in cmd/core_plugin/workloadcertrefresh/refresher_linux.go [192:279]
func (j *RefresherJob) refreshCreds(ctx context.Context, opts outputOpts, now string) error {
contentDir := fmt.Sprintf("%s-%s", opts.contentDirPrefix, now)
tempSymlink := fmt.Sprintf("%s-%s", opts.tempSymlinkPrefix, now)
// Get status first so it can be written even when other endpoints are empty.
certConfigStatus, err := j.readMetadata(ctx, configStatusKey)
if err != nil {
// Return success when certs are not configured to avoid unnecessary systemd
// failed units.
galog.Infof("Error getting config status, workload certificates may not be configured: %v", err)
return nil
}
galog.Debugf("Creating timestamp contents dir %s", contentDir)
if err := os.MkdirAll(contentDir, 0755); err != nil {
return fmt.Errorf("error creating contents dir: %w", err)
}
// Write config_status first even if remaining endpoints are empty.
if err := os.WriteFile(filepath.Join(contentDir, "config_status"), certConfigStatus, 0644); err != nil {
return fmt.Errorf("error writing config_status: %w", err)
}
// Handles the edge case where the config values provided for the first time
// may be invalid. This ensures that the symlink directory always exists and
// contains the config_status to surface config errors to the VM.
if _, err := os.Stat(opts.symlink); os.IsNotExist(err) {
galog.Infof("Creating new symlink %s", symlink)
if err := os.Symlink(contentDir, opts.symlink); err != nil {
return fmt.Errorf("error creating symlink: %w", err)
}
}
// Now get the rest of the content.
wisMd, err := j.readMetadata(ctx, workloadIdentitiesKey)
if err != nil {
return fmt.Errorf("error getting workload-identities: %w", err)
}
spiffeID, err := writeWorkloadIdentities(contentDir, wisMd)
if err != nil {
return fmt.Errorf("failed to write workload identities with error: %w", err)
}
wtrcsMd, err := j.readMetadata(ctx, trustAnchorsKey)
if err != nil {
return fmt.Errorf("error getting workload-trust-anchors: %w", err)
}
if err := writeTrustAnchors(wtrcsMd, contentDir, spiffeID); err != nil {
return fmt.Errorf("failed to write trust anchors: %w", err)
}
if err := os.Symlink(contentDir, tempSymlink); err != nil {
return fmt.Errorf("error creating temporary link: %w", err)
}
oldTarget, err := os.Readlink(opts.symlink)
if err != nil {
galog.Warnf("Error reading existing symlink %q: %v", opts.symlink, err)
oldTarget = ""
}
// Only rotate on success of all steps above.
galog.Infof("Rotating symlink %s", opts.symlink)
if err := os.Remove(opts.symlink); err != nil {
return fmt.Errorf("error removing symlink: %w", err)
}
if err := os.Rename(tempSymlink, opts.symlink); err != nil {
return fmt.Errorf("error rotating target link: %w", err)
}
// Clean up previous contents dir.
newTarget, err := os.Readlink(opts.symlink)
if err != nil {
return fmt.Errorf("error reading new symlink: %w, unable to remove old symlink target", err)
}
if oldTarget != newTarget {
galog.Infof("Removing old content dir %s", oldTarget)
if err := os.RemoveAll(oldTarget); err != nil {
return fmt.Errorf("failed to remove old symlink target: %w", err)
}
}
return nil
}