func (c *Cluster) ensureCert() error {
	e := c.etcd

	// skip sync if not specify auto generate certificate
	if e.Spec.Secure == nil || e.Spec.Secure.TLS == nil || e.Spec.Secure.TLS.AutoTLSCert == nil {
		// TODO: Delete Generated Certificate?
		return nil
	}

	autoTLSConfig := e.Spec.Secure.TLS.AutoTLSCert

	// ensure CA exist
	var caSecret *corev1.Secret
	if len(autoTLSConfig.ExternalCASecret) == 0 {
		defaultCAName := secure.NameForEtcdCertSecret(e.Name, secure.EtcdCACert)
		if existCA, err := c.secretLister.Secrets(e.Namespace).Get(defaultCAName); err != nil && k8serr.IsNotFound(err) {
			newCASecret, err := secure.NewEtcdCASecret(e)
			if err != nil {
				return err
			}
			if newCASecret, err = c.kubeClient.CoreV1().Secrets(newCASecret.Namespace).Create(context.TODO(), newCASecret, metav1.CreateOptions{}); err != nil {
				return err
			}
			c.recorder.Event(e, corev1.EventTypeNormal, "CACertCreated", "CA certificate secret has been created for etcdcluster")
			caSecret = newCASecret
		} else if err != nil {
			return err
		} else {
			caSecret = existCA
		}
	} else {
		existCA, err := c.secretLister.Secrets(e.Namespace).Get(autoTLSConfig.ExternalCASecret)
		if err != nil {
			c.recorder.Eventf(e, corev1.EventTypeWarning, "EnsureExternalCASecretFailed", "get external ca secret failed: %v", err)
			return err
		}
		caSecret = existCA
	}

	// TODO: update certificate

	for t, create := range map[secure.EtcdCertType]bool{
		secure.EtcdPeerCert:   autoTLSConfig.AutoGeneratePeerCert,
		secure.EtcdServerCert: autoTLSConfig.AutoGenerateServerCert,
		secure.EtcdClientCert: autoTLSConfig.AutoGenerateClientCert,
	} {
		if !create {
			continue
		}
		certName := secure.NameForEtcdCertSecret(e.Name, t)
		if _, err := c.secretLister.Secrets(e.Namespace).Get(certName); err != nil && k8serr.IsNotFound(err) {
			certSecret, err := secure.NewEtcdCertSecret(e, caSecret, t)
			if err != nil {
				return err
			}
			if _, err = c.kubeClient.CoreV1().Secrets(certSecret.Namespace).Create(context.TODO(), certSecret, metav1.CreateOptions{}); err != nil {
				return err
			}
			c.recorder.Eventf(e, corev1.EventTypeNormal, "CertCreated", "%s certificate secret has been created for etcdcluster", t)
		} else if err != nil {
			return err
		}
	}

