kubeslice / kubeslice/kubeslice-controller
Bug: changing SliceConfig rotation interval does not update active certificate expiry time
- Dominant language
- Go
- Stars
- 73
- Forks
- 48
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 8
Description
### 📜 Description
When `SliceConfig.Spec.RotationInterval` is changed, the new value is propagated to the `VpnKeyRotation` CR but the `CertificateExpiryTime` is not recalculated. Certificates issued under the old interval remain valid until the old expiry, then the new interval takes effect on the next rotation.
This is a security concern: reducing the rotation interval to respond to a compromise does not immediately cause certificates to be rotated.
### 👟 Reproduction steps
1. Create a SliceConfig with `rotationInterval: 90`.
2. Wait for certificates to be issued. `CertificateExpiryTime` is set to now + 90 days.
3. Update `rotationInterval` to `30`.
4. Observe: `VpnKeyRotation.Spec.RotationInterval` is now 30, but `CertificateExpiryTime` still shows now + 90 days.
5. Certificates will not rotate for another ~90 days.
### 👍 Expected behavior
When the rotation interval decreases, the `CertificateExpiryTime` should be recalculated as `CertificateCreationTime + newInterval`, triggering a rotation sooner if the new expiry is in the past.
### 👎 Actual Behavior
`CertificateExpiryTime` is unchanged when the interval changes.
### 🐚 Relevant log output
```shell
```
### Version
_No response_
### 🖥️ What operating system are you seeing the problem on?
_No response_
### ✅ Proposed Solution
In `ReconcileVpnKeyRotation`, after updating `RotationInterval`, recalculate `CertificateExpiryTime`:
```go
if !reflect.DeepEqual(copyVpnConfig.Spec.RotationInterval, s.Spec.RotationInterval) {
copyVpnConfig.Spec.RotationInterval = s.Spec.RotationInterval
if copyVpnConfig.Spec.CertificateCreationTime != nil {
newExpiry := metav1.NewTime(copyVpnConfig.Spec.CertificateCreationTime.AddDate(0, 0, s.Spec.RotationInterval))
copyVpnConfig.Spec.CertificateExpiryTime = &newExpiry
}
toUpdate = true
}
```
### 👀 Have you spent some time to check if this issue has been raised before?
- [x] I checked and didn't find any similar issue
### Code of Conduct
- [x] I agree to follow this project's Code of Conduct
Contributor guide
Assessment
This issue has not been assessed yet.