PKI code cleanup

hack/.packages

@@ -182,7 +182,6 @@ k8s.io/kops/upup/pkg/fi/cloudup/terraform
 k8s.io/kops/upup/pkg/fi/cloudup/vsphere
 k8s.io/kops/upup/pkg/fi/cloudup/vspheretasks
 k8s.io/kops/upup/pkg/fi/fitasks
-k8s.io/kops/upup/pkg/fi/k8sapi
 k8s.io/kops/upup/pkg/fi/loader
 k8s.io/kops/upup/pkg/fi/nodeup
 k8s.io/kops/upup/pkg/fi/nodeup/cloudinit

nodeup/pkg/model/kube_apiserver_test.go

@@ -86,10 +86,6 @@ func (k fakeKeyStore) MirrorTo(basedir vfs.Path) error {
 	panic("implement me")
 }
 
-func (k fakeKeyStore) CertificatePool(name string, createIfMissing bool) (*fi.CertificatePool, error) {
-	panic("implement me")
-}
-
 func (k fakeKeyStore) FindCertificatePool(name string) (*fi.CertificatePool, error) {
 	panic("implement me")
 }

upup/pkg/fi/ca.go

@@ -73,10 +73,6 @@ type HasVFSPath interface {
 type CAStore interface {
 	Keystore
 
-	// CertificatePool returns all active certificates with the specified id
-	// Deprecated: prefer FindCertificatePool
-	CertificatePool(name string, createIfMissing bool) (*CertificatePool, error)
-
 	// FindCertificatePool returns the named CertificatePool, or (nil,nil) if not found
 	FindCertificatePool(name string) (*CertificatePool, error)
 

upup/pkg/fi/clientset_castore.go

@@ -204,20 +204,6 @@ func FindPrimary(keyset *kops.Keyset) *kops.KeysetItem {
 	return primary
 }
 
-// CertificatePool implements CAStore::CertificatePool
-func (c *ClientsetCAStore) CertificatePool(id string, createIfMissing bool) (*CertificatePool, error) {
-	cert, err := c.FindCertificatePool(id)
-	if err == nil && cert == nil {
-		if !createIfMissing {
-			klog.Warningf("using empty certificate, because running with DryRun")
-			return &CertificatePool{}, err
-		}
-		return nil, fmt.Errorf("cannot find certificate pool %q", id)
-	}
-	return cert, err
-
-}
-
 // FindKeypair implements CAStore::FindKeypair
 func (c *ClientsetCAStore) FindKeypair(name string) (*pki.Certificate, *pki.PrivateKey, KeysetFormat, error) {
 	ctx := context.TODO()
@@ -334,8 +320,7 @@ func (c *ClientsetCAStore) ListSSHCredentials() ([]*kops.SSHCredential, error) {
 	return items, nil
 }
 
-// IssueCert implements CAStore::IssueCert
-func (c *ClientsetCAStore) IssueCert(signer string, name string, serial *big.Int, privateKey *pki.PrivateKey, template *x509.Certificate) (*pki.Certificate, error) {
+func (c *ClientsetCAStore) issueCert(signer string, name string, serial *big.Int, privateKey *pki.PrivateKey, template *x509.Certificate) (*pki.Certificate, error) {
 	ctx := context.TODO()
 
 	klog.Infof("Issuing new certificate: %q", name)
@@ -449,7 +434,7 @@ func (c *ClientsetCAStore) FindPrivateKeyset(name string) (*kops.Keyset, error)
 func (c *ClientsetCAStore) CreateKeypair(signer string, id string, template *x509.Certificate, privateKey *pki.PrivateKey) (*pki.Certificate, error) {
 	serial := c.buildSerial()
 
-	cert, err := c.IssueCert(signer, id, serial, privateKey, template)
+	cert, err := c.issueCert(signer, id, serial, privateKey, template)
 	if err != nil {
 		return nil, err
 	}
@@ -488,8 +473,8 @@ func (c *ClientsetCAStore) addKey(ctx context.Context, name string, keysetType k
 	return nil
 }
 
-// DeleteKeysetItem deletes the specified key from the registry; deleting the whole keyset if it was the last one
-func DeleteKeysetItem(client kopsinternalversion.KeysetInterface, name string, keysetType kops.KeysetType, id string) error {
+// deleteKeysetItem deletes the specified key from the registry; deleting the whole keyset if it was the last one
+func deleteKeysetItem(client kopsinternalversion.KeysetInterface, name string, keysetType kops.KeysetType, id string) error {
 	ctx := context.TODO()
 
 	keyset, err := client.Get(ctx, name, metav1.GetOptions{})
@@ -637,7 +622,7 @@ func (c *ClientsetCAStore) DeleteKeysetItem(item *kops.Keyset, id string) error
 	switch item.Spec.Type {
 	case kops.SecretTypeKeypair:
 		client := c.clientset.Keysets(c.namespace)
-		return DeleteKeysetItem(client, item.Name, kops.SecretTypeKeypair, id)
+		return deleteKeysetItem(client, item.Name, kops.SecretTypeKeypair, id)
 	default:
 		// Primarily because we need to make sure users can recreate them!
 		return fmt.Errorf("deletion of keystore items of type %v not (yet) supported", item.Spec.Type)