Add ability to force cert regeneration

[briandowns]

Signed-off-by: Brian Downs [email protected]

[Oats87]

I almost wonder if there is merit in figuring out how to add logging here for the purposes of knowing when certs are getting regenerated; however, I'm not sure that putting log messages in NewX makes sense. Conundrum.

[brandond]

@Oats87 I believe that I added logging to all cert signing operations a while back, so the call to l.factory.Renew(secret) should trigger an Info-level log message.

dynamiclistener/factory/cert_utils.go

Lines 106 to 107 in 6b37dc1

	logrus.Infof("certificate %s signed by %s: notBefore=%s notAfter=%s",
	parsedCert.Subject, caCert.Subject, parsedCert.NotBefore, parsedCert.NotAfter)

[brandond]

Just want to be clear in the terminology used here about regenerating certs vs renewing them. It is very important to Rancher that the cert is just renewed and not actually regenerated, as generating a new cert makes the browser suspicious and will break websockets.

[briandowns]

This operation would generate a new certificate needed for the certificate rotation work.

[brandond]

OK, my apologies. This is not intended to be used to force renewal; the expected behavior is to repopulate the secret with a completely new key and certificate, retaining only the CNs from the current certificate.