Print the certificate SHA-1 thumbprint in the VCP e2e test - #843
Open
wallrj-cyberark wants to merge 1 commit into
Open
wallrj-cyberark wants to merge 1 commit into
wallrj-cyberark wants to merge 1 commit into
Conversation
When the certificate never appears in the inventory, the thumbprint is what identifies it in the platform. The common name is not a reliable search key, so without the thumbprint a failed run cannot be followed up. It has to be printed by this script. The job deletes its GKE cluster when it finishes, so once the run is over there is no copy of the certificate left to compute the thumbprint from. - Print the thumbprint alongside the common name after creating the Secret. - Repeat it in the timeout message, which is where it is needed. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Contributor
Author
|
Dispatched The thumbprint was then enough to locate the certificate in the platform, which was the point — before this change that lookup was not possible once the job had torn down its cluster. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
test-e2ehas been failing for several days, with the certificate never appearing in the Venafi inventory before the 300s deadline. Following one of those failures up means finding the certificate in the platform, and the SHA-1 thumbprint is what identifies it there. The common name is not a reliable search key.This script prints neither. That is a problem specific to this test: it deletes its GKE cluster on the way out, so by the time anyone looks at a failed run the certificate is gone and the thumbprint cannot be recovered. This is not hypothetical — a debugging session earlier today stalled because nobody could produce the thumbprint for a run that had already finished.
What this does
Prints the thumbprint once after creating the Secret, and again in the timeout message, which is where you actually need it:
No behaviour changes. The only additions are one
opensslinvocation and threeechos.Test evidence
The thumbprint has to match what the platform stores, so I checked the pipeline two independent ways against the same certificate:
Uppercase hex with no separators is the form the platform records, so it can be pasted into a log search unmodified.
bash -n hack/e2e/test.shpasses. I have dispatchede2e.yamlagainst this branch; I will link the run below once it finishes, so the new output can be seen in a real job.[with Claude]