External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-29 22:03:22 -02:30
Code Issues Packages Projects Releases Wiki Activity

Fix k8s-certs-renew renewing all certificates on every timer run (#13413)

Browse Source 
* Fix k8s-certs-renew renewing all certificates on every timer run

Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>

* Strip trailing whitespace from systemd-analyze calendar output

Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>

* Remove issue link

Co-authored-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

---------

Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Co-authored-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
This commit is contained in:
Ali Afsharzadeh
2026-08-21 07:07:16 +00:00
committed by GitHub
co-authored by ChengHao Yang
parent c2089ae595
commit ae329ee192
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/kubernetes/control-plane/templates/k8s-certs-renew.sh.j2
+4 -2
View File
@@ -5,9 +5,11 @@ echo "## Check Expiration before renewal ##"
{{ bin_dir }}/kubeadm certs check-expiration
days_buffer=7 # set a time margin, because we should not renew at the last moment
next_time=$(systemctl show k8s-certs-renew.timer -p NextElapseUSecRealtime --value)
# systemctl show reports an empty NextElapseUSecRealtime while the timer's unit is
# running, so use the calendar spec to get the next scheduled run.
next_time=$(LC_ALL=C systemd-analyze calendar "{{ auto_renew_certificates_systemd_calendar }}" | grep -oP 'Next elapse:\s*\K.*\S')
if [ "${next_time}" == "" ]; then
if [ "${next_time}" == "" ] || [ "${next_time}" == "never" ]; then
echo "## Skip expiry comparison due to fail to parse next elapse from systemd calendar,do renewal directly ##"
else
current_time=$(date +%s)