// renewCertsByComponent takes charge of renewing certificates used by a specific component before
// the static pod of the component is upgraded
971232
func renewCertsByComponent(cfg *kubeadmapi.InitConfiguration, component string) error {
	// if the cluster is using a local etcd
	if cfg.Etcd.Local != nil {
		if component == constants.Etcd || component == constants.KubeAPIServer {
			// try to load the etcd CA
			caCert, caKey, err := certsphase.LoadCertificateAuthority(cfg.CertificatesDir, certsphase.KubeadmCertEtcdCA.BaseName)
			if err != nil {
				return errors.Wrapf(err, "failed to upgrade the %s CA certificate and key", constants.Etcd)
			}
			// create a renewer for certificates signed by etcd CA
			renewer := renewal.NewFileRenewal(caCert, caKey)
			// then, if upgrading the etcd component, renew all the certificates signed by etcd CA and used
			// by etcd itself (the etcd-server, the etcd-peer and the etcd-healthcheck-client certificate)
			if component == constants.Etcd {
				for _, cert := range []*certsphase.KubeadmCert{
					&certsphase.KubeadmCertEtcdServer,
					&certsphase.KubeadmCertEtcdPeer,
					&certsphase.KubeadmCertEtcdHealthcheck,
				} {
					fmt.Printf("[upgrade/staticpods] Renewing %q certificate\n", cert.BaseName)
					if err := renewal.RenewExistingCert(cfg.CertificatesDir, cert.BaseName, renewer); err != nil {
						return errors.Wrapf(err, "failed to renew %s certificates", cert.Name)
					}
				}
			}
			// if upgrading the apiserver component, renew the certificate signed by etcd CA and used
			// by the apiserver (the apiserver-etcd-client certificate)
			if component == constants.KubeAPIServer {
				cert := certsphase.KubeadmCertEtcdAPIClient
				fmt.Printf("[upgrade/staticpods] Renewing %q certificate\n", cert.BaseName)
				if err := renewal.RenewExistingCert(cfg.CertificatesDir, cert.BaseName, renewer); err != nil {
					return errors.Wrapf(err, "failed to renew %s certificate and key", cert.Name)
				}
			}
		}
	}
	if component == constants.KubeAPIServer {
		// Checks if an external CA is provided by the user (when the CA Cert is present but the CA Key is not)
		// if not, then CA is managed by kubeadm, so it is possible to renew all the certificates signed by ca
		// and used the apis server (the apiserver certificate and the apiserver-kubelet-client certificate)
		externalCA, _ := certsphase.UsingExternalCA(&cfg.ClusterConfiguration)
		if !externalCA {
			// try to load ca
			caCert, caKey, err := certsphase.LoadCertificateAuthority(cfg.CertificatesDir, certsphase.KubeadmCertRootCA.BaseName)
			if err != nil {
				return errors.Wrapf(err, "failed to upgrade the %s certificates", constants.KubeAPIServer)
			}
			// create a renewer for certificates signed by CA
			renewer := renewal.NewFileRenewal(caCert, caKey)
			// renew the certificates
			for _, cert := range []*certsphase.KubeadmCert{
				&certsphase.KubeadmCertAPIServer,
				&certsphase.KubeadmCertKubeletClient,
			} {
				fmt.Printf("[upgrade/staticpods] Renewing %q certificate\n", cert.BaseName)
				if err := renewal.RenewExistingCert(cfg.CertificatesDir, cert.BaseName, renewer); err != nil {
					return errors.Wrapf(err, "failed to renew %s certificate and key", cert.Name)
				}
			}
		}

		// Checks if an external Front-Proxy CA is provided by the user (when the Front-Proxy CA Cert is present but the Front-Proxy CA Key is not)
		// if not, then Front-Proxy CA is managed by kubeadm, so it is possible to renew all the certificates signed by ca
		// and used the apis server (the front-proxy-client certificate)
		externalFrontProxyCA, _ := certsphase.UsingExternalFrontProxyCA(&cfg.ClusterConfiguration)
		if !externalFrontProxyCA {
			// try to load front-proxy-ca
			caCert, caKey, err := certsphase.LoadCertificateAuthority(cfg.CertificatesDir, certsphase.KubeadmCertFrontProxyCA.BaseName)
			if err != nil {
				return errors.Wrapf(err, "failed to upgrade the %s certificates", constants.KubeAPIServer)
			}
			// create a renewer for certificates signed by Front-Proxy CA
			renewer := renewal.NewFileRenewal(caCert, caKey)
			// renew the certificates
			cert := certsphase.KubeadmCertFrontProxyClient
			fmt.Printf("[upgrade/staticpods] Renewing %q certificate\n", cert.BaseName)
			if err := renewal.RenewExistingCert(cfg.CertificatesDir, cert.BaseName, renewer); err != nil {
				return errors.Wrapf(err, "failed to renew %s certificate and key", cert.Name)
			}
		}
	}
	return nil
}
222849
func (s *CertificateDetail) SetRenewalEligibility(v string) *CertificateDetail {
	s.RenewalEligibility = &v
	return s
}
456669
func (d *Accessor) GetUnexpiredCertificates() (crs []certdb.CertificateRecord, err error) {
	err = d.checkDB()
	if err != nil {
		return nil, err
	}

