On previous installations, the subcloud kube-rootca certificate is
different than the one from system controller. Currently, the audit
is comparing cert_id and declaring out-of-sync if they don't match,
which leads to an out-of-sync in the endpoint post upgrade. This
commit changes the audit logic to first audit by alarms so upgraded
subclouds can remain in-sync. Audit by cert_id still happen, but
only if the subcloud was rehomed.
Additionally, the force parameter was re-introduced in kube-rootca
update orchestration. Since with alarm based audit different cert_ids
can still present an in-sync status, the user might want to update
subcloud cert to match system controller, so the force parameter is
necessary to allow this.
Note: Dcagent didn't previously allowed extra_args to be sent in
in the payload. To avoid breaking audit with previous versions of
dcagent sending an unknown key in the payload (which will thrown an
error), extra_args are being sent in request header with the key
"X-DCAGENT-HEADERS". Support for extra_args in the payload was added,
but can only be used when all supported dcagent versions have this
option.
Note: Due to the current issue that blocks upgrade test, this commit
did not test subcloud upgrade, but the scenario would follow a
similar path from the second test case below, where updating a
subcloud rootca to a different cert from system controller results in
an in-sync endpoint status.
Test plan:
- PASS: Deploy a subcloud and verify kube-rootca_sync_status is
in-sync.
- PASS: Perform a kube-rootca update orchestration directly in the
subcloud without passing a cert so it will auto generate
one and verify kube-rootca_sync_status is still in-sync.
- PASS: Rehome the subcloud from the previous test and verify
kube-rootca_sync_status is out-of-sync.
- PASS: Perform a kube-rootca update orchestration using dcmanager
in an out-of-sync subcloud providing system controller certs
and verify the final sync status is in-sync.
- PASS: Perform a kube-rootca update orchestration using dcmanager
in an in-sync subcloud with force parameter without
providing certs and verify the final sync status is in-sync.
- PASS: Install a N-1 release and verify kube-rootca_sync_status is
in-sync.
Closes-bug: 2092069
Change-Id: If0cc002d0d4970730771ae90d80dc50c7daf4d4c
Signed-off-by: Victor Romano <victor.gluzromano@windriver.com>
e00c7223b5