From 25adeae9bf6be36feb39384c0a4869f1bf1bacba Mon Sep 17 00:00:00 2001
From: George Angel <george-angel@users.noreply.github.com>
Date: Tue, 14 Aug 2018 16:57:20 +0100
Subject: [PATCH] Etcd cert reload (#49)

* sys: no longer need to restart svc, reloads certs on req

https://github.com/coreos/etcd/commit/4e21f87e3d014d606bb3ba2a89731a7d24806611
---
 cert-fetcher/main.tf              | 37 +++++++++++++++++++++++++++++++
 etcd.tf                           |  9 ++++----
 resources/etcd-member-dropin.conf |  1 -
 3 files changed, 41 insertions(+), 6 deletions(-)
 create mode 100644 cert-fetcher/main.tf

diff --git a/cert-fetcher/main.tf b/cert-fetcher/main.tf
new file mode 100644
index 0000000..5397636
--- /dev/null
+++ b/cert-fetcher/main.tf
@@ -0,0 +1,37 @@
+variable "on_calendar" {}
+
+data "ignition_systemd_unit" "cert-fetch-service" {
+  name = "cert-fetch.service"
+
+  content = <<EOS
+[Unit]
+Description=Fetch new certificates from cfssl server
+[Service]
+Type=oneshot
+ExecStart=/opt/bin/cfssl-new-cert
+[Install]
+WantedBy=multi-user.target
+EOS
+}
+
+data "ignition_systemd_unit" "cert-fetch-timer" {
+  name = "cert-fetch.timer"
+
+  content = <<EOS
+[Unit]
+Description=Fetch new certificates from cfssl server
+[Timer]
+OnCalendar=${var.on_calendar}
+AccuracySec=1s
+RandomizedDelaySec=60min
+[Install]
+WantedBy=timers.target
+EOS
+}
+
+output "systemd_units" {
+  value = [
+    "${data.ignition_systemd_unit.cert-fetch-service.id}",
+    "${data.ignition_systemd_unit.cert-fetch-timer.id}",
+  ]
+}
diff --git a/etcd.tf b/etcd.tf
index e3ea9d2..892f01d 100644
--- a/etcd.tf
+++ b/etcd.tf
@@ -118,11 +118,10 @@ data "ignition_systemd_unit" "etcd-member-dropin" {
   }
 }
 
-module "etcd-member-restarter" {
-  source = "./systemd_service_restarter"
+module "etcd-cert-fetcher" {
+  source = "./cert-fetcher"
 
-  service_name = "etcd-member"
-  on_calendar  = "${var.cfssl_node_renew_timer}"
+  on_calendar = "${var.cfssl_node_renew_timer}"
 }
 
 data "ignition_config" "etcd" {
@@ -150,7 +149,7 @@ data "ignition_config" "etcd" {
         element(data.ignition_systemd_unit.etcd-member-dropin.*.id, count.index),
         element(data.ignition_systemd_unit.etcd-disk-mounter.*.id, count.index),
     ),
-    module.etcd-member-restarter.systemd_units,
+    module.etcd-cert-fetcher.systemd_units,
     var.etcd_additional_systemd_units,
   )}"]
 }
diff --git a/resources/etcd-member-dropin.conf b/resources/etcd-member-dropin.conf
index 07b1c0b..b148942 100644
--- a/resources/etcd-member-dropin.conf
+++ b/resources/etcd-member-dropin.conf
@@ -24,4 +24,3 @@ Environment="RKT_RUN_ARGS=\
   --volume etc-etcd,kind=host,source=/etc/etcd,readOnly=true \
   --mount volume=etc-etcd,target=/etc/etcd"
 ExecStartPre=/usr/bin/mkdir -p /etc/etcd
-ExecStartPre=/opt/bin/cfssl-new-cert