@@ -17,7 +17,6 @@ limitations under the License.
17
17
package certwatcher_test
18
18
19
19
import (
20
- "bytes"
21
20
"context"
22
21
"crypto/rand"
23
22
"crypto/rsa"
@@ -77,12 +76,12 @@ var _ = Describe("CertWatcher", func() {
77
76
Expect (err ).ToNot (HaveOccurred ())
78
77
})
79
78
80
- startWatcher := func () (done <- chan struct {}) {
79
+ startWatcher := func (interval time. Duration ) (done <- chan struct {}) {
81
80
doneCh := make (chan struct {})
82
81
go func () {
83
82
defer GinkgoRecover ()
84
83
defer close (doneCh )
85
- Expect (watcher .WithWatchInterval (time . Second ).Start (ctx )).To (Succeed ())
84
+ Expect (watcher .WithWatchInterval (interval ).Start (ctx )).To (Succeed ())
86
85
}()
87
86
// wait till we read first cert
88
87
Eventually (func () error {
@@ -93,14 +92,16 @@ var _ = Describe("CertWatcher", func() {
93
92
}
94
93
95
94
It ("should read the initial cert/key" , func () {
96
- doneCh := startWatcher ()
95
+ // This test verifies the initial read succeeded. So interval doesn't matter.
96
+ doneCh := startWatcher (10 * time .Second )
97
97
98
98
ctxCancel ()
99
99
Eventually (doneCh , "4s" ).Should (BeClosed ())
100
100
})
101
101
102
102
It ("should reload currentCert when changed" , func () {
103
- doneCh := startWatcher ()
103
+ // This test verifies fsnotify detects the cert change. So interval doesn't matter.
104
+ doneCh := startWatcher (10 * time .Second )
104
105
called := atomic.Int64 {}
105
106
watcher .RegisterCallback (func (crt tls.Certificate ) {
106
107
called .Add (1 )
@@ -115,7 +116,7 @@ var _ = Describe("CertWatcher", func() {
115
116
Eventually (func () bool {
116
117
secondcert , _ := watcher .GetCertificate (nil )
117
118
first := firstcert .PrivateKey .(* rsa.PrivateKey )
118
- return first .Equal (secondcert .PrivateKey ) || bytes . Equal ( firstcert .Certificate [ 0 ], secondcert .Certificate [ 0 ])
119
+ return first .Equal (secondcert .PrivateKey ) || firstcert .Leaf . SerialNumber == secondcert .Leaf . SerialNumber
119
120
}).ShouldNot (BeTrue ())
120
121
121
122
ctxCancel ()
@@ -124,7 +125,8 @@ var _ = Describe("CertWatcher", func() {
124
125
})
125
126
126
127
It ("should reload currentCert when changed with rename" , func () {
127
- doneCh := startWatcher ()
128
+ // This test verifies fsnotify detects the cert change. So interval doesn't matter.
129
+ doneCh := startWatcher (10 * time .Second )
128
130
called := atomic.Int64 {}
129
131
watcher .RegisterCallback (func (crt tls.Certificate ) {
130
132
called .Add (1 )
@@ -145,7 +147,7 @@ var _ = Describe("CertWatcher", func() {
145
147
Eventually (func () bool {
146
148
secondcert , _ := watcher .GetCertificate (nil )
147
149
first := firstcert .PrivateKey .(* rsa.PrivateKey )
148
- return first .Equal (secondcert .PrivateKey ) || bytes . Equal ( firstcert .Certificate [ 0 ], secondcert .Certificate [ 0 ])
150
+ return first .Equal (secondcert .PrivateKey ) || firstcert .Leaf . SerialNumber == secondcert .Leaf . SerialNumber
149
151
}).ShouldNot (BeTrue ())
150
152
151
153
ctxCancel ()
@@ -154,7 +156,8 @@ var _ = Describe("CertWatcher", func() {
154
156
})
155
157
156
158
It ("should reload currentCert after move out" , func () {
157
- doneCh := startWatcher ()
159
+ // This test verifies poll works, so we'll use 1s as interval (fsnotify doesn't detect this change).
160
+ doneCh := startWatcher (1 * time .Second )
158
161
called := atomic.Int64 {}
159
162
watcher .RegisterCallback (func (crt tls.Certificate ) {
160
163
called .Add (1 )
@@ -172,7 +175,7 @@ var _ = Describe("CertWatcher", func() {
172
175
Eventually (func () bool {
173
176
secondcert , _ := watcher .GetCertificate (nil )
174
177
first := firstcert .PrivateKey .(* rsa.PrivateKey )
175
- return first .Equal (secondcert .PrivateKey ) || bytes . Equal ( firstcert .Certificate [ 0 ], secondcert .Certificate [ 0 ])
178
+ return first .Equal (secondcert .PrivateKey ) || firstcert .Leaf . SerialNumber == secondcert .Leaf . SerialNumber
176
179
}, "10s" , "1s" ).ShouldNot (BeTrue ())
177
180
178
181
ctxCancel ()
@@ -190,7 +193,8 @@ var _ = Describe("CertWatcher", func() {
190
193
})
191
194
192
195
It ("should get updated on successful certificate read" , func () {
193
- doneCh := startWatcher ()
196
+ // This test verifies fsnotify, so interval doesn't matter.
197
+ doneCh := startWatcher (10 * time .Second )
194
198
195
199
Eventually (func () error {
196
200
readCertificateTotalAfter := testutil .ToFloat64 (metrics .ReadCertificateTotal )
@@ -205,7 +209,8 @@ var _ = Describe("CertWatcher", func() {
205
209
})
206
210
207
211
It ("should get updated on read certificate errors" , func () {
208
- doneCh := startWatcher ()
212
+ // This test works with fsnotify, so interval doesn't matter.
213
+ doneCh := startWatcher (10 * time .Second )
209
214
210
215
Eventually (func () error {
211
216
readCertificateTotalAfter := testutil .ToFloat64 (metrics .ReadCertificateTotal )
0 commit comments