	err = d.db.Select(&crs, fmt.Sprintf(d.db.Rebind(selectAllUnexpiredSQL), sqlstruct.Columns(certdb.CertificateRecord{})))
	if err != nil {
		return nil, wrapSQLError(err)
	}

	return crs, nil
}
1222517
func (r ComponentReferences) TemplateComponentRefs() (refs ComponentReferences) {
	return r.filter(func(ref ComponentReference) bool {
		return ref.Input() != nil && ref.Input().ResolvedMatch != nil && ref.Input().ResolvedMatch.IsTemplate()
	})
}
926331
func (db *DB) GetCertByID(certID int64) (*certificate.Certificate, error) {
	row := db.QueryRow(`SELECT `+strings.Join(allCertificateColumns, ", ")+`
		FROM certificates WHERE id=$1`, certID)
	cert, err := db.scanCert(row)
	return &cert, err

}
997898
func (s *Session) Renew(args *structs.SessionSpecificRequest,
	reply *structs.IndexedSessions) error {
	if done, err := s.srv.forward("Session.Renew", args, args, reply); done {
		return err
	}
	defer metrics.MeasureSince([]string{"session", "renew"}, time.Now())

	// Get the session, from local state.
	state := s.srv.fsm.State()
	index, session, err := state.SessionGet(nil, args.Session)
	if err != nil {
		return err
	}

	reply.Index = index
	if session == nil {
		return nil
	}

	// Fetch the ACL token, if any, and apply the policy.
	rule, err := s.srv.ResolveToken(args.Token)
	if err != nil {
		return err
	}
	if rule != nil && s.srv.config.ACLEnforceVersion8 {
		if !rule.SessionWrite(session.Node) {
			return acl.ErrPermissionDenied
		}
	}

	// Reset the session TTL timer.
	reply.Sessions = structs.Sessions{session}
	if err := s.srv.resetSessionTimer(args.Session, session); err != nil {
		s.srv.logger.Printf("[ERR] consul.session: Session renew failed: %v", err)
		return err
	}

	return nil
}
954042
func (a *Account) CreateComponent(typ, id string) error {
	p, err := plural(typ)
	if err != nil {
		return err
	}

	body := createComponentReq{
		ID: id,
	}
	return a.post(a.auth, fmt.Sprintf("/api/v2/components/%s", p), body, nil)
}
502273
func Convert_core_ComponentStatus_To_v1_ComponentStatus(in *core.ComponentStatus, out *v1.ComponentStatus, s conversion.Scope) error {
	return autoConvert_core_ComponentStatus_To_v1_ComponentStatus(in, out, s)
}
165214
func (lca *CA) CACertificate() ([]byte, error) {
	if lca.s == nil {
		return nil, errNotSetup
	}

	cert, err := lca.s.Certificate(lca.Label, lca.Profile)
	if err != nil {
		return nil, err
	}

	p := &pem.Block{
		Type:  "CERTIFICATE",
		Bytes: cert.Raw,
	}
	return pem.EncodeToMemory(p), nil
}
357583
func NewComponentExtraArgs(opts util.ExtraOptionSlice, version semver.Version, featureGates string) ([]ComponentExtraArgs, error) {
	var kubeadmExtraArgs []ComponentExtraArgs
	for _, extraOpt := range opts {
		if _, ok := componentToKubeadmConfigKey[extraOpt.Component]; !ok {
			return nil, fmt.Errorf("Unknown component %s.  Valid components and kubeadm config are %v", componentToKubeadmConfigKey, componentToKubeadmConfigKey)
		}
	}

	keys := []string{}
	for k := range componentToKubeadmConfigKey {
		keys = append(keys, k)
	}
	sort.Strings(keys)

	for _, component := range keys {
		kubeadmComponentKey := componentToKubeadmConfigKey[component]
		if kubeadmComponentKey == "" {
			continue
		}
		extraConfig, err := ExtraConfigForComponent(component, opts, version)
		if err != nil {
			return nil, errors.Wrapf(err, "getting kubeadm extra args for %s", component)
		}
		if featureGates != "" {
			extraConfig["feature-gates"] = featureGates
		}
		if len(extraConfig) > 0 {
			kubeadmExtraArgs = append(kubeadmExtraArgs, ComponentExtraArgs{
				Component: kubeadmComponentKey,
				Options:   extraConfig,
			})
		}
	}

