OpenShift v4.x - 인증서 만료 기간

const (
        // ValidityOneDay sets the validity of a cert to 24 hours.
        ValidityOneDay = time.Hour * 24
)

x509: certificate has expired or not yet valid

const (
    // ValidityTenYears sets the validity of a cert to 10 years.
    ValidityTenYears = ValidityOneYear * 10
)

const (
    // ValidityOneYear sets the validity of a cert to 1 year.
    ValidityOneYear = ValidityOneDay * 365
)

# We originally wanted to run the etcd cert signer as
# a static pod, but kubelet could't remove static pod
# when API server is not up, so we have to run this as
# podman container.
# See https://github.com/kubernetes/kubernetes/issues/43292

echo "Starting etcd certificate signer..."

trap "podman rm --force etcd-signer" ERR

bootkube_podman_run \
	--name etcd-signer \
	--detach \
	--volume /opt/openshift/tls:/opt/openshift/tls:ro,z \
	"${KUBE_ETCD_SIGNER_SERVER_IMAGE}" \
	serve \
	--cacrt=/opt/openshift/tls/etcd-signer.crt \
	--cakey=/opt/openshift/tls/etcd-signer.key \
	--metric-cacrt=/opt/openshift/tls/etcd-metric-signer.crt \
	--metric-cakey=/opt/openshift/tls/etcd-metric-signer.key \
	--servcrt=/opt/openshift/tls/kube-apiserver-lb-server.crt \
	--servkey=/opt/openshift/tls/kube-apiserver-lb-server.key \
	--servcrt=/opt/openshift/tls/kube-apiserver-internal-lb-server.crt \
	--servkey=/opt/openshift/tls/kube-apiserver-internal-lb-server.key \
	--servcrt=/opt/openshift/tls/kube-apiserver-localhost-server.crt \
	--servkey=/opt/openshift/tls/kube-apiserver-localhost-server.key \
	--address=0.0.0.0:6443 \
	--insecure-health-check-address=0.0.0.0:6080 \
	--csrdir=/tmp \
	--peercertdur=26280h \
	--servercertdur=26280h \
	--metriccertdur=26280h

- NotBefore
재생성 시점의 시간에서 1/sec를 뺀 시간으로 지정 된다.

- NotAfter
(2y * 365day) * 24h = 17520h로 지정 된다.

// generateRouterCA generates and returns a CA certificate and key.
func generateRouterCA() ([]byte, []byte, error) {
	signerName := fmt.Sprintf("%s@%d", "ingress-operator", time.Now().Unix())

	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to generate key: %v", err)
	}

	root := &x509.Certificate{
		Subject: pkix.Name{CommonName: signerName},

		SignatureAlgorithm: x509.SHA256WithRSA,

		NotBefore:    time.Now().Add(-1 * time.Second),
		NotAfter:     time.Now().Add(2 * 365 * 24 * time.Hour),
		SerialNumber: big.NewInt(1),

		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
		BasicConstraintsValid: true,

		IsCA: true,

		// Don't allow the CA to be used to make another CA.
		MaxPathLen:     0,
		MaxPathLenZero: true,
	}