Skip to content
This repository was archived by the owner on Jul 11, 2023. It is now read-only.

Support for root certificate rotation via CLI #5207

Merged
merged 6 commits into from
Nov 22, 2022

Conversation

jsturtevant
Copy link
Contributor

@jsturtevant jsturtevant commented Oct 17, 2022

Description:
This build on #5201 (required before this) to provide alpha support for rotation in the CLI. This is a proposal for adding a command to ease the burden of managing the MRCs and adds several tests for trust domain and switching between providers.

example usage would be:

./bin/osm alpha certificate rotate -d -y

Resolves #4835

Testing done:

Affected area:

Functional Area
New Functionality [ ]
CI System [ ]
CLI Tool [ ]
Certificate Management [ ]
Control Plane [ ]
Demo [ ]
Documentation [ ]
Egress [ ]
Ingress [ ]
Install [ ]
Networking [ ]
Observability [ ]
Performance [ ]
SMI Policy [ ]
Security [ ]
Sidecar Injection [ ]
Tests [ ]
Upgrade [ ]
Other [ ]

Please answer the following questions with yes/no.

  1. Does this change contain code from or inspired by another project?

    • Did you notify the maintainers and provide attribution?
  2. Is this a breaking change?

  3. Has documentation corresponding to this change been updated in the osm-docs repo (if applicable)?

@jsturtevant
Copy link
Contributor Author

This also partially addresses #5207, which was needed to be able to test rotation to vault from other providers.

@jsturtevant jsturtevant force-pushed the cli-rotation branch 5 times, most recently from c87d682 to 045d8cc Compare November 10, 2022 20:49
This command consists of multiple subcommands related that are in alpha.
`

func newAlphaCmd(out io.Writer) *cobra.Command {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we have any other OSM CLI commands that we would characterize as "alpha" or could "preview" just be added in a warning for the command's help and output?

Copy link
Contributor Author

@jsturtevant jsturtevant Nov 14, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good question, I am up for either and easy change to make. I modeled it after kubectl alpha which I like because it is very clear that is experimental when using it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like this approach, but I am curious to see what other maintainers think.

@codecov-commenter
Copy link

codecov-commenter commented Nov 16, 2022

Codecov Report

Merging #5207 (abbcdb2) into main (e9ee46f) will decrease coverage by 0.94%.
The diff coverage is 20.79%.

@@            Coverage Diff             @@
##             main    #5207      +/-   ##
==========================================
- Coverage   70.30%   69.35%   -0.95%     
==========================================
  Files         195      198       +3     
  Lines       15697    15994     +297     
==========================================
+ Hits        11035    11093      +58     
- Misses       4607     4844     +237     
- Partials       55       57       +2     
Flag Coverage Δ
unittests 69.35% <20.79%> (-0.95%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
cmd/cli/certificate_rotate.go 13.81% <13.81%> (ø)
cmd/cli/alpha.go 72.72% <72.72%> (ø)
cmd/cli/certificate.go 100.00% <100.00%> (ø)
cmd/cli/osm.go 81.03% <100.00%> (+0.33%) ⬆️
pkg/certificate/providers/config.go 79.51% <100.00%> (ø)
pkg/certificate/manager.go 87.55% <0.00%> (+0.41%) ⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

Signed-off-by: James Sturtevant <[email protected]>
Signed-off-by: James Sturtevant <[email protected]>
Signed-off-by: James Sturtevant <[email protected]>
Signed-off-by: James Sturtevant <[email protected]>
Signed-off-by: James Sturtevant <[email protected]>
Signed-off-by: James Sturtevant <[email protected]>
@jaellio jaellio merged commit d90ac1c into openservicemesh:main Nov 22, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

OSM CLI command support for automated root cert rotation Create e2e tests for root certificate rotation
5 participants