	return kubeadmExtraArgs, nil
}
351068
func ExtraConfigForComponent(component string, opts util.ExtraOptionSlice, version semver.Version) (map[string]string, error) {
	versionedOpts, err := DefaultOptionsForComponentAndVersion(component, version)
	if err != nil {
		return nil, errors.Wrapf(err, "setting version specific options for %s", component)
	}

	for _, opt := range opts {
		if opt.Component == component {
			if val, ok := versionedOpts[opt.Key]; ok {
				glog.Infof("Overwriting default %s=%s with user provided %s=%s for component %s", opt.Key, val, opt.Key, opt.Value, component)
			}
			versionedOpts[opt.Key] = opt.Value
		}
	}

	return versionedOpts, nil
}
660130
func generatePathComponents(prefix, name string) ds.PropertySlice {
	ps, ns := types.StreamName(prefix).Segments(), types.StreamName(name).Segments()

	// Allocate our components array. For each component, there are two entries
	// (forward and reverse), as well as one count entry per component type.
	c := make(ds.PropertySlice, 0, (len(ps)+len(ns)+1)*2)

	gen := func(b string, segs []string) {
		// Generate count component (PC:4).
		c = append(c, ds.MkProperty(fmt.Sprintf("%sC:%d", b, len(segs))))

		// Generate forward and reverse components.
		for i, s := range segs {
			c = append(c,
				// Forward (PF:0:foo).
				ds.MkProperty(fmt.Sprintf("%sF:%d:%s", b, i, s)),
				// Reverse (PR:3:foo)
				ds.MkProperty(fmt.Sprintf("%sR:%d:%s", b, len(segs)-i-1, s)),
			)
		}
	}
	gen("P", ps)
	gen("N", ns)
	return c
}
1056449
func VerifyCertificate(cert *x509.Certificate) (revoked, ok bool) {
	revoked, ok, _ = VerifyCertificateError(cert)
	return revoked, ok
}
643185
func (c *Client) Renew(acknowledgement dhcp4.Packet) (bool, dhcp4.Packet, error) {
	renewRequest := c.RenewalRequestPacket(&acknowledgement)
	renewRequest.PadToMinSize()

	err := c.SendPacket(renewRequest)
	if err != nil {
		return false, renewRequest, err
	}

	newAcknowledgement, err := c.GetAcknowledgement(&renewRequest)
	if err != nil {
		return false, newAcknowledgement, err
	}

	newAcknowledgementOptions := newAcknowledgement.ParseOptions()
	if dhcp4.MessageType(newAcknowledgementOptions[dhcp4.OptionDHCPMessageType][0]) != dhcp4.ACK {
		return false, newAcknowledgement, nil
	}

	return true, newAcknowledgement, nil
}
848225
func (kv *consulKV) renewSession(
	pair *api.KVPair,
	ttl uint64,
	noCreate bool,
) (string, error) {
	// Check if there is any previous session with an active TTL
	session, err := kv.getActiveSession(pair.Key)
	if err != nil {
		logrus.Infof("Failed to find session: %v", err)
		return "", err
	}

	if session != "" {
		if noCreate {
			// Do not create new session for the key
			return "", kvdb.ErrModified
		}
		// Destroy the existing session associated with the key
		kv.client.Destroy(session, nil)
	}

	durationTTL := time.Duration(int64(ttl)) * time.Second

	entry := &api.SessionEntry{
		Behavior:  api.SessionBehaviorDelete, // Delete the key when the session expires
		TTL:       durationTTL.String(),
		LockDelay: 0, // Virtually disable lock delay
	}

	// Create the key session
	session, _, err = kv.client.Create(entry, nil)

	// Session timer is started after a call to "Renew"
	kv.client.Renew(session, nil)

	return session, err
}
455749
func sysctlByComponents(components []string, value string) (string, error) {
	components = append([]string{sysctlPath}, components...)
	f, err := os.OpenFile(path.Join(components...), os.O_RDWR, 0)
	if err != nil {
		return "", err
	}
	defer f.Close()
	b, err := ioutil.ReadAll(f)
	if err != nil {
		return "", err
	}
	if _, err := f.Seek(0, 0); err != nil {
		return "", err
	}
	if _, err := fmt.Fprintf(f, "%s\n", value); err != nil {
		return "", err
	}
	return strings.TrimRight(string(b), "\n"), nil
}
605054
func Convert_kubeadm_ControlPlaneComponent_To_v1beta1_ControlPlaneComponent(in *kubeadm.ControlPlaneComponent, out *ControlPlaneComponent, s conversion.Scope) error {
	return autoConvert_kubeadm_ControlPlaneComponent_To_v1beta1_ControlPlaneComponent(in, out, s)
}