diff --git a/go.mod b/go.mod
index c02126b62db..86fbad34d1d 100644
--- a/go.mod
+++ b/go.mod
@@ -42,7 +42,7 @@ require (
k8s.io/mount-utils v0.31.3
k8s.io/pod-security-admission v0.31.3
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
- sigs.k8s.io/controller-runtime v0.19.3
+ sigs.k8s.io/controller-runtime v0.19.4
)
require (
diff --git a/go.sum b/go.sum
index c637fe05fa2..e42e80295fb 100644
--- a/go.sum
+++ b/go.sum
@@ -3578,8 +3578,8 @@ rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 h1:2770sDpzrjjsAtVhSeUFseziht227YAWYHLGNM8QPwY=
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
sigs.k8s.io/controller-runtime v0.2.2/go.mod h1:9dyohw3ZtoXQuV1e766PHUn+cmrRCIcBh6XIMFNMZ+I=
-sigs.k8s.io/controller-runtime v0.19.3 h1:XO2GvC9OPftRst6xWCpTgBZO04S2cbp0Qqkj8bX1sPw=
-sigs.k8s.io/controller-runtime v0.19.3/go.mod h1:j4j87DqtsThvwTv5/Tc5NFRyyF/RF0ip4+62tbTSIUM=
+sigs.k8s.io/controller-runtime v0.19.4 h1:SUmheabttt0nx8uJtoII4oIP27BVVvAKFvdvGFwV/Qo=
+sigs.k8s.io/controller-runtime v0.19.4/go.mod h1:iRmWllt8IlaLjvTTDLhRBXIEtkCK6hwVBJJsYS9Ajf4=
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 8376a92707c..4eb0e80ce04 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1786,7 +1786,7 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/client
sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/client/metrics
sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/common/metrics
sigs.k8s.io/apiserver-network-proxy/konnectivity-client/proto/client
-# sigs.k8s.io/controller-runtime v0.19.3
+# sigs.k8s.io/controller-runtime v0.19.4
## explicit; go 1.22.0
sigs.k8s.io/controller-runtime/pkg/cache
sigs.k8s.io/controller-runtime/pkg/cache/internal
diff --git a/vendor/sigs.k8s.io/controller-runtime/pkg/certwatcher/certwatcher.go b/vendor/sigs.k8s.io/controller-runtime/pkg/certwatcher/certwatcher.go
index f629dd4e16e..c3232409823 100644
--- a/vendor/sigs.k8s.io/controller-runtime/pkg/certwatcher/certwatcher.go
+++ b/vendor/sigs.k8s.io/controller-runtime/pkg/certwatcher/certwatcher.go
@@ -20,10 +20,15 @@ import (
"bytes"
"context"
"crypto/tls"
+ "fmt"
"os"
"sync"
"time"
+ "github.com/fsnotify/fsnotify"
+ kerrors "k8s.io/apimachinery/pkg/util/errors"
+ "k8s.io/apimachinery/pkg/util/sets"
+ "k8s.io/apimachinery/pkg/util/wait"
"sigs.k8s.io/controller-runtime/pkg/certwatcher/metrics"
logf "sigs.k8s.io/controller-runtime/pkg/internal/log"
)
@@ -40,6 +45,7 @@ type CertWatcher struct {
sync.RWMutex
currentCert *tls.Certificate
+ watcher *fsnotify.Watcher
interval time.Duration
certPath string
@@ -53,13 +59,25 @@ type CertWatcher struct {
// New returns a new CertWatcher watching the given certificate and key.
func New(certPath, keyPath string) (*CertWatcher, error) {
+ var err error
+
cw := &CertWatcher{
certPath: certPath,
keyPath: keyPath,
interval: defaultWatchInterval,
}
- return cw, cw.ReadCertificate()
+ // Initial read of certificate and key.
+ if err := cw.ReadCertificate(); err != nil {
+ return nil, err
+ }
+
+ cw.watcher, err = fsnotify.NewWatcher()
+ if err != nil {
+ return nil, err
+ }
+
+ return cw, nil
}
// WithWatchInterval sets the watch interval and returns the CertWatcher pointer
@@ -88,14 +106,35 @@ func (cw *CertWatcher) GetCertificate(_ *tls.ClientHelloInfo) (*tls.Certificate,
// Start starts the watch on the certificate and key files.
func (cw *CertWatcher) Start(ctx context.Context) error {
+ files := sets.New(cw.certPath, cw.keyPath)
+
+ {
+ var watchErr error
+ if err := wait.PollUntilContextTimeout(ctx, 1*time.Second, 10*time.Second, true, func(ctx context.Context) (done bool, err error) {
+ for _, f := range files.UnsortedList() {
+ if err := cw.watcher.Add(f); err != nil {
+ watchErr = err
+ return false, nil //nolint:nilerr // We want to keep trying.
+ }
+ // We've added the watch, remove it from the set.
+ files.Delete(f)
+ }
+ return true, nil
+ }); err != nil {
+ return fmt.Errorf("failed to add watches: %w", kerrors.NewAggregate([]error{err, watchErr}))
+ }
+ }
+
+ go cw.Watch()
+
ticker := time.NewTicker(cw.interval)
defer ticker.Stop()
- log.Info("Starting certificate watcher")
+ log.Info("Starting certificate poll+watcher", "interval", cw.interval)
for {
select {
case <-ctx.Done():
- return nil
+ return cw.watcher.Close()
case <-ticker.C:
if err := cw.ReadCertificate(); err != nil {
log.Error(err, "failed read certificate")
@@ -104,11 +143,26 @@ func (cw *CertWatcher) Start(ctx context.Context) error {
}
}
-// Watch used to read events from the watcher's channel and reacts to changes,
-// it has currently no function and it's left here for backward compatibility until a future release.
-//
-// Deprecated: fsnotify has been removed and Start() is now polling instead.
+// Watch reads events from the watcher's channel and reacts to changes.
func (cw *CertWatcher) Watch() {
+ for {
+ select {
+ case event, ok := <-cw.watcher.Events:
+ // Channel is closed.
+ if !ok {
+ return
+ }
+
+ cw.handleEvent(event)
+ case err, ok := <-cw.watcher.Errors:
+ // Channel is closed.
+ if !ok {
+ return
+ }
+
+ log.Error(err, "certificate watch error")
+ }
+ }
}
// updateCachedCertificate checks if the new certificate differs from the cache,
@@ -166,3 +220,23 @@ func (cw *CertWatcher) ReadCertificate() error {
}
return nil
}
+
+func (cw *CertWatcher) handleEvent(event fsnotify.Event) {
+ // Only care about events which may modify the contents of the file.
+ switch {
+ case event.Op.Has(fsnotify.Write):
+ case event.Op.Has(fsnotify.Create):
+ case event.Op.Has(fsnotify.Chmod), event.Op.Has(fsnotify.Remove):
+ // If the file was removed or renamed, re-add the watch to the previous name
+ if err := cw.watcher.Add(event.Name); err != nil {
+ log.Error(err, "error re-watching file")
+ }
+ default:
+ return
+ }
+
+ log.V(1).Info("certificate event", "event", event)
+ if err := cw.ReadCertificate(); err != nil {
+ log.Error(err, "error re-reading certificate")
+ }
+}