From 61991076c9052b3162a6ce4e5fce5ed7ab5d5fd3 Mon Sep 17 00:00:00 2001 From: Andreas Eriksen Date: Wed, 12 Aug 2020 10:01:06 +0200 Subject: Revert "Revert "record when endpoint certificates have last been requested"" --- .../certificate/EndpointCertificateManager.java | 2 ++ .../EndpointCertificateMetadataSerializer.java | 8 ++++++++ .../certificate/EndpointCertificateManagerTest.java | 12 ++++++------ .../EndpointCertificateMetadataSerializerTest.java | 20 ++++++++++++++------ 4 files changed, 30 insertions(+), 12 deletions(-) (limited to 'controller-server') diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/certificate/EndpointCertificateManager.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/certificate/EndpointCertificateManager.java index 1cf42cf0073..e4ec0b04978 100644 --- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/certificate/EndpointCertificateManager.java +++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/certificate/EndpointCertificateManager.java @@ -95,6 +95,7 @@ public class EndpointCertificateManager { public Optional getEndpointCertificateMetadata(Instance instance, ZoneId zone, Optional instanceSpec) { var t0 = Instant.now(); Optional metadata = getOrProvision(instance, zone, instanceSpec); + metadata.ifPresent(m -> curator.writeEndpointCertificateMetadata(instance.id(), m.withLastRequested(clock.instant().getEpochSecond()))); Duration duration = Duration.between(t0, Instant.now()); if (duration.toSeconds() > 30) log.log(Level.INFO, String.format("Getting endpoint certificate metadata for %s took %d seconds!", instance.id().serializedForm(), duration.toSeconds())); return metadata; @@ -185,6 +186,7 @@ public class EndpointCertificateManager { storedMetaData.keyName(), storedMetaData.certName(), storedMetaData.version(), + Instant.now().getEpochSecond(), providerMetadata.request_id(), providerMetadata.requestedDnsSans(), providerMetadata.issuer()); diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/persistence/EndpointCertificateMetadataSerializer.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/persistence/EndpointCertificateMetadataSerializer.java index 80d8270eaaa..ba882ef7985 100644 --- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/persistence/EndpointCertificateMetadataSerializer.java +++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/persistence/EndpointCertificateMetadataSerializer.java @@ -32,6 +32,7 @@ public class EndpointCertificateMetadataSerializer { private final static String keyNameField = "keyName"; private final static String certNameField = "certName"; private final static String versionField = "version"; + private final static String lastRequestedField = "lastRequested"; private final static String requestIdField = "requestId"; private final static String requestedDnsSansField = "requestedDnsSans"; private final static String issuerField = "issuer"; @@ -42,6 +43,7 @@ public class EndpointCertificateMetadataSerializer { object.setString(keyNameField, metadata.keyName()); object.setString(certNameField, metadata.certName()); object.setLong(versionField, metadata.version()); + object.setLong(lastRequestedField, metadata.lastRequested()); metadata.request_id().ifPresent(id -> object.setString(requestIdField, id)); metadata.requestedDnsSans().ifPresent(sans -> { @@ -69,10 +71,16 @@ public class EndpointCertificateMetadataSerializer { Optional.of(inspector.field(issuerField).asString()) : Optional.empty(); + long lastRequested = inspector.field(lastRequestedField).valid() ? + inspector.field(lastRequestedField).asLong() : + 1597200000L; // Wed Aug 12 02:40:00 UTC 2020 + // Not originally stored, so we default to when field was added + return new EndpointCertificateMetadata( inspector.field(keyNameField).asString(), inspector.field(certNameField).asString(), Math.toIntExact(inspector.field(versionField).asLong()), + lastRequested, request_id, requestedDnsSans, issuer); diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/certificate/EndpointCertificateManagerTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/certificate/EndpointCertificateManagerTest.java index d0e87056821..fe237797641 100644 --- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/certificate/EndpointCertificateManagerTest.java +++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/certificate/EndpointCertificateManagerTest.java @@ -46,7 +46,7 @@ public class EndpointCertificateManagerTest { private final MockCuratorDb mockCuratorDb = new MockCuratorDb(); private final EndpointCertificateMock endpointCertificateMock = new EndpointCertificateMock(); private final InMemoryFlagSource inMemoryFlagSource = new InMemoryFlagSource(); - private final Clock clock = Clock.systemUTC(); + private static final Clock clock = Clock.fixed(Instant.EPOCH, java.time.ZoneId.systemDefault()); private final EndpointCertificateManager endpointCertificateManager = new EndpointCertificateManager(zoneRegistryMock, mockCuratorDb, secretStore, endpointCertificateMock, clock, inMemoryFlagSource); @@ -87,7 +87,7 @@ public class EndpointCertificateManagerTest { .fromKeypair( testKeyPair, new X500Principal("CN=test"), - Instant.now(), Instant.now().plus(5, ChronoUnit.MINUTES), + clock.instant(), clock.instant().plus(5, ChronoUnit.MINUTES), SignatureAlgorithm.SHA256_WITH_ECDSA, X509CertificateBuilder.generateRandomSerialNumber()); for (String san : sans) x509CertificateBuilder = x509CertificateBuilder.addSubjectAlternativeName(san); @@ -129,7 +129,7 @@ public class EndpointCertificateManagerTest { @Test public void reuses_stored_certificate_metadata() { - mockCuratorDb.writeEndpointCertificateMetadata(testInstance.id(), new EndpointCertificateMetadata(testKeyName, testCertName, 7)); + mockCuratorDb.writeEndpointCertificateMetadata(testInstance.id(), new EndpointCertificateMetadata(testKeyName, testCertName, 7, 0)); secretStore.setSecret(testKeyName, KeyUtils.toPem(testKeyPair.getPrivate()), 7); secretStore.setSecret(testCertName, X509CertificateUtils.toPem(testCertificate) + X509CertificateUtils.toPem(testCertificate), 7); Optional endpointCertificateMetadata = endpointCertificateManager.getEndpointCertificateMetadata(testInstance, testZone, Optional.empty()); @@ -148,7 +148,7 @@ public class EndpointCertificateManagerTest { secretStore.setSecret(testKeyName, KeyUtils.toPem(testKeyPair.getPrivate()), 8); secretStore.setSecret(testKeyName, KeyUtils.toPem(testKeyPair.getPrivate()), 9); secretStore.setSecret(testCertName, X509CertificateUtils.toPem(testCertificate) + X509CertificateUtils.toPem(testCertificate), 8); - mockCuratorDb.writeEndpointCertificateMetadata(testInstance.id(), new EndpointCertificateMetadata(testKeyName, testCertName, 7)); + mockCuratorDb.writeEndpointCertificateMetadata(testInstance.id(), new EndpointCertificateMetadata(testKeyName, testCertName, 7, 0)); Optional endpointCertificateMetadata = endpointCertificateManager.getEndpointCertificateMetadata(testInstance, testZone, Optional.empty()); assertTrue(endpointCertificateMetadata.isPresent()); assertEquals(testKeyName, endpointCertificateMetadata.get().keyName()); @@ -158,7 +158,7 @@ public class EndpointCertificateManagerTest { @Test public void reprovisions_certificate_when_necessary() { - mockCuratorDb.writeEndpointCertificateMetadata(testInstance.id(), new EndpointCertificateMetadata(testKeyName, testCertName, -1, Optional.of("uuid"), Optional.of(List.of()), Optional.empty())); + mockCuratorDb.writeEndpointCertificateMetadata(testInstance.id(), new EndpointCertificateMetadata(testKeyName, testCertName, -1, 0, Optional.of("uuid"), Optional.of(List.of()), Optional.empty())); secretStore.setSecret("vespa.tls.default.default.default-key", KeyUtils.toPem(testKeyPair.getPrivate()), 0); secretStore.setSecret("vespa.tls.default.default.default-cert", X509CertificateUtils.toPem(testCertificate) + X509CertificateUtils.toPem(testCertificate), 0); Optional endpointCertificateMetadata = endpointCertificateManager.getEndpointCertificateMetadata(testInstance, testZone, Optional.empty()); @@ -171,7 +171,7 @@ public class EndpointCertificateManagerTest { public void reprovisions_certificate_with_added_sans_when_deploying_to_new_zone() { ZoneId testZone = zoneRegistryMock.zones().directlyRouted().in(Environment.prod).zones().stream().skip(1).findFirst().orElseThrow().getId(); - mockCuratorDb.writeEndpointCertificateMetadata(testInstance.id(), new EndpointCertificateMetadata(testKeyName, testCertName, -1, Optional.of("uuid"), Optional.of(expectedSans), Optional.of("mockCa"))); + mockCuratorDb.writeEndpointCertificateMetadata(testInstance.id(), new EndpointCertificateMetadata(testKeyName, testCertName, -1, 0, Optional.of("uuid"), Optional.of(expectedSans), Optional.of("mockCa"))); secretStore.setSecret("vespa.tls.default.default.default-key", KeyUtils.toPem(testKeyPair.getPrivate()), -1); secretStore.setSecret("vespa.tls.default.default.default-cert", X509CertificateUtils.toPem(testCertificate) + X509CertificateUtils.toPem(testCertificate), -1); diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/persistence/EndpointCertificateMetadataSerializerTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/persistence/EndpointCertificateMetadataSerializerTest.java index 3c80245c025..9c6790f630b 100644 --- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/persistence/EndpointCertificateMetadataSerializerTest.java +++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/persistence/EndpointCertificateMetadataSerializerTest.java @@ -11,21 +11,21 @@ import static org.junit.Assert.*; public class EndpointCertificateMetadataSerializerTest { private final EndpointCertificateMetadata sample = - new EndpointCertificateMetadata("keyName", "certName", 1); + new EndpointCertificateMetadata("keyName", "certName", 1, 0); private final EndpointCertificateMetadata sampleWithRequestMetadata = - new EndpointCertificateMetadata("keyName", "certName", 1, Optional.of("requestId"), Optional.of(List.of("SAN1", "SAN2")), Optional.of("issuer")); + new EndpointCertificateMetadata("keyName", "certName", 1, 0, Optional.of("requestId"), Optional.of(List.of("SAN1", "SAN2")), Optional.of("issuer")); @Test public void serialize() { assertEquals( - "{\"keyName\":\"keyName\",\"certName\":\"certName\",\"version\":1}", + "{\"keyName\":\"keyName\",\"certName\":\"certName\",\"version\":1,\"lastRequested\":0}", EndpointCertificateMetadataSerializer.toSlime(sample).toString()); } @Test public void serializeWithRequestMetadata() { assertEquals( - "{\"keyName\":\"keyName\",\"certName\":\"certName\",\"version\":1,\"requestId\":\"requestId\",\"requestedDnsSans\":[\"SAN1\",\"SAN2\"],\"issuer\":\"issuer\"}", + "{\"keyName\":\"keyName\",\"certName\":\"certName\",\"version\":1,\"lastRequested\":0,\"requestId\":\"requestId\",\"requestedDnsSans\":[\"SAN1\",\"SAN2\"],\"issuer\":\"issuer\"}", EndpointCertificateMetadataSerializer.toSlime(sampleWithRequestMetadata).toString()); } @@ -34,7 +34,7 @@ public class EndpointCertificateMetadataSerializerTest { assertEquals( sample, EndpointCertificateMetadataSerializer.fromJsonString( - "{\"keyName\":\"keyName\",\"certName\":\"certName\",\"version\":1}")); + "{\"keyName\":\"keyName\",\"certName\":\"certName\",\"version\":1,\"lastRequested\":0}")); } @Test @@ -42,6 +42,14 @@ public class EndpointCertificateMetadataSerializerTest { assertEquals( sampleWithRequestMetadata, EndpointCertificateMetadataSerializer.fromJsonString( - "{\"keyName\":\"keyName\",\"certName\":\"certName\",\"version\":1,\"requestId\":\"requestId\",\"requestedDnsSans\":[\"SAN1\",\"SAN2\"],\"issuer\":\"issuer\"}")); + "{\"keyName\":\"keyName\",\"certName\":\"certName\",\"version\":1,\"lastRequested\":0,\"requestId\":\"requestId\",\"requestedDnsSans\":[\"SAN1\",\"SAN2\"],\"issuer\":\"issuer\"}")); + } + + @Test + public void deserializeFromJsonWithDefaultLastRequested() { + assertEquals( + new EndpointCertificateMetadata("keyName", "certName", 1, 1597200000), + EndpointCertificateMetadataSerializer.fromJsonString( + "{\"keyName\":\"keyName\",\"certName\":\"certName\",\"version\":1}")); } } -- cgit v1.2.3