	return nil
}
// ensureCert ensure the certificate which a secure etcd cluster need existed, if not specify an existed cert,
// it will generate a self-signed CA, and using this CA to generate the server cert, peer cert, and the client cert
ensureCert ensure the certificate which a secure etcd cluster need existed, if not specify an existed cert,
it will generate a self-signed CA, and using this CA to generate the server cert, peer cert, and the client cert
// ensureCert ensure the certificate which a secure etcd cluster need existed if not specify an existed cert // it will generate a self - signed CA and using this CA to generate the server cert peer cert and the client cert
func (c *Cluster) ensureCert() error {
	e := c.etcd
	if e.Spec.Secure == nil || e.Spec.Secure.TLS == nil || e.Spec.Secure.TLS.AutoTLSCert == nil {
		return nil
	}
	autoTLSConfig := e.Spec.Secure.TLS.AutoTLSCert
	var caSecret *corev1.Secret
	if len(autoTLSConfig.ExternalCASecret) == 0 {
		defaultCAName := secure.NameForEtcdCertSecret(e.Name, secure.EtcdCACert)
		if existCA, err := c.secretLister.Secrets(e.Namespace).Get(defaultCAName); err != nil && k8serr.IsNotFound(err) {
			newCASecret, err := secure.NewEtcdCASecret(e)
			if err != nil {
				return err
			}
			if newCASecret, err = c.kubeClient.CoreV1().Secrets(newCASecret.Namespace).Create(context.TODO(), newCASecret, metav1.CreateOptions{}); err != nil {
				return err
			}
			c.recorder.Event(e, corev1.EventTypeNormal, "CACertCreated", "CA certificate secret has been created for etcdcluster")
			caSecret = newCASecret
		} else if err != nil {
			return err
		} else {
			caSecret = existCA
		}
	} else {
		existCA, err := c.secretLister.Secrets(e.Namespace).Get(autoTLSConfig.ExternalCASecret)
		if err != nil {
			c.recorder.Eventf(e, corev1.EventTypeWarning, "EnsureExternalCASecretFailed", "get external ca secret failed: %v", err)
			return err
		}
		caSecret = existCA
	}
	for t, create := range map[secure.EtcdCertType]bool{
		secure.EtcdPeerCert:   autoTLSConfig.AutoGeneratePeerCert,
		secure.EtcdServerCert: autoTLSConfig.AutoGenerateServerCert,
		secure.EtcdClientCert: autoTLSConfig.AutoGenerateClientCert,
	} {
		if !create {
			continue
		}
		certName := secure.NameForEtcdCertSecret(e.Name, t)
		if _, err := c.secretLister.Secrets(e.Namespace).Get(certName); err != nil && k8serr.IsNotFound(err) {
			certSecret, err := secure.NewEtcdCertSecret(e, caSecret, t)
			if err != nil {
				return err
			}
			if _, err = c.kubeClient.CoreV1().Secrets(certSecret.Namespace).Create(context.TODO(), certSecret, metav1.CreateOptions{}); err != nil {
				return err
			}
			c.recorder.Eventf(e, corev1.EventTypeNormal, "CertCreated", "%s certificate secret has been created for etcdcluster", t)
		} else if err != nil {
			return err
		}
	}
	return nil
}
func ( c * Cluster ) ensureCert ( ) error { e := c . etcd if e . Spec . Secure == nil || e . Spec . Secure . TLS == nil || e . Spec . Secure . TLS . AutoTLSCert == nil { return nil } autoTLSConfig := e . Spec . Secure . TLS . AutoTLSCert var caSecret * corev1 . Secret if len ( autoTLSConfig . ExternalCASecret ) == 0 { defaultCAName := secure . NameForEtcdCertSecret ( e . Name , secure . EtcdCACert ) if existCA , err := c . secretLister . Secrets ( e . Namespace ) . Get ( defaultCAName ) ; err != nil && k8serr . IsNotFound ( err ) { newCASecret , err := secure . NewEtcdCASecret ( e ) if err != nil { return err } if newCASecret , err = c . kubeClient . CoreV1 ( ) . Secrets ( newCASecret . Namespace ) . Create ( context . TODO ( ) , newCASecret , metav1 . CreateOptions { } ) ; err != nil { return err } c . recorder . Event ( e , corev1 . EventTypeNormal , " " , " " ) caSecret = newCASecret } else if err != nil { return err } else { caSecret = existCA } } else { existCA , err := c . secretLister . Secrets ( e . Namespace ) . Get ( autoTLSConfig . ExternalCASecret ) if err != nil { c . recorder . Eventf ( e , corev1 . EventTypeWarning , " " , " " , err ) return err } caSecret = existCA } for t , create := range map [ secure . EtcdCertType ] bool { secure . EtcdPeerCert : autoTLSConfig . AutoGeneratePeerCert , secure . EtcdServerCert : autoTLSConfig . AutoGenerateServerCert , secure . EtcdClientCert : autoTLSConfig . AutoGenerateClientCert , } { if ! create { continue } certName := secure . NameForEtcdCertSecret ( e . Name , t ) if _ , err := c . secretLister . Secrets ( e . Namespace ) . Get ( certName ) ; err != nil && k8serr . IsNotFound ( err ) { certSecret , err := secure . NewEtcdCertSecret ( e , caSecret , t ) if err != nil { return err } if _ , err = c . kubeClient . CoreV1 ( ) . Secrets ( certSecret . Namespace ) . Create ( context . TODO ( ) , certSecret , metav1 . CreateOptions { } ) ; err != nil { return err } c . recorder . Eventf ( e , corev1 . EventTypeNormal , " " , " " , t ) } else if err != nil { return err } } return nil }
ensureCert ensure the certificate which a secure etcd cluster need existed, if not specify an existed cert,
it will generate a self-signed CA, and using this CA to generate the server cert, peer cert, and the client cert
ensureCert ensure the certificate which a secure etcd cluster need existed if not specify an existed cert it will generate a self - signed CA and using this CA to generate the server cert peer cert and the client cert
// skip sync if not specify auto generate certificate // TODO: Delete Generated Certificate? // ensure CA exist // TODO: update certificate