items, processes them, and marks them done.

-// It enforces that the syncHandler is never invoked concurrently with the same key.

-func (sc *ServiceServingCertController) worker() {

-	for {

-		if !sc.work() {

-			return

-		}

-	}

-}

-

-// work returns true if the worker thread should continue

-func (sc *ServiceServingCertController) work() bool {

-	key, quit := sc.queue.Get()

-	if quit {

-		return false

-	}

-	defer sc.queue.Done(key)

-

-	if err := sc.syncHandler(key.(string)); err == nil {

-		// this means the request was successfully handled.  We should "forget" the item so that any retry

-		// later on is reset

-		sc.queue.Forget(key)

-

-	} else {

-		// if we had an error it means that we didn't handle it, which means that we want to requeue the work

-		utilruntime.HandleError(fmt.Errorf("error syncing service, it will be retried: %v", err))

-		sc.queue.AddRateLimited(key)

-	}

-

-	return true

-}

-

-// syncService will sync the service with the given key.

-// This function is not meant to be invoked concurrently with the same key.

-func (sc *ServiceServingCertController) syncService(key string) error {

-	obj, exists, err := sc.serviceCache.GetByKey(key)

-	if err != nil {

-		glog.V(4).Infof("Unable to retrieve service %v from store: %v", key, err)

-		return err

-	}

-	if !exists {

-		glog.V(4).Infof("Service has been deleted %v", key)

-		return nil

-	}

-

-	if !sc.requiresCertGeneration(obj.(*kapi.Service)) {

-		return nil

-	}

-

-	// make a copy to avoid mutating cache state

-	t, err := kapi.Scheme.DeepCopy(obj)

-	if err != nil {

-		return err

-	}

-	service := t.(*kapi.Service)

-	if service.Annotations == nil {

-		service.Annotations = map[string]string{}

-	}

-

-	dnsName := service.Name + "." + service.Namespace + ".svc"

-	fqDNSName := dnsName + "." + sc.dnsSuffix

-	servingCert, err := sc.ca.MakeServerCert(sets.NewString(dnsName, fqDNSName))

-	if err != nil {

-		return err

-	}

-	certBytes, keyBytes, err := servingCert.GetPEMBytes()

-	if err != nil {

-		return err

-	}

-

-	secret := &kapi.Secret{

-		ObjectMeta: kapi.ObjectMeta{

-			Namespace: service.Namespace,

-			Name:      service.Annotations[ServingCertSecretAnnotation],

-			Annotations: map[string]string{

-				ServiceUIDAnnotation:  string(service.UID),

-				ServiceNameAnnotation: service.Name,

-			},

-		},

-		Type: kapi.SecretTypeTLS,

-		Data: map[string][]byte{

-			kapi.TLSCertKey:       certBytes,

-			kapi.TLSPrivateKeyKey: keyBytes,

-		},

-	}

-

-	_, err = sc.secretClient.Secrets(service.Namespace).Create(secret)

-	if err != nil && !kapierrors.IsAlreadyExists(err) {

-		// if we have an error creating the secret, then try to update the service with that information.  If it fails,

-		// then we'll just try again later on  re-list or because the service had already been updated and we'll get triggered again.

-		service.Annotations[ServingCertErrorAnnotation] = err.Error()

-		service.Annotations[ServingCertErrorNumAnnotation] = strconv.Itoa(getNumFailures(service) + 1)

-		_, updateErr := sc.serviceClient.Services(service.Namespace).Update(service)

-

-		// if we're past the max retries and we successfully updated, then the sync loop successfully handled this service and we want to forget it

-		if updateErr == nil && getNumFailures(service) >= sc.maxRetries {

-			return nil

-		}

-		return err

-	}

-	if kapierrors.IsAlreadyExists(err) {

-		actualSecret, err := sc.secretClient.Secrets(service.Namespace).Get(secret.Name)

-		if err != nil {

-			// if we have an error creating the secret, then try to update the service with that information.  If it fails,

-			// then we'll just try again later on  re-list or because the service had already been updated and we'll get triggered again.

