Repository: kubernetes/kubernetes
File: staging/src/k8s.io/apiserver/pkg/server/options/serving_with_loopback.go (Go)

Code before:
		(*secureServingInfo).SNICerts = (*secureServingInfo).SNICerts[1:]
		return err

	// if we failed, but we already have a fallback loopback client config (usually insecure), allow it
	case err != nil && *loopbackClientConfig != nil:

	default:
		*loopbackClientConfig = secureLoopbackClientConfig
		if healthCheckAdder != nil {
			s.addLoopbackCertificateExpiryHealthCheck(healthCheckAdder)
		}
	}

	return nil
}

func (s *SecureServingOptionsWithLoopback) ApplyToConfig(cfg *server.Config) error {
	return s.applyTo(&cfg.SecureServing, &cfg.LoopbackClientConfig, cfg)
}

// addLoopbackCertificateExpiryHealthCheck adds a health check called `loopback-certificate-expiry` to the
// server that fails when the loopback client certificate has expired, enabling
// liveness probes to be used to automatically restart the apiserver.
func (s *SecureServingOptionsWithLoopback) addLoopbackCertificateExpiryHealthCheck(healthCheckAdder HealthChecksAdder) {
	expirationDate := s.clock.Now().Add(maxAge)
	healthCheckAdder.AddHealthChecks(healthz.NamedCheck("loopback-certificate-expiry", func(r *http.Request) error {
		if s.clock.Now().After(expirationDate) {
			return LoopbackCertificateExpiredError{}
		}

		return nil
	}))
}

type LoopbackCertificateExpiredError struct{}

func (lcee LoopbackCertificateExpiredError) Error() string {
	return "loopback client certificate is expired"
}


Review comment (suggestion):
this adds to healthz/livez/readyz ... do we want it in all 3? I can never remember which combination we want to target for different types of checks

Code after:
	case err != nil && *loopbackClientConfig == nil:
		(*secureServingInfo).SNICerts = (*secureServingInfo).SNICerts[1:]
		return err

	// if we failed, but we already have a fallback loopback client config (usually insecure), allow it
	case err != nil && *loopbackClientConfig != nil:

	default:
		*loopbackClientConfig = secureLoopbackClientConfig
		if healthCheckAdder != nil {
			s.addLoopbackServingCertificateHealthCheck(healthCheckAdder)
		}
	}

	return nil
}

func (s *SecureServingOptionsWithLoopback) ApplyToConfig(cfg *server.Config) error {
	return s.applyTo(&cfg.SecureServing, &cfg.LoopbackClientConfig, cfg)
}

// addLoopbackServingCertificateHealthCheck adds a health check called `loopback-certificate-expiry` to the
// server that fails when the loopback client certificate has expired, enabling
// liveness probes to be used to automatically restart the apiserver.
func (s *SecureServingOptionsWithLoopback) addLoopbackServingCertificateHealthCheck(healthCheckAdder HealthzLivezHealthChecksAdder) {
	expirationDate := s.clock.Now().Add(maxAge)
	check := healthz.NamedCheck("loopback-serving-certificate", func(r *http.Request) error {
		if s.clock.Now().After(expirationDate) {
			return LoopbackCertificateExpiredError{}
		}

		return nil
	})

	healthCheckAdder.AddHealthzChecks(check)
	healthCheckAdder.AddLivezChecks(check)
}

type LoopbackCertificateExpiredError struct{}

func (lcee LoopbackCertificateExpiredError) Error() string {
	return "loopback serving certificate is expired"
}