OCPEDGE-2997: Add PKI certificate inventory

[eggfoobar]

Add a deterministic role-based inventory for certificate chains and use it for existing regeneration and rotation inspection paths.

Summary by CodeRabbit

• New Features
  • Added certificate inventory capabilities with certificate paths, roles, validity details, and role-based filtering.
  • Added classification for CA, client, serving, peer, and unknown certificates.
• Bug Fixes
  • Improved certificate regeneration and rotation checks by evaluating certificate inventory entries consistently.
  • Rotation checks now reliably identify the earliest certificate requiring attention.
• Tests
  • Added coverage for inventory contents, certificate roles, validity, signer lookup, certificate retrieval, and role filtering.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@eggfoobar: This pull request references OCPEDGE-2997 which is a valid jira issue.

Details

In response to this:

Add a deterministic role-based inventory for certificate chains and use it for existing regeneration and rotation inspection paths.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: cc855437-1fe7-4fa5-88ed-d90819454865

📥 Commits

Reviewing files that changed from the base of the PR and between 11f508f and 8e185c6.

📒 Files selected for processing (3)

• pkg/cmd/init.go
• pkg/cmd/init_test.go
