Add Certificate Hash

[inteon]

Replace all current matching logic with a simple Certificate Hash that can be used to detect if the Certificate resource changed after the Secret was created/ updated.

The main goal of this PR is to be able to determine if a Secret is up-to-date for the specified Certificate resource without requiring CertificateRequest resources to exist. In the long term, this logic will replace existing matching logic and simplify the change detection mechanisms.

• We cannot use the issued certificate blob in the Secret to determine if the Certificate resource is up-to-date, because the CA might have issued a Certificate that does not match the properties requested in the Certificate resource.
• Instead, we add a hash to each Secret. This hash is created when the Secret is created and is based on the Certificate that requested the certificate in the Secret. The hash also adds parity bits to detect what field changed in case we detect a change.

Kind

/kind feature

Release Note

NONE

[jetstack-bot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[jetstack-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from inteon. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[inteon]

/ok-to-test

[jetstack-bot]

@inteon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cert-manager-master-make-test	9add564	link	true	/test pull-cert-manager-master-make-test
pull-cert-manager-master-e2e-v1-28	9add564	link	true	/test pull-cert-manager-master-e2e-v1-28

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[stephenc]

Will this address the case where the keystore password secret has changed and thus the keychain needs to be regenerated with the new secret, e.g.

apiVersion: cert-manager.io/v1
kind: Certificate
...
spec:
  ...
  keystores:
    jks:
      create: true
      passwordSecretRef:
        name: some-other-secret-name
        key: "jks-password"                        # <- i.e. if the value of this key in the `some-other-secret-name` secret has changed

Note: obviously if I change the certificate's .spec.keystores.jks.passwordSecretRef.key to a-different-key then the hash will change, but the hash should also include the existence of the secret referenced by .spec.keystores.jks.passwordSecretRef.name as well as the value of the key within that secret (modulo some way of not leaking the value of the secret through the hash)

[inteon]

Will this address the case where the keystore password secret has changed and thus the keychain needs to be regenerated with the new secret, e.g.

apiVersion: cert-manager.io/v1
kind: Certificate
...
spec:
  ...
  keystores:
    jks:
      create: true
      passwordSecretRef:
        name: some-other-secret-name
        key: "jks-password"                        # <- i.e. if the value of this key in the `some-other-secret-name` secret has changed

Note: obviously if I change the certificate's .spec.keystores.jks.passwordSecretRef.key to a-different-key then the hash will change, but the hash should also include the existence of the secret referenced by .spec.keystores.jks.passwordSecretRef.name as well as the value of the key within that secret (modulo some way of not leaking the value of the secret through the hash)

The issue you are describing will not be fixed by this PR. This PR is trying to improve the ReadinessPolicyChain and TriggerPolicyChain.
To fix the issue you are describing, the SecretPostIssuancePolicyChain should be improved, more particularly the SecretKeystoreFormatMismatch function.

[cert-manager-prow]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[cert-manager-prow]

@inteon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cert-manager-master-make-verify	28fed1f	link	true	/test pull-cert-manager-master-make-verify
pull-cert-manager-master-e2e-v1-30-upgrade	28fed1f	link	true	/test pull-cert-manager-master-e2e-v1-30-upgrade
pull-cert-manager-master-e2e-v1-30	28fed1f	link	true	/test pull-cert-manager-master-e2e-v1-30

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.