Repository: kubernetes/kubernetes
File: pkg/controller/certificates/cleaner/cleaner.go (Go)

Code before:
			return true
		}
	}
	return false
}

// isIssuedPastDeadline checks if the certificate has an Issued status and the
// creation time of the CSR is passed the deadline that issued requests are
// maintained for.
func isIssuedPastDeadline(logger klog.Logger, csr *capi.CertificateSigningRequest) bool {
	for _, c := range csr.Status.Conditions {
		if c.Type == capi.CertificateApproved && isIssued(csr) && isOlderThan(c.LastUpdateTime, approvedExpiration) {
			logger.Info("Cleaning CSR as it is more than approvedExpiration duration old and approved.", "csr", csr.Name, "approvedExpiration", approvedExpiration)
			return true
		}
	}
	return false
}

// isApprovedUnissuedPastDeadline checks if the certificate has an Approved status but
// no certificate has been issued, and the approval time has passed the deadline
// that pending requests are maintained for.
func isApprovedUnissuedPastDeadline(logger klog.Logger, csr *capi.CertificateSigningRequest) bool {
	for _, c := range csr.Status.Conditions {
		if c.Type == capi.CertificateApproved && !(isIssued(csr) && isOlderThan(c.LastUpdateTime, pendingExpiration)) {
			logger.Info("Cleaning CSR as it is approved but unissued for more than pendingExpiration duration.", "csr", csr.Name, "pendingExpiration", pendingExpiration)
			return true
		}
	}
	return false
}

// isOlderThan checks that t is a non-zero and older than d from time.Now().
func isOlderThan(t metav1.Time, d time.Duration) bool {
	return !t.IsZero() && time.Since(t.Time) > d
}

// isIssued checks if the CSR has `Issued` status. There is no explicit
// 'Issued' status. Implicitly, if there is a certificate associated with the
// CSR, the CSR statuses that are visible via `kubectl` will include 'Issued'.
func isIssued(csr *capi.CertificateSigningRequest) bool {
	return len(csr.Status.Certificate) > 0
}

// isExpired checks if the CSR has a certificate and the date in the `NotAfter`
// field has gone by.
func isExpired(csr *capi.CertificateSigningRequest) bool {
	if len(csr.Status.Certificate) == 0 {
		return false
	}
	block, _ := pem.Decode(csr.Status.Certificate)

Review comment (suggestion):
this is a pre-existing issue with some of the other check functions, but let's improve this to hoist the checks that don't change out of the loop, e.g.:

```go
func isApprovedUnissuedPastDeadline(logger klog.Logger, csr *capi.CertificateSigningRequest) bool {
  if isIssued(csr) {
    return false
  }
	for _, c := range csr.Status.Conditions {
		if c.Type == capi.CertificateApproved && isOlderThan(c.LastUpdateTime, pendingExpiration) {
      ...
```

can make the same change to `isIssuedPastDeadline`

```go
func isIssuedPastDeadline(logger klog.Logger, csr *capi.CertificateSigningRequest) bool {
	if !isIssued(csr) {
		return false
	}
	for _, c := range csr.Status.Conditions {
		if c.Type == capi.CertificateApproved && isOlderThan(c.LastUpdateTime, approvedExpiration) {
```

Code after:
			return true
		}
	}
	return false
}

// isIssuedPastDeadline checks if the certificate has an Issued status and the
// creation time of the CSR is passed the deadline that issued requests are
// maintained for.
func isIssuedPastDeadline(logger klog.Logger, csr *capi.CertificateSigningRequest) bool {
	if !isIssued(csr) {
		return false
	}
	for _, c := range csr.Status.Conditions {
		if c.Type == capi.CertificateApproved && isOlderThan(c.LastUpdateTime, approvedExpiration) {
			logger.Info("Cleaning CSR as it is more than approvedExpiration duration old and approved.", "csr", csr.Name, "approvedExpiration", approvedExpiration)
			return true
		}
	}
	return false
}

// isApprovedUnissuedPastDeadline checks if the certificate has an Approved status but
// no certificate has been issued, and the approval time has passed the deadline
// that pending requests are maintained for.
func isApprovedUnissuedPastDeadline(logger klog.Logger, csr *capi.CertificateSigningRequest) bool {
	if isIssued(csr) {
		return false
	}
	for _, c := range csr.Status.Conditions {
		if c.Type == capi.CertificateApproved && isOlderThan(c.LastUpdateTime, pendingExpiration) {
			logger.Info("Cleaning CSR as it is approved but unissued for more than pendingExpiration duration.", "csr", csr.Name, "pendingExpiration", pendingExpiration)
			return true
		}
	}
	return false
}

// isOlderThan checks that t is a non-zero and older than d from time.Now().
func isOlderThan(t metav1.Time, d time.Duration) bool {
	return !t.IsZero() && time.Since(t.Time) > d
}

// isIssued checks if the CSR has `Issued` status. There is no explicit
// 'Issued' status. Implicitly, if there is a certificate associated with the
// CSR, the CSR statuses that are visible via `kubectl` will include 'Issued'.
func isIssued(csr *capi.CertificateSigningRequest) bool {
	return len(csr.Status.Certificate) > 0
}

// isExpired checks if the CSR has a certificate and the date in the `NotAfter`