Skip to content

ROX-26719: Repository for Secured Cluster certificates#13023

Merged
vladbologa merged 6 commits intomasterfrom
vb/secured-cluster-cert-repo
Oct 24, 2024
Merged

ROX-26719: Repository for Secured Cluster certificates#13023
vladbologa merged 6 commits intomasterfrom
vb/secured-cluster-cert-repo

Conversation

@vladbologa
Copy link
Contributor

@vladbologa vladbologa commented Oct 16, 2024

Description

Follow-up of #12825

Why this change is needed

#12740 introduced a new gRPC endpoint to retrieve secured cluster certificates. What I'm trying to achieve with the current set of Sensor PRs is to reuse the old Sensor mechanism to refresh local certificates, so that it can retrieve and refresh full secured cluster certificates, while keeping the previous functionality intact.

It's important to note that both mechanisms will exist in parallel (for a while), because Sensor needs to be compatible with old versions of Centrals that don't have the new IssueSecuredClusterCertsRequest API. There will be a new SensorComponent that uses the IssueSecuredClusterCertsRequest API, and my intention is to reuse as much code between them as possible, without changing the behaviour of the existing component (that only refreshes local scanner certs).

What this change does

This PR is partly a prefactor that doesn't change any existing functionality at all.

It adds the securedcluster.NewServiceCertificatesRepo function (similar to localscanner.NewServiceCertificatesRepo) that creates a certificate repo to store and retrieve Secured Cluster certificates. It uses a new naming scheme for the certificates, so that it does not conflict with the legacy certificates.

After this PR is merged, two different functions will exist:

  • localscanner.NewServiceCertificatesRepo (the one that was already there)
  • securedcluster.NewServiceCertificatesRepo (the new one that isn't used yet)

It also moves the FetchSensorDeploymentOwnerRef function from the localscanner package and exports it, because it is useful for calling NewServiceCertificatesRepo (which requires an owner reference parameter).

To create secured clusters secrets from a *storage.TypedServiceCertificateSet, you'd have to:

  • obtain the sensor owner reference with certrefresh.FetchSensorDeploymentOwnerRef
  • create a new certificate repository with securedcluster.NewServiceCertificatesRepo
  • call certrepo.EnsureServiceCertificates to store the certificates as secrets

New certificate naming scheme

securedcluster.NewServiceCertificatesRepo stores certificates with a new naming scheme, but currently there is no code that creates these new certificates, nor loads them. Loading will be handled by https://issues.redhat.com/browse/ROX-26055

Either way the old certificates are still there (e.g. the init bundle certificates + the local scanner ones) and will be used as before.

User-facing documentation

  • CHANGELOG is updated OR update is not needed
  • documentation PR is created and is linked above OR is not needed

Testing and quality

  • the change is production ready: the change is GA or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

Added tests for FetchSensorDeploymentOwnerRef, which already existed but didn't have coverage.
Added test for securedcluster.NewServiceCertificatesRepo

Tested manually on a local deployment that the certs are fetched and stored. (needs additional code that is not part of this PR)

@vladbologa vladbologa requested a review from a team as a code owner October 16, 2024 09:20
@vladbologa vladbologa requested a review from mclasmeier October 16, 2024 09:24
@rhacs-bot
Copy link
Contributor

rhacs-bot commented Oct 16, 2024

Images are ready for the commit at 18c4edb.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.6.x-813-g18c4edbc8e.

@codecov
Copy link

codecov bot commented Oct 16, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 48.32%. Comparing base (a47cf20) to head (18c4edb).
Report is 10 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #13023      +/-   ##
==========================================
+ Coverage   48.29%   48.32%   +0.02%     
==========================================
  Files        2455     2457       +2     
  Lines      176836   176855      +19     
==========================================
+ Hits        85408    85459      +51     
+ Misses      84556    84530      -26     
+ Partials     6872     6866       -6     
Flag Coverage Δ
go-unit-tests 48.32% <100.00%> (+0.02%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@vladbologa vladbologa force-pushed the vb/secured-cluster-cert-repo branch 2 times, most recently from 5126995 to fc8cf84 Compare October 16, 2024 14:54
@vladbologa vladbologa force-pushed the vb/secured-cluster-cert-repo branch 2 times, most recently from 9798dcb to f70d284 Compare October 17, 2024 14:47
Copy link
Contributor

@vikin91 vikin91 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review summary

The change looks good, but I would love to see those tests and test helpers organized differently - changing that would be sufficient to make it mergable for me.

PR description

However, I would like to highlight something else. When looking at that PR (and the other one from the past), I asked myself why are we introducing such changes? I navigated to Jira ticket and it looks like its description does not fit the contents of this PR. I checked the design doc and also found nothing. I am missing here a WHY section and the PR description does not offer it.

  1. "This PR adds the securedcluster.NewServiceCertificatesRepo function" - I think it was already there
  2. "It uses a new naming scheme for the certificates, so that it does not conflict with the legacy certificates" - then the old certs stop being fetchable after merging this? Pleas provide some more on the compatibility part.
  3. "It also moves the FetchSensorDeploymentOwnerRef function from the localscanner package and exports it, because it is useful for calling NewServiceCertificatesRepo (which requires an owner reference parameter)." - that paragraph is clear.

Validation

The paragraph

Tested manually on a local deployment that the certs are fetched and stored. (needs additional code that is not part of this PR)
makes me a bit worried, as the NewServiceCertificatesRepo was already there (even before #12825) so we should not need a new code to make sure that it works. Was the old function unused? How do we make sure that all code paths that used this function are still okay?

@vladbologa
Copy link
Contributor Author

  1. "This PR adds the securedcluster.NewServiceCertificatesRepo function" - I think it was already there
  2. "It uses a new naming scheme for the certificates, so that it does not conflict with the legacy certificates" - then the old certs stop being fetchable after merging this? Pleas provide some more on the compatibility part.

makes me a bit worried, as the NewServiceCertificatesRepo was already there (even before #12825) so we should not need a new code to make sure that it works. Was the old function unused? How do we make sure that all code paths that used this function are still okay?

The securedcluster.NewServiceCertificatesRepo function is new and currently not used. What is already there is called localscanner.NewServiceCertificatesRepo. They will both exist in parallel for a while, I'll explain when I update the PR description - which I agree that it doesn't provide enough information.

@vladbologa vladbologa force-pushed the vb/secured-cluster-cert-repo branch 3 times, most recently from 9e20f7a to 0708ae8 Compare October 22, 2024 08:22
Copy link
Contributor

@vikin91 vikin91 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Vlad, that is a great PR description! Many thanks for making this PR so much better.
I currently do not see any issues with the code, so I think it can be merged like this.

When new code that uses this contribution appears in the future I may look at it again with some additional context, but for now all looks good!

@vladbologa vladbologa changed the title ROX-25948: Repository for Secured Cluster certificates ROX-26719: Repository for Secured Cluster certificates Oct 22, 2024
Copy link
Contributor

@porridge porridge left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! A few nitpicks/questions inline.

@vladbologa vladbologa force-pushed the vb/secured-cluster-cert-repo branch from 0708ae8 to 18c4edb Compare October 23, 2024 13:03
@vladbologa
Copy link
Contributor Author

/retest

@vladbologa vladbologa merged commit b5e3935 into master Oct 24, 2024
@vladbologa vladbologa deleted the vb/secured-cluster-cert-repo branch October 24, 2024 09:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants