Method Run

cert/spec.go:333–380

Run starts monitoring and enforcement of this spec's on disk PKI.

(ctx context.Context)

// Run starts monitoring and enforcement of this spec's on disk PKI.
func (spec *Spec) Run(ctx context.Context) {
	// initialize our run   At this point an observer knows this spec is 'alive' and being enforced.
	SpecExpiresBeforeThreshold.WithLabelValues(spec.Name).Set(float64(spec.Before.Seconds()))

	// cleanup our runtime metrics on the way out so the observer knows we're no longer enforcing.
	defer spec.WipeMetrics()

	err := spec.UpdateIfNeeded()
	if err != nil {
		log.Errorf("spec %s: continuing despite failed initial validation due to %s", spec, err)
	}

	rng := rand.New(rand.NewSource(time.Now().UTC().UnixNano()))
	sleepPeriod := spec.Interval
	if spec.InitialSplay != 0 {
		sleepPeriod = time.Duration(rng.Float64() * float64(spec.InitialSplay.Nanoseconds()))
		log.Infof("spec %s: initial splay will be used.", spec)
	}
	for {
		log.Infof("spec %s: Next check will be in %s", spec, sleepPeriod)
		SpecNextWake.WithLabelValues(spec.Name).Set(float64(time.Now().Add(sleepPeriod).Unix()))

		select {
		case <-time.After(sleepPeriod):
			log.Debugf("spec %s: woke, starting enforcement", spec)

			// fire wake notifications so things like "spec no longer exists on disk" are checked
			// and logged if relevant.
			for _, callback := range spec.WakeCallbacks {
				callback()
			}

			err := spec.UpdateIfNeeded()
			if err != nil {
				log.Errorf("failed processing %s due to %s", spec, err)
			}
			sleepPeriod = spec.Interval
			if spec.IntervalSplay != 0 {
				i := sleepPeriod.Nanoseconds()
				i += int64(rng.Float64() * float64(spec.IntervalSplay.Nanoseconds()))
				sleepPeriod = time.Duration(int64(i))
			}
		case <-ctx.Done():
			log.Debugf("spec %s: stopping monitoring due to %s", spec, ctx.Err())
			return
		}
	}
}