-			service.Annotations[ServingCertErrorAnnotation] = err.Error()

-			service.Annotations[ServingCertErrorNumAnnotation] = strconv.Itoa(getNumFailures(service) + 1)

-			_, updateErr := sc.serviceClient.Services(service.Namespace).Update(service)

-

-			// if we're past the max retries and we successfully updated, then the sync loop successfully handled this service and we want to forget it

-			if updateErr == nil && getNumFailures(service) >= sc.maxRetries {

-				return nil

-			}

-			return err

-		}

-

-		if actualSecret.Annotations[ServiceUIDAnnotation] != string(service.UID) {

-			service.Annotations[ServingCertErrorAnnotation] = fmt.Sprintf("secret/%v references serviceUID %v, which does not match %v", actualSecret.Name, actualSecret.Annotations[ServiceUIDAnnotation], service.UID)

-			service.Annotations[ServingCertErrorNumAnnotation] = strconv.Itoa(getNumFailures(service) + 1)

-			_, updateErr := sc.serviceClient.Services(service.Namespace).Update(service)

-

-			// if we're past the max retries and we successfully updated, then the sync loop successfully handled this service and we want to forget it

-			if updateErr == nil && getNumFailures(service) >= sc.maxRetries {

-				return nil

-			}

-			return errors.New(service.Annotations[ServingCertErrorAnnotation])

-		}

-	}

-

-	service.Annotations[ServingCertCreatedByAnnotation] = sc.ca.Config.Certs[0].Subject.CommonName

-	delete(service.Annotations, ServingCertErrorAnnotation)

-	delete(service.Annotations, ServingCertErrorNumAnnotation)

-	_, err = sc.serviceClient.Services(service.Namespace).Update(service)

-

-	return err

-}

-

-func getNumFailures(service *kapi.Service) int {

-	numFailuresString := service.Annotations[ServingCertErrorNumAnnotation]

-	if len(numFailuresString) == 0 {

-		return 0

-	}

-

-	numFailures, err := strconv.Atoi(numFailuresString)

-	if err != nil {

-		return 0

-	}

-	return numFailures

-}

-

-func (sc *ServiceServingCertController) requiresCertGeneration(service *kapi.Service) bool {

-	if secretName := service.Annotations[ServingCertSecretAnnotation]; len(secretName) == 0 {

-		return false

-	}

-	if getNumFailures(service) >= sc.maxRetries {

-		return false

-	}

-	if service.Annotations[ServingCertCreatedByAnnotation] == sc.ca.Config.Certs[0].Subject.CommonName {

-		return false

-	}

-

-	return true

-}

deleted file mode 100644

@@ -1,420 +0,0 @@

-package servingcert

-

-import (

-	"fmt"

-	"io/ioutil"

-	"reflect"

-	"testing"

-	"time"

-

-	kapi "k8s.io/kubernetes/pkg/api"

-	kapierrors "k8s.io/kubernetes/pkg/api/errors"

-	"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/fake"

-	"k8s.io/kubernetes/pkg/client/testing/core"

-	"k8s.io/kubernetes/pkg/runtime"

-	"k8s.io/kubernetes/pkg/types"

-	"k8s.io/kubernetes/pkg/watch"

-

-	"github.com/openshift/origin/pkg/cmd/server/admin"

-)

-

-func controllerSetup(startingObjects []runtime.Object, stopChannel chan struct{}, t *testing.T) ( /*caName*/ string, *fake.Clientset, *watch.FakeWatcher, *ServiceServingCertController) {

-	certDir, err := ioutil.TempDir("", "serving-cert-unit-")

-	if err != nil {

-		t.Fatalf("unexpected error: %v", err)

-	}

-	caInfo := admin.DefaultServiceSignerCAInfo(certDir)

-

-	caOptions := admin.CreateSignerCertOptions{

-		CertFile: caInfo.CertFile,

-		KeyFile:  caInfo.KeyFile,

-		Name:     admin.DefaultServiceServingCertSignerName(),

-		Output:   ioutil.Discard,

-	}

-	ca, err := caOptions.CreateSignerCert()

-	if err != nil {

-		t.Fatalf("unexpected error: %v", err)

-	}

-

-	kubeclient := fake.NewSimpleClientset(startingObjects...)

