OCPEDGE-2997: Add PKI certificate inventory

[eggfoobar]

Add a deterministic role-based inventory for certificate chains and use it for existing regeneration and rotation inspection paths.

Summary by CodeRabbit

• New Features
  • Added certificate inventory capabilities with certificate paths, roles, validity details, and role-based filtering.
  • Added classification for CA, client, serving, peer, and unknown certificates.
• Bug Fixes
  • Improved certificate regeneration and rotation checks by evaluating certificate inventory entries consistently.
  • Rotation checks now reliably identify the earliest certificate requiring attention.
• Tests
  • Added coverage for inventory contents, certificate roles, validity, signer lookup, certificate retrieval, and role filtering.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@eggfoobar: This pull request references OCPEDGE-2997 which is a valid jira issue.

Details

In response to this:

Add a deterministic role-based inventory for certificate chains and use it for existing regeneration and rotation inspection paths.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

Review skipped

We couldn't safely recover the incremental review. No full review was started, and the last reviewed checkpoint was preserved. Retry later, or explicitly request a full review by commenting @coderabbitai full review.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: cc855437-1fe7-4fa5-88ed-d90819454865

📥 Commits

Reviewing files that changed from the base of the PR and between 11f508f and 8e185c6.

📒 Files selected for processing (3)

• pkg/cmd/init.go
• pkg/cmd/init_test.go
• pkg/util/cryptomaterial/certchains/inventory.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

Changes

Certificate inventory migration

Layer / File(s)	Summary
Inventory model and traversal pkg/util/cryptomaterial/certchains/inventory.go	Adds certificate roles, inventory entries, deterministic chain traversal, role filtering, and certificate classification.
Lifecycle checks use inventory pkg/cmd/init.go, pkg/util/cryptomaterial/certchains/certchains.go	Updates regeneration and rotation checks to iterate over inventory entries and return without traversal errors.
Inventory and regeneration validation pkg/util/cryptomaterial/certchains/inventory_test.go, pkg/cmd/init_test.go	Tests inventory ordering, roles, certificate metadata, role filtering, and the updated regeneration return value.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant initCerts
  participant CertificateChains
  participant CertificateInventory
  participant LifecycleChecks
  initCerts->>CertificateChains: request inventory
  CertificateChains->>CertificateInventory: build ordered classified entries
  CertificateInventory-->>LifecycleChecks: return paths and certificates
  LifecycleChecks->>LifecycleChecks: evaluate regeneration or rotation dates

Loading

Suggested labels: ready-for-human-review

Suggested reviewers: copejon

Merge Risk: ⚪ Minimal · up to 8e185

This change introduces deterministic certificate inventory traversal for regeneration and rotation checks. No current merge-readiness risk is identified.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 11.11% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: adding a deterministic PKI certificate inventory. It matches the pull request objectives and changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request adds or updates only standard Go tests in the inspected files. It introduces no Ginkgo Describe, Context, When, It, Specify, or Entry titles. The table-driven t.Run labe…
Test Structure And Quality	✅ Passed	PASS. The pull request adds and updates standard Go tests using testing.T and testify, not Ginkgo It blocks. The changed tests use t.TempDir() for temporary filesystem cleanup and perform no c…
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds only standard Go unit tests (TestCertificateChains_Inventory and TestCertificateInventory_ByRole) and updates Test_certsToRegenerate. It adds no Ginkgo It, `Describ…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request adds standard Go unit tests (TestCertificateChains_Inventory and TestCertificateInventory_ByRole) only. It adds no Ginkgo e2e tests, node operations, scheduling assumptions,…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS. The pull request changes only certificate-chain inventory, certificate regeneration, rotation inspection, and tests. The diff adds or modifies no deployment manifests, operator code, controllers…
Ote Binary Stdout Contract	✅ Passed	PASS. The pull request adds no stdout writes in main, init(), or suite setup. The changed production code only iterates certificate inventory entries and changes return handling. The klog.Errorf call …
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request adds standard Go unit tests only. It adds no Ginkgo It, Describe, Context, or When tests. The tests use temporary directories and in-process certificate data. They conta…
No-Weak-Crypto	✅ Passed	PASS. The PR adds certificate inventory and changes traversal logic only. The added code uses crypto/x509 certificate metadata and role classification. The diff introduces no MD5, SHA1, DES, 3DES, R…
Container-Privileges	✅ Passed	The PR changes only Go source and test files. It adds no container or Kubernetes manifest. Added lines contain none of the specified settings: privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMI…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request adds no new logging calls and does not log certificate contents, keys, tokens, passwords, or customer data. The existing klog.Errorf in WhenToRotateAtEarliest still logs cer…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[eggfoobar]

/retest-required

[eggfoobar]

/test ?

[eggfoobar]

/test e2e-aws-tests-bootc-periodic-el10 e2e-aws-tests-bootc-periodic-el9 e2e-aws-tests

[eggfoobar]

/test e2e-aws-tests

[redhat-chai-bot]

@eggfoobar The e2e-aws-tests failure does not appear to be related to this PR's changes. Here's the evidence:

What failed: Only the el98-src@configuration1 scenario failed (Exitval=1). All other 16 scenarios passed.

Why it's unrelated:

1. Your changes are scoped to pkg/util/cryptomaterial/certchains/ (new inventory logic) and pkg/cmd/init.go — none of the configuration test scenarios exercise this code path.
2. Known flake: el98-src@configuration1 also failed on unrelated PR USHIFT-7501: Stop openvswitch after OVN cleanup in microshift-cleanup-data #7347 (Sep 10). Across the last ~10 runs where scenarios executed, this scenario has a ~20% flake rate.
3. Broader job instability: The e2e-aws-tests job itself has only a ~20% pass rate over the last 14 days. Multiple scenarios flake independently (el98-src@standard1 at ~40%, el98-src@downgrade-block, el98-src@upgrade-fails-then-recovers), and several runs fail from infra-level issues before scenarios even start.

A /retest e2e-aws-tests should clear this.

---

AI-generated. Review for accuracy.

[pacevedom]

/lgtm

[openshift-ci]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-tests-arm
/test e2e-aws-tests-bootc-arm-el10
/test e2e-aws-tests-bootc-arm-el9
/test e2e-aws-tests-bootc-el10
/test e2e-aws-tests-bootc-el9

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eggfoobar, pacevedom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [pacevedom]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[redhat-chai-bot]

The retest of e2e-aws-tests failed again, but on a different scenario this time: el98-src@standard1 (Exitval=1) — while configuration1 (the previous offender) passed cleanly. This confirms these are independent flakes unrelated to your changes.

standard1 has a ~40% flake rate across recent runs — it's the most common offender in this job.

Another /retest e2e-aws-tests should eventually clear it.

---

AI-generated. Review for accuracy.

[eggfoobar]

/retest e2e-aws-tests

[eggfoobar]

/test e2e-aws-tests

[openshift-ci]

@eggfoobar: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[eggfoobar]

/verified by ci

[openshift-ci-robot]

@eggfoobar: This PR has been marked as verified by ci.

Details

In response to this:

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[pacevedom]

/pipeline auto

[openshift-ci]

Pipeline controller notification

The pipeline-auto label has been added to this PR. Second-stage tests will be triggered automatically when all first-stage tests pass.