func NewManager(cfg *kubeadmapi.ClusterConfiguration, kubernetesDir string) (*Manager, error) {
	rm := &Manager{
		cfg:           cfg,
		kubernetesDir: kubernetesDir,
		certificates:  map[string]*CertificateRenewHandler{},
		cas:           map[string]*CAExpirationHandler{},
	}

	// gets the list of certificates that are expected according to the current cluster configuration
	certListFunc := certsphase.GetDefaultCertList
	if cfg.Etcd.External != nil {
		certListFunc = certsphase.GetCertsWithoutEtcd
	}
	certTree, err := certListFunc().AsMap().CertTree()
	if err != nil {
		return nil, err
	}

	// create a CertificateRenewHandler for each signed certificate in the certificate tree;
	// NB. we are not offering support for renewing CAs; this would cause serious consequences
	for ca, certs := range certTree {
		for _, cert := range certs {
			// create a ReadWriter for certificates stored in the K8s local PKI
			pkiReadWriter := newPKICertificateReadWriter(rm.cfg.CertificatesDir, cert.BaseName)

			// adds the certificateRenewHandler.
			// PKI certificates are indexed by name, that is a well know constant defined
			// in the certsphase package and that can be reused across all the kubeadm codebase
			rm.certificates[cert.Name] = &CertificateRenewHandler{
				Name:       cert.Name,
				LongName:   cert.LongName,
				FileName:   cert.BaseName,
				CAName:     ca.Name,
				CABaseName: ca.BaseName, //Nb. this is a path for etcd certs (they are stored in a subfolder)
				readwriter: pkiReadWriter,
			}
		}

		pkiReadWriter := newPKICertificateReadWriter(rm.cfg.CertificatesDir, ca.BaseName)
		rm.cas[ca.Name] = &CAExpirationHandler{
			Name:       ca.Name,
			LongName:   ca.LongName,
			FileName:   ca.BaseName,
			readwriter: pkiReadWriter,
		}
	}

	// gets the list of certificates that should be considered for renewal
	kubeConfigs := []struct {
		longName string
		fileName string
	}{
		{
			longName: "certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself",
			fileName: kubeadmconstants.AdminKubeConfigFileName,
		},
		{
			longName: "certificate embedded in the kubeconfig file for the controller manager to use",
			fileName: kubeadmconstants.ControllerManagerKubeConfigFileName,
		},
		{
			longName: "certificate embedded in the kubeconfig file for the scheduler manager to use",
			fileName: kubeadmconstants.SchedulerKubeConfigFileName,
		},
		//NB. we are excluding KubeletKubeConfig from renewal because management of this certificate is delegated to kubelet
	}

	// create a CertificateRenewHandler for each kubeConfig file
	for _, kubeConfig := range kubeConfigs {
		// create a ReadWriter for certificates embedded in kubeConfig files
		kubeConfigReadWriter := newKubeconfigReadWriter(kubernetesDir, kubeConfig.fileName,
			rm.cfg.CertificatesDir, kubeadmconstants.CACertAndKeyBaseName)

		// adds the certificateRenewHandler.
		// Certificates embedded kubeConfig files in are indexed by fileName, that is a well know constant defined
		// in the kubeadm constants package and that can be reused across all the kubeadm codebase
		rm.certificates[kubeConfig.fileName] = &CertificateRenewHandler{
			Name:       kubeConfig.fileName, // we are using fileName as name, because there is nothing similar outside
			LongName:   kubeConfig.longName,
			FileName:   kubeConfig.fileName,
			CABaseName: kubeadmconstants.CACertAndKeyBaseName, // all certificates in kubeConfig files are signed by the Kubernetes CA
			readwriter: kubeConfigReadWriter,
		}
	}

	return rm, nil
}
// NewManager return a new certificate renewal manager ready for handling certificates in the cluster
NewManager return a new certificate renewal manager ready for handling certificates in the cluster
// NewManager return a new certificate renewal manager ready for handling certificates in the cluster
func NewManager(cfg *kubeadmapi.ClusterConfiguration, kubernetesDir string) (*Manager, error) {
	rm := &Manager{
		cfg:           cfg,
		kubernetesDir: kubernetesDir,
		certificates:  map[string]*CertificateRenewHandler{},
		cas:           map[string]*CAExpirationHandler{},
	}
	certListFunc := certsphase.GetDefaultCertList
	if cfg.Etcd.External != nil {
		certListFunc = certsphase.GetCertsWithoutEtcd
	}
	certTree, err := certListFunc().AsMap().CertTree()
	if err != nil {
		return nil, err
	}
	for ca, certs := range certTree {
		for _, cert := range certs {
			pkiReadWriter := newPKICertificateReadWriter(rm.cfg.CertificatesDir, cert.BaseName)
			rm.certificates[cert.Name] = &CertificateRenewHandler{
				Name:       cert.Name,
				LongName:   cert.LongName,
				FileName:   cert.BaseName,
				CAName:     ca.Name,
				CABaseName: ca.BaseName, 
				readwriter: pkiReadWriter,
			}
		}
		pkiReadWriter := newPKICertificateReadWriter(rm.cfg.CertificatesDir, ca.BaseName)
		rm.cas[ca.Name] = &CAExpirationHandler{
			Name:       ca.Name,
			LongName:   ca.LongName,
			FileName:   ca.BaseName,
			readwriter: pkiReadWriter,
		}
	}
	kubeConfigs := []struct {
		longName string
		fileName string
	}{
		{
			longName: "certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself",
			fileName: kubeadmconstants.AdminKubeConfigFileName,
		},
		{
			longName: "certificate embedded in the kubeconfig file for the controller manager to use",
			fileName: kubeadmconstants.ControllerManagerKubeConfigFileName,
		},
		{
			longName: "certificate embedded in the kubeconfig file for the scheduler manager to use",
			fileName: kubeadmconstants.SchedulerKubeConfigFileName,
		},
	}
	for _, kubeConfig := range kubeConfigs {
		kubeConfigReadWriter := newKubeconfigReadWriter(kubernetesDir, kubeConfig.fileName,
			rm.cfg.CertificatesDir, kubeadmconstants.CACertAndKeyBaseName)
		rm.certificates[kubeConfig.fileName] = &CertificateRenewHandler{
			Name:       kubeConfig.fileName, 
			LongName:   kubeConfig.longName,
			FileName:   kubeConfig.fileName,
			CABaseName: kubeadmconstants.CACertAndKeyBaseName, 
			readwriter: kubeConfigReadWriter,
		}
	}
	return rm, nil
}
func NewManager ( cfg * kubeadmapi . ClusterConfiguration , kubernetesDir string ) ( * Manager , error ) { rm := & Manager { cfg : cfg , kubernetesDir : kubernetesDir , certificates : map [ string ] * CertificateRenewHandler { } , cas : map [ string ] * CAExpirationHandler { } , } certListFunc := certsphase . GetDefaultCertList if cfg . Etcd . External != nil { certListFunc = certsphase . GetCertsWithoutEtcd } certTree , err := certListFunc ( ) . AsMap ( ) . CertTree ( ) if err != nil { return nil , err } for ca , certs := range certTree { for _ , cert := range certs { pkiReadWriter := newPKICertificateReadWriter ( rm . cfg . CertificatesDir , cert . BaseName ) rm . certificates [ cert . Name ] = & CertificateRenewHandler { Name : cert . Name , LongName : cert . LongName , FileName : cert . BaseName , CAName : ca . Name , CABaseName : ca . BaseName , readwriter : pkiReadWriter , } } pkiReadWriter := newPKICertificateReadWriter ( rm . cfg . CertificatesDir , ca . BaseName ) rm . cas [ ca . Name ] = & CAExpirationHandler { Name : ca . Name , LongName : ca . LongName , FileName : ca . BaseName , readwriter : pkiReadWriter , } } kubeConfigs := [ ] struct { longName string fileName string } { { longName : " " , fileName : kubeadmconstants . AdminKubeConfigFileName , } , { longName : " " , fileName : kubeadmconstants . ControllerManagerKubeConfigFileName , } , { longName : " " , fileName : kubeadmconstants . SchedulerKubeConfigFileName , } , } for _ , kubeConfig := range kubeConfigs { kubeConfigReadWriter := newKubeconfigReadWriter ( kubernetesDir , kubeConfig . fileName , rm . cfg . CertificatesDir , kubeadmconstants . CACertAndKeyBaseName ) rm . certificates [ kubeConfig . fileName ] = & CertificateRenewHandler { Name : kubeConfig . fileName , LongName : kubeConfig . longName , FileName : kubeConfig . fileName , CABaseName : kubeadmconstants . CACertAndKeyBaseName , readwriter : kubeConfigReadWriter , } } return rm , nil }
NewManager return a new certificate renewal manager ready for handling certificates in the cluster
NewManager return a new certificate renewal manager ready for handling certificates in the cluster
// gets the list of certificates that are expected according to the current cluster configuration // create a CertificateRenewHandler for each signed certificate in the certificate tree; // NB. we are not offering support for renewing CAs; this would cause serious consequences // create a ReadWriter for certificates stored in the K8s local PKI // adds the certificateRenewHandler. // PKI certificates are indexed by name, that is a well know constant defined // in the certsphase package and that can be reused across all the kubeadm codebase //Nb. this is a path for etcd certs (they are stored in a subfolder) // gets the list of certificates that should be considered for renewal //NB. we are excluding KubeletKubeConfig from renewal because management of this certificate is delegated to kubelet // create a CertificateRenewHandler for each kubeConfig file // create a ReadWriter for certificates embedded in kubeConfig files // adds the certificateRenewHandler. // Certificates embedded kubeConfig files in are indexed by fileName, that is a well know constant defined // in the kubeadm constants package and that can be reused across all the kubeadm codebase // we are using fileName as name, because there is nothing similar outside // all certificates in kubeConfig files are signed by the Kubernetes CA