-	fakeWatch := watch.NewFake()

-	kubeclient.PrependReactor("create", "*", func(action core.Action) (handled bool, ret runtime.Object, err error) {

-		return true, action.(core.CreateAction).GetObject(), nil

-	})

-	kubeclient.PrependReactor("update", "*", func(action core.Action) (handled bool, ret runtime.Object, err error) {

-		return true, action.(core.UpdateAction).GetObject(), nil

-	})

-	kubeclient.PrependWatchReactor("*", core.DefaultWatchReactor(fakeWatch, nil))

-

-	controller := NewServiceServingCertController(kubeclient.Core(), kubeclient.Core(), ca, "cluster.local", 10*time.Minute)

-

-	return caOptions.Name, kubeclient, fakeWatch, controller

-}

-

-func TestBasicControllerFlow(t *testing.T) {

-	stopChannel := make(chan struct{})

-	defer close(stopChannel)

-	received := make(chan bool)

-

-	caName, kubeclient, fakeWatch, controller := controllerSetup([]runtime.Object{}, stopChannel, t)

-	controller.syncHandler = func(serviceKey string) error {

-		defer func() { received <- true }()

-

-		err := controller.syncService(serviceKey)

-		if err != nil {

-			t.Errorf("unexpected error: %v", err)

-		}

-

-		return err

-	}

-	go controller.Run(1, stopChannel)

-

-	expectedSecretName := "new-secret"

-	serviceName := "svc-name"

-	serviceUID := "some-uid"

-	expectedServiceAnnotations := map[string]string{ServingCertSecretAnnotation: expectedSecretName, ServingCertCreatedByAnnotation: caName}

-	expectedSecretAnnotations := map[string]string{ServiceUIDAnnotation: serviceUID, ServiceNameAnnotation: serviceName}

-	namespace := "ns"

-

-	serviceToAdd := &kapi.Service{}

-	serviceToAdd.Name = serviceName

-	serviceToAdd.Namespace = namespace

-	serviceToAdd.UID = types.UID(serviceUID)

-	serviceToAdd.Annotations = map[string]string{ServingCertSecretAnnotation: expectedSecretName}

-	fakeWatch.Add(serviceToAdd)

-

-	t.Log("waiting to reach syncHandler")

-	select {

-	case <-received:

-	case <-time.After(time.Duration(30 * time.Second)):

-		t.Fatalf("failed to call into syncService")

-	}

-

-	foundSecret := false

-	foundServiceUpdate := false

-	for _, action := range kubeclient.Actions() {

-		switch {

-		case action.Matches("create", "secrets"):

-			createSecret := action.(core.CreateAction)

-			newSecret := createSecret.GetObject().(*kapi.Secret)

-			if newSecret.Name != expectedSecretName {

-				t.Errorf("expected %v, got %v", expectedSecretName, newSecret.Name)

-				continue

-			}

-			if newSecret.Namespace != namespace {

-				t.Errorf("expected %v, got %v", namespace, newSecret.Namespace)

-				continue

-			}

-			if !reflect.DeepEqual(newSecret.Annotations, expectedSecretAnnotations) {

-				t.Errorf("expected %v, got %v", expectedSecretAnnotations, newSecret.Annotations)

-				continue

-			}

-			foundSecret = true

-

-		case action.Matches("update", "services"):

-			updateService := action.(core.UpdateAction)

-			service := updateService.GetObject().(*kapi.Service)

-			if !reflect.DeepEqual(service.Annotations, expectedServiceAnnotations) {

-				t.Errorf("expected %v, got %v", expectedServiceAnnotations, service.Annotations)

-				continue

-			}

-			foundServiceUpdate = true

-

-		}

-	}

-

-	if !foundSecret {

-		t.Errorf("secret wasn't created.  Got %v\n", kubeclient.Actions())

-	}

-	if !foundServiceUpdate {

-		t.Errorf("service wasn't updated.  Got %v\n", kubeclient.Actions())

-	}

-}

-

-func TestAlreadyExistingSecretControllerFlow(t *testing.T) {

-	stopChannel := make(chan struct{})

-	defer close(stopChannel)

-	received := make(chan bool)

-

-	expectedSecretName := "new-secret"

-	serviceName := "svc-name"

-	serviceUID := "some-uid"

-	expectedSecretAnnotations := map[string]string{ServiceUIDAnnotation: serviceUID, ServiceNameAnnotation: serviceName}

-	namespace := "ns"

-

-	existingSecret := &kapi.Secret{}

-	existingSecret.Name = expectedSecretName

-	existingSecret.Namespace = namespace

-	existingSecret.Type = kapi.SecretTypeTLS

-	existingSecret.Annotations = expectedSecretAnnotations

-

-	caName, kubeclient, fakeWatch, controller := controllerSetup([]runtime.Object{existingSecret}, stopChannel, t)

-	kubeclient.PrependReactor("create", "secrets", func(action core.Action) (handled bool, ret runtime.Object, err error) {

-		return true, &kapi.Secret{}, kapierrors.NewAlreadyExists(kapi.Resource("secrets"), "new-secret")

-	})

-	controller.syncHandler = func(serviceKey string) error {

-		defer func() { received <- true }()

-

-		err := controller.syncService(serviceKey)

-		if err != nil {

-			t.Errorf("unexpected error: %v", err)

-		}

-

-		return err

-	}

-	go controller.Run(1, stopChannel)

-

-	expectedServiceAnnotations := map[string]string{ServingCertSecretAnnotation: expectedSecretName, ServingCertCreatedByAnnotation: caName}

-

-	serviceToAdd := &kapi.Service{}

-	serviceToAdd.Name = serviceName

-	serviceToAdd.Namespace = namespace

-	serviceToAdd.UID = types.UID(serviceUID)

-	serviceToAdd.Annotations = map[string]string{ServingCertSecretAnnotation: expectedSecretName}

-	fakeWatch.Add(serviceToAdd)

-

-	t.Log("waiting to reach syncHandler")

-	select {

-	case <-received:

-	case <-time.After(time.Duration(30 * time.Second)):

-		t.Fatalf("failed to call into syncService")

-	}

-

-	foundSecret := false

-	foundServiceUpdate := false

-	for _, action := range kubeclient.Actions() {

-		switch {

-		case action.Matches("get", "secrets"):

-			foundSecret = true

-

-		case action.Matches("update", "services"):

-			updateService := action.(core.UpdateAction)

-			service := updateService.GetObject().(*kapi.Service)

-			if !reflect.DeepEqual(service.Annotations, expectedServiceAnnotations) {

-				t.Errorf("expected %v, got %v", expectedServiceAnnotations, service.Annotations)

-				continue

-			}

-			foundServiceUpdate = true

-

-		}

-	}

-

-	if !foundSecret {

-		t.Errorf("secret wasn't retrieved.  Got %v\n", kubeclient.Actions())

-	}

-	if !foundServiceUpdate {

-		t.Errorf("service wasn't updated.  Got %v\n", kubeclient.Actions())

-	}

-

-}

-

-func TestAlreadyExistingSecretForDifferentUIDControllerFlow(t *testing.T) {

-	stopChannel := make(chan struct{})

-	defer close(stopChannel)

-	received := make(chan bool)

-

-	expectedError := "secret/new-secret references serviceUID wrong-uid, which does not match some-uid"

-	expectedSecretName := "new-secret"

-	serviceName := "svc-name"

-	serviceUID := "some-uid"

-	namespace := "ns"

-

-	existingSecret := &kapi.Secret{}

-	existingSecret.Name = expectedSecretName

-	existingSecret.Namespace = namespace

-	existingSecret.Type = kapi.SecretTypeTLS

-	existingSecret.Annotations = map[string]string{ServiceUIDAnnotation: "wrong-uid", ServiceNameAnnotation: serviceName}

-

-	_, kubeclient, fakeWatch, controller := controllerSetup([]runtime.Object{existingSecret}, stopChannel, t)

-	kubeclient.PrependReactor("create", "secrets", func(action core.Action) (handled bool, ret runtime.Object, err error) {

-		return true, &kapi.Secret{}, kapierrors.NewAlreadyExists(kapi.Resource("secrets"), "new-secret")

-	})

-	controller.syncHandler = func(serviceKey string) error {

-		defer func() { received <- true }()

-

-		err := controller.syncService(serviceKey)

-		if err != nil && err.Error() != expectedError {

-			t.Errorf("unexpected error: %v", err)

-		}

-

-		return err

-	}

-	go controller.Run(1, stopChannel)

-

-	expectedServiceAnnotations := map[string]string{ServingCertSecretAnnotation: expectedSecretName, ServingCertErrorAnnotation: expectedError, ServingCertErrorNumAnnotation: "1"}

-

-	serviceToAdd := &kapi.Service{}

-	serviceToAdd.Name = serviceName

-	serviceToAdd.Namespace = namespace

-	serviceToAdd.UID = types.UID(serviceUID)

-	serviceToAdd.Annotations = map[string]string{ServingCertSecretAnnotation: expectedSecretName}

-	fakeWatch.Add(serviceToAdd)

-

-	t.Log("waiting to reach syncHandler")

-	select {

-	case <-received:

-	case <-time.After(time.Duration(30 * time.Second)):

-		t.Fatalf("failed to call into syncService")

-	}

-

-	foundSecret := false

-	foundServiceUpdate := false

-	for _, action := range kubeclient.Actions() {

-		switch {

-		case action.Matches("get", "secrets"):

-			foundSecret = true

-

-		case action.Matches("update", "services"):

-			updateService := action.(core.UpdateAction)

-			service := updateService.GetObject().(*kapi.Service)

-			if !reflect.DeepEqual(service.Annotations, expectedServiceAnnotations) {

-				t.Errorf("expected %v, got %v", expectedServiceAnnotations, service.Annotations)

-				continue

-			}

-			foundServiceUpdate = true

-

-		}

-	}

-

-	if !foundSecret {

-		t.Errorf("secret wasn't retrieved.  Got %v\n", kubeclient.Actions())

-	}

-	if !foundServiceUpdate {

-		t.Errorf("service wasn't updated.  Got %v\n", kubeclient.Actions())

-	}

-}

-

-func TestSecretCreationErrorControllerFlow(t *testing.T) {

-	stopChannel := make(chan struct{})

-	defer close(stopChannel)

-	received := make(chan bool)

-

-	expectedError := `secrets "new-secret" is forbidden: any reason`

-	expectedSecretName := "new-secret"

-	serviceName := "svc-name"

-	serviceUID := "some-uid"

-	namespace := "ns"

-

-	_, kubeclient, fakeWatch, controller := controllerSetup([]runtime.Object{}, stopChannel, t)

-	kubeclient.PrependReactor("create", "secrets", func(action core.Action) (handled bool, ret runtime.Object, err error) {

-		return true, &kapi.Secret{}, kapierrors.NewForbidden(kapi.Resource("secrets"), "new-secret", fmt.Errorf("any reason"))

-	})

-	controller.syncHandler = func(serviceKey string) error {

-		defer func() { received <- true }()

-

-		err := controller.syncService(serviceKey)

-		if err != nil && err.Error() != expectedError {

-			t.Errorf("unexpected error: %v", err)

-		}

-

-		return err

-	}

-	go controller.Run(1, stopChannel)

-

-	expectedServiceAnnotations := map[string]string{ServingCertSecretAnnotation: expectedSecretName, ServingCertErrorAnnotation: expectedError, ServingCertErrorNumAnnotation: "1"}

-

-	serviceToAdd := &kapi.Service{}

-	serviceToAdd.Name = serviceName

-	serviceToAdd.Namespace = namespace

-	serviceToAdd.UID = types.UID(serviceUID)

-	serviceToAdd.Annotations = map[string]string{ServingCertSecretAnnotation: expectedSecretName}

-	fakeWatch.Add(serviceToAdd)

-

-	t.Log("waiting to reach syncHandler")

-	select {

-	case <-received:

-	case <-time.After(time.Duration(30 * time.Second)):

-		t.Fatalf("failed to call into syncService")

-	}

-

-	foundServiceUpdate := false

-	for _, action := range kubeclient.Actions() {

-		switch {

-		case action.Matches("update", "services"):

-			updateService := action.(core.UpdateAction)

-			service := updateService.GetObject().(*kapi.Service)

-			if !reflect.DeepEqual(service.Annotations, expectedServiceAnnotations) {

-				t.Errorf("expected %v, got %v", expectedServiceAnnotations, service.Annotations)

-				continue

-			}

-			foundServiceUpdate = true

-

-		}

-	}

-

-	if !foundServiceUpdate {

-		t.Errorf("service wasn't updated.  Got %v\n", kubeclient.Actions())

-	}

-}

-

-func TestSkipGenerationControllerFlow(t *testing.T) {

-	stopChannel := make(chan struct{})

-	defer close(stopChannel)

-	received := make(chan bool)

-

-	expectedSecretName := "new-secret"

-	serviceName := "svc-name"

-	serviceUID := "some-uid"

-	namespace := "ns"

-

-	caName, kubeclient, fakeWatch, controller := controllerSetup([]runtime.Object{}, stopChannel, t)

-	kubeclient.PrependReactor("update", "service", func(action core.Action) (handled bool, ret runtime.Object, err error) {

-		return true, &kapi.Service{}, kapierrors.NewForbidden(kapi.Resource("fdsa"), "new-service", fmt.Errorf("any service reason"))

-	})

-	kubeclient.PrependReactor("create", "secret", func(action core.Action) (handled bool, ret runtime.Object, err error) {

-		return true, &kapi.Secret{}, kapierrors.NewForbidden(kapi.Resource("asdf"), "new-secret", fmt.Errorf("any reason"))

-	})

-	kubeclient.PrependReactor("update", "secret", func(action core.Action) (handled bool, ret runtime.Object, err error) {

-		return true, &kapi.Secret{}, kapierrors.NewForbidden(kapi.Resource("asdf"), "new-secret", fmt.Errorf("any reason"))

-	})

-	controller.syncHandler = func(serviceKey string) error {

-		defer func() { received <- true }()

-

-		err := controller.syncService(serviceKey)

-		if err != nil {

-			t.Errorf("unexpected error: %v", err)

-		}

-

-		return err

-	}

-	go controller.Run(1, stopChannel)

-

-	serviceToAdd := &kapi.Service{}

-	serviceToAdd.Name = serviceName

-	serviceToAdd.Namespace = namespace

-	serviceToAdd.UID = types.UID(serviceUID)

-	serviceToAdd.Annotations = map[string]string{ServingCertSecretAnnotation: expectedSecretName, ServingCertErrorAnnotation: "any-error", ServingCertErrorNumAnnotation: "11"}

-	fakeWatch.Add(serviceToAdd)

-

-	t.Log("waiting to reach syncHandler")

-	select {

-	case <-received:

-	case <-time.After(time.Duration(30 * time.Second)):

-		t.Fatalf("failed to call into syncService")

-	}

-

-	for _, action := range kubeclient.Actions() {

-		switch action.GetVerb() {

-		case "update", "create":

-			t.Errorf("no mutation expected, but we got %v", action)

-		}

-	}

-

-	kubeclient.ClearActions()

-	serviceToAdd.Annotations = map[string]string{ServingCertSecretAnnotation: expectedSecretName, ServingCertCreatedByAnnotation: caName}

-	fakeWatch.Add(serviceToAdd)

-

-	t.Log("waiting to reach syncHandler")

-	select {

-	case <-received:

-	case <-time.After(time.Duration(30 * time.Second)):

-		t.Fatalf("failed to call into syncService")

-	}

-

-	for _, action := range kubeclient.Actions() {

-		switch action.GetVerb() {

-		case "update", "create":

-			t.Errorf("no mutation expected, but we got %v", action)

-		}

-	}

-}

new file mode 100644

@@ -0,0 +1,301 @@

+package servingcert

+

+import (

+	"errors"

+	"fmt"

+	"strconv"

+	"time"

+

+	"github.com/golang/glog"

+

+	kapi "k8s.io/kubernetes/pkg/api"

+	kapierrors "k8s.io/kubernetes/pkg/api/errors"

+	"k8s.io/kubernetes/pkg/client/cache"

+	kcoreclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/core/unversioned"

+	"k8s.io/kubernetes/pkg/controller"

+	"k8s.io/kubernetes/pkg/controller/framework"

+	"k8s.io/kubernetes/pkg/runtime"

+	utilruntime "k8s.io/kubernetes/pkg/util/runtime"

+	"k8s.io/kubernetes/pkg/util/sets"

+	"k8s.io/kubernetes/pkg/util/wait"

+	"k8s.io/kubernetes/pkg/util/workqueue"

+	"k8s.io/kubernetes/pkg/watch"

+

+	"github.com/openshift/origin/pkg/cmd/server/crypto"

+)

+

+const (

+	// ServingCertSecretAnnotation stores the name of the secret to generate into.

+	ServingCertSecretAnnotation = "service.alpha.openshift.io/serving-cert-secret-name"

+	// ServingCertCreatedByAnnotation stores the of the signer common name.  This could be used later to see if the

+	// services need to have the the serving certs regenerated.  The presence and matching of this annotation prevents

+	// regeneration

+	ServingCertCreatedByAnnotation = "service.alpha.openshift.io/serving-cert-signed-by"

+	// ServingCertErrorAnnotation stores the error that caused cert generation failures.

