certrotation: update reasons in getValidityFromAnnotations

Author: vrutkovs

pkg/operator/certrotation/signer.go

@@ -158,9 +158,6 @@ func ensureOwnerReference(meta *metav1.ObjectMeta, owner *metav1.OwnerReference)
 func needNewSigningCertKeyPair(secret *corev1.Secret, refresh time.Duration, refreshOnlyWhenExpired bool) (bool, string) {
 	annotations := secret.Annotations
 	notBefore, notAfter, reason := getValidityFromAnnotations(annotations)
-	if len(reason) > 0 {
-		return true, reason
-	}
 
 	if time.Now().After(notAfter) {
 		return true, "already expired"
@@ -170,6 +167,10 @@ func needNewSigningCertKeyPair(secret *corev1.Secret, refresh time.Duration, ref
 		return false, ""
 	}
 
+	if len(reason) > 0 {
+		return true, reason
+	}
+
 	validity := notAfter.Sub(notBefore)
 	at80Percent := notAfter.Add(-validity / 5)
 	if time.Now().After(at80Percent) {
@@ -191,15 +192,15 @@ func getValidityFromAnnotations(annotations map[string]string) (notBefore time.T
 	}
 	notAfter, err := time.Parse(time.RFC3339, notAfterString)
 	if err != nil {
-		return notBefore, notAfter, fmt.Sprintf("bad expiry: %q", notAfterString)
+		return notBefore, notAfter, fmt.Sprintf("bad notAfter expiry: %q", notAfterString)
 	}
 	notBeforeString := annotations[CertificateNotBeforeAnnotation]
-	if len(notAfterString) == 0 {
+	if len(notBeforeString) == 0 {
 		return notBefore, notAfter, "missing notBefore"
 	}
 	notBefore, err = time.Parse(time.RFC3339, notBeforeString)
 	if err != nil {
-		return notBefore, notAfter, fmt.Sprintf("bad expiry: %q", notBeforeString)
+		return notBefore, notAfter, fmt.Sprintf("bad notBefore expiry: %q", notBeforeString)
 	}
 
 	return notBefore, notAfter, ""

pkg/operator/certrotation/target.go

@@ -204,10 +204,6 @@ func needNewTargetCertKeyPair(secret *corev1.Secret, signer *crypto.CA, caBundle
 // So with a cert percentage of 75% and equally long CA and cert validities at the worst case we start at 85% of the cert to renew, trying again every minute.
 func needNewTargetCertKeyPairForTime(annotations map[string]string, signer *crypto.CA, refresh time.Duration, refreshOnlyWhenExpired bool) string {
 	notBefore, notAfter, reason := getValidityFromAnnotations(annotations)
-	if len(reason) > 0 {
-		return reason
-	}
-
 	// Is cert expired?
 	if time.Now().After(notAfter) {
 		return "already expired"
@@ -217,6 +213,10 @@ func needNewTargetCertKeyPairForTime(annotations map[string]string, signer *cryp
 		return ""
 	}
 
+	if len(reason) > 0 {
+		return reason
+	}
+
 	// Are we at 80% of validity?
 	validity := notAfter.Sub(notBefore)
 	at80Percent := notAfter.Add(-validity / 5)