kubeslice / kubeslice/kubeslice-controller

Bug: changing SliceConfig rotation interval does not update active certificate expiry time

Open
#351 0 comments 0 reactions 1 assignee Claimed by @richiesebastian View on GitHub
bug
Dominant language
Go
Stars
73
Forks
48
Avg merge
2d 21h
Merged PRs (30d)
8

Description

### 📜 Description

When `SliceConfig.Spec.RotationInterval` is changed, the new value is propagated to the `VpnKeyRotation` CR but the `CertificateExpiryTime` is not recalculated. Certificates issued under the old interval remain valid until the old expiry, then the new interval takes effect on the next rotation.

This is a security concern: reducing the rotation interval to respond to a compromise does not immediately cause certificates to be rotated.

### 👟 Reproduction steps

1. Create a SliceConfig with `rotationInterval: 90`.
2. Wait for certificates to be issued. `CertificateExpiryTime` is set to now + 90 days.
3. Update `rotationInterval` to `30`.
4. Observe: `VpnKeyRotation.Spec.RotationInterval` is now 30, but `CertificateExpiryTime` still shows now + 90 days.
5. Certificates will not rotate for another ~90 days.

### 👍 Expected behavior

When the rotation interval decreases, the `CertificateExpiryTime` should be recalculated as `CertificateCreationTime + newInterval`, triggering a rotation sooner if the new expiry is in the past.

### 👎 Actual Behavior

`CertificateExpiryTime` is unchanged when the interval changes.

### 🐚 Relevant log output

```shell

```

### Version

_No response_

### 🖥️ What operating system are you seeing the problem on?

_No response_

### ✅ Proposed Solution

In `ReconcileVpnKeyRotation`, after updating `RotationInterval`, recalculate `CertificateExpiryTime`:

```go
if !reflect.DeepEqual(copyVpnConfig.Spec.RotationInterval, s.Spec.RotationInterval) {
copyVpnConfig.Spec.RotationInterval = s.Spec.RotationInterval
if copyVpnConfig.Spec.CertificateCreationTime != nil {
newExpiry := metav1.NewTime(copyVpnConfig.Spec.CertificateCreationTime.AddDate(0, 0, s.Spec.RotationInterval))
copyVpnConfig.Spec.CertificateExpiryTime = &newExpiry
}
toUpdate = true
}
```

### 👀 Have you spent some time to check if this issue has been raised before?

- [x] I checked and didn't find any similar issue

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.