OCPBUGS-57627: cert-inspection: create stubs for in-memory certificates

[vrutkovs]

We have no method to detect those, we have to create stub entries for every instance of apiserver.

Tested in openshift/origin#30005

[openshift-ci-robot]

@vrutkovs: This pull request references Jira Issue OCPBUGS-57627, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.20.0) matches configured target version for branch (4.20.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @wangke19

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

We have no method to detect those, we have to create stub entries for every instance of apiserver

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[wangke19]

The description is hardcoded as "apiserver loopback certificate". This limits the function's reusability. It would be better to add a Description field to the InMemoryCertDetail
struct to allow callers to provide context-specific descriptions.

[vrutkovs]

Good idea

[wangke19]

We checking for nil on list.InMemoryResourceData.CertKeyPairs but then initializing list.CertKeyPairs.Items. This might likely be:

if list.InMemoryResourceData.CertKeyPairs == nil {
     list.InMemoryResourceData.CertKeyPairs = []certgraphapi.PKIRegistryInMemoryCertKeyPair{}
 }
 // and separately
 if list.CertKeyPairs.Items == nil {
      list.CertKeyPairs.Items = []certgraphapi.CertKeyPair{}
 }

[vrutkovs]

Great find

[wangke19]

Add Unit Tests

The new functionality, especially in collector.go and deduplication.go, is not covered by new tests.

Advice:

• Create a new test file pkg/certs/cert-inspection/certgraphanalysis/collector_test.go.
• Add a unit test for CreateInMemoryPKIList using a fake kubeClient to ensure it correctly generates CertKeyPair objects based on a list of pods.
• Add a unit test for CombineCertInMemoryLocations in deduplication.go to verify that it correctly merges and de-duplicates pod locations.

[openshift-ci]

@vrutkovs: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[wangke19]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vrutkovs, wangke19
Once this PR has been reviewed and has the lgtm label, please assign p0lyn0mial for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale