feat(tls): substrate-aware CharmState SAN/CN accessors (2/4)#166
Closed
marceloneppel wants to merge 1 commit into
Closed
feat(tls): substrate-aware CharmState SAN/CN accessors (2/4)#166marceloneppel wants to merge 1 commit into
marceloneppel wants to merge 1 commit into
Conversation
Layer the certificate-SAN and common-name policy onto CharmState, on top of the raw peer-databag accessors from the previous branch, so the substrate-specific certificate identity is reviewable as a unit with its own tests before any manager or handler consumes it. K8s must regain the parity the migration had dropped: common_hosts has to advertise the primary/replicas Service FQDNs and the resolved pod FQDN, and the operator-cert common name has to be the endpoints FQDN (wildcarded past the 64-char CN limit) rather than the VM-style host/address; the peer SAN set must exclude the ip key the original K8s charm never emitted. VM behaviour is left host/address-derived as before. The CharmState charm parameter is also widened to ops.CharmBase so the state object no longer depends on the concrete charm type. These accessors are additive and only read state, so the existing charm keeps constructing unchanged. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
marceloneppel
force-pushed
the
tls-1-state
branch
from
db1bcb2 to
2127465
Compare
marceloneppel
force-pushed
the
tls-2-handlers
branch
from
b89e893 to
c7fcfd1
Compare
marceloneppel
changed the title
Member
Author
|
Superseded by #173 after a branch rename (tls-2-handlers → tls-2-state-accessors). Same commit; this PR was auto-closed by GitHub when its head branch was renamed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 2/4, stacked on #165. Adds the substrate-aware
CharmStateaccessors that compose the peer/workload primitives from part 1 into the cert-request SANs and common names.What's here (3 files)
core/state.py:client_addresses/peer_addresses,client_common_name/peer_common_name(VM host-derived; K8s endpoints-FQDN parity, with the>64-char wildcard rule), K8scommon_hosts(Service FQDNs), and theCharmBase-widening soCharmStateaccepts any charm.tests/unit/test_tls_state.py,tests/unit/test_tls_client_addrs.py.These accessors read the part-1 peer/databag primitives; the part-3 events handler feeds them into the
TLSCertificatesRequiresV4certificate requests. Draft — not ready for review.