feat(tls): substrate-aware CharmState SAN/CN accessors (2/4)#173
Draft
marceloneppel wants to merge 1 commit into
Draft
feat(tls): substrate-aware CharmState SAN/CN accessors (2/4)#173marceloneppel wants to merge 1 commit into
marceloneppel wants to merge 1 commit into
Conversation
marceloneppel
force-pushed
the
tls-1-state
branch
from
2127465 to
f370152
Compare
marceloneppel
force-pushed
the
tls-2-state-accessors
branch
2 times, most recently
from
f01bfee to
1dd22a8
Compare
Layer the certificate-SAN and common-name policy onto CharmState, on top of the raw peer-databag accessors from the previous branch, so the substrate-specific certificate identity is reviewable as a unit with its own tests before any manager or handler consumes it. K8s must regain the parity the migration had dropped: common_hosts has to advertise the primary/replicas Service FQDNs and the resolved pod FQDN, and the operator-cert common name has to be the endpoints FQDN (wildcarded past the 64-char CN limit) rather than the VM-style host/address; the peer SAN set must exclude the ip key the original K8s charm never emitted. VM behaviour is left host/address-derived as before. The CharmState charm parameter is also widened to ops.CharmBase so the state object no longer depends on the concrete charm type. These accessors are additive and only read state, so the existing charm keeps constructing unchanged. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
marceloneppel
force-pushed
the
tls-1-state
branch
from
ea0c33c to
6dbc899
Compare
marceloneppel
force-pushed
the
tls-2-state-accessors
branch
from
1dd22a8 to
c6aa083
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 2/4, stacked on tls-1-state. Adds the substrate-aware
CharmStateaccessors that compose the peer/workload primitives from part 1 into the cert-request SANs and common names.What's here (
core/state.py)client_addresses/peer_addresses,client_common_name/peer_common_name(VM host-derived; K8s endpoints-FQDN parity with the>64-char wildcard rule), K8scommon_hosts(Service FQDNs), and theCharmBase-widening soCharmStateaccepts any charm.These accessors read the part-1 peer/databag primitives; the part-3 events handler feeds them into the
TLSCertificatesRequiresV4certificate requests. ~249 lines. Draft — not ready for review.(Recreated from the closed #166 after a branch rename; identical commit.)