SECURESIGN-1460 | Ensure that TSA component does not create duplicated resources

[JasonPowr]

@bouskaJ @osmman Just looking for some feed back on this approach to ensuring only one resources is created at a time, if its acceptable Ill apply it to other TSA resources, needs some more testing

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JasonPowr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [JasonPowr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bouskaJ]

as I am part of the development @osmman can you re-review?

[JasonPowr]

/test tas-operator-e2e

[osmman]

I think that rootCA, intermediateCA, leafCA should not be created if signer uses key from is KMS or Tink service. These should be using certificate chain stored in certificateChainRef. Problem is that signer key from KMS/Tink will not be used for signing of Root CA.

Here PoC which splits management of signer and cert chains into different actions.

[JasonPowr]

@osmman Does it create rootCA, intermediateCA, leafCA keys when other signer types are specified ? Originally it wasn't supposed to, here:

secure-sign-operator/internal/controller/tsa/actions/generate_signer.go

Line 129 in 6052c53

if tsaUtils.IsFileType(instance) {

, We only handle keys e.g rootCA, intermediateCA, leafCA if it is a file signer type. Maybe I am misunderstanding ?

and we will only create a cert chain if one is not specified

secure-sign-operator/internal/controller/tsa/actions/generate_signer.go

Lines 329 to 343 in 6052c53

	func (g generateSigner) handleCertificateChain(ctx context.Context, instance *v1alpha1.TimestampAuthority, config *tsaUtils.TsaCertChainConfig) (*tsaUtils.TsaCertChainConfig, error) {
	if ref := instance.Spec.Signer.CertificateChain.CertificateChainRef; ref != nil {
	certificateChain, err := k8sutils.GetSecretData(g.Client, instance.Namespace, ref)
	if err != nil {
	return nil, err
	}
	config.CertificateChain = certificateChain
	} else {
	certificateChain, err := tsaUtils.CreateTSACertChain(ctx, instance, DeploymentName, g.Client, config)
	if err != nil {
	return nil, err
	}
	config.CertificateChain = certificateChain
	}
	return config, nil

, if using a tink or kms, a certchain should be provided

[osmman]

@osmman Does it create rootCA, intermediateCA, leafCA keys when other signer types are specified ? Originally it wasn't supposed to, here:

secure-sign-operator/internal/controller/tsa/actions/generate_signer.go

Line 129 in 6052c53

if tsaUtils.IsFileType(instance) {

, We only handle keys e.g rootCA, intermediateCA, leafCA if it is a file signer type. Maybe I am misunderstanding ?
and we will only create a cert chain if one is not specified

secure-sign-operator/internal/controller/tsa/actions/generate_signer.go

Lines 329 to 343 in 6052c53

	func (g generateSigner) handleCertificateChain(ctx context.Context, instance *v1alpha1.TimestampAuthority, config *tsaUtils.TsaCertChainConfig) (*tsaUtils.TsaCertChainConfig, error) {
	if ref := instance.Spec.Signer.CertificateChain.CertificateChainRef; ref != nil {
	certificateChain, err := k8sutils.GetSecretData(g.Client, instance.Namespace, ref)
	if err != nil {
	return nil, err
	}
	config.CertificateChain = certificateChain
	} else {
	certificateChain, err := tsaUtils.CreateTSACertChain(ctx, instance, DeploymentName, g.Client, config)
	if err != nil {
	return nil, err
	}
	config.CertificateChain = certificateChain
	}
	return config, nil

, if using a tink or kms, a certchain should be provided

I think that the action will fail if KMS or Tink resource and cert chain ref is empty/configured to autocreate certs. It will try to resolve certificate chain

secure-sign-operator/internal/controller/tsa/actions/generate_signer.go

Line 153 in 6052c53

tsaCertChainConfig, err = g.handleCertificateChain(ctx, instance, tsaCertChainConfig)

which need RootPrivateKey. That value do not exists because it is resolved only for File based signer.

[JasonPowr]

/test tas-operator-e2e

[osmman]

/lgtm