+	ServingCertErrorAnnotation = "service.alpha.openshift.io/serving-cert-generation-error"

+	// ServingCertErrorNumAnnotation stores how many consecutive errors we've hit.  A value of the maxRetries will prevent

+	// the controller from reattempting until it is cleared.

+	ServingCertErrorNumAnnotation = "service.alpha.openshift.io/serving-cert-generation-error-num"

+	// ServiceUIDAnnotation is an annotation on a secret that indicates which service created it, by UID

+	ServiceUIDAnnotation = "service.alpha.openshift.io/originating-service-uid"

+	// ServiceNameAnnotation is an annotation on a secret that indicates which service created it, by Name to allow reverse lookups on services

+	// for comparison against UIDs

+	ServiceNameAnnotation = "service.alpha.openshift.io/originating-service-name"

+	// ServingCertExpiryAnnotation is an annotation that holds the expiry time of the certificate.  It accepts time in the

+	// RFC3339 format: 2018-11-29T17:44:39Z

+	ServingCertExpiryAnnotation = "service.alpha.openshift.io/expiry"

+)

+

+// ServiceServingCertController is responsible for synchronizing Service objects stored

+// in the system with actual running replica sets and pods.

+type ServiceServingCertController struct {

+	serviceClient kcoreclient.ServicesGetter

+	secretClient  kcoreclient.SecretsGetter

+

+	// Services that need to be checked

+	queue      workqueue.RateLimitingInterface

+	maxRetries int

+

+	serviceCache      cache.Store

+	serviceController *framework.Controller

+

+	ca         *crypto.CA

+	publicCert string

+	dnsSuffix  string

+

+	// syncHandler does the work. It's factored out for unit testing

+	syncHandler func(serviceKey string) error

+}

+

+// NewServiceServingCertController creates a new ServiceServingCertController.

+// TODO this should accept a shared informer

+func NewServiceServingCertController(serviceClient kcoreclient.ServicesGetter, secretClient kcoreclient.SecretsGetter, ca *crypto.CA, dnsSuffix string, resyncInterval time.Duration) *ServiceServingCertController {

+	sc := &ServiceServingCertController{

+		serviceClient: serviceClient,

+		secretClient:  secretClient,

+

+		queue:      workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter()),

+		maxRetries: 10,

+

+		ca:        ca,

+		dnsSuffix: dnsSuffix,

+	}

+

+	sc.serviceCache, sc.serviceController = framework.NewInformer(

+		&cache.ListWatch{

+			ListFunc: func(options kapi.ListOptions) (runtime.Object, error) {

+				return sc.serviceClient.Services(kapi.NamespaceAll).List(options)

+			},

+			WatchFunc: func(options kapi.ListOptions) (watch.Interface, error) {

+				return sc.serviceClient.Services(kapi.NamespaceAll).Watch(options)

+			},

+		},

+		&kapi.Service{},

+		resyncInterval,

+		framework.ResourceEventHandlerFuncs{

+			AddFunc: func(obj interface{}) {

+				service := obj.(*kapi.Service)

+				glog.V(4).Infof("Adding service %s", service.Name)

+				sc.enqueueService(obj)

+			},

+			UpdateFunc: func(old, cur interface{}) {

+				service := cur.(*kapi.Service)

+				glog.V(4).Infof("Updating service %s", service.Name)

+				// Resync on service object relist.

+				sc.enqueueService(cur)

+			},

+		},

+	)

+

+	sc.syncHandler = sc.syncService

+

+	return sc

+}

+

+// Run begins watching and syncing.

+func (sc *ServiceServingCertController) Run(workers int, stopCh <-chan struct{}) {

+	defer utilruntime.HandleCrash()

+	go sc.serviceController.Run(stopCh)

+	for i := 0; i < workers; i++ {

+		go wait.Until(sc.worker, time.Second, stopCh)

+	}

+

+	<-stopCh

+	glog.Infof("Shutting down service signing cert controller")

+	sc.queue.ShutDown()

+}

+

+func (sc *ServiceServingCertController) enqueueService(obj interface{}) {

+	key, err := controller.KeyFunc(obj)

+	if err != nil {

+		glog.Errorf("Couldn't get key for object %+v: %v", obj, err)

+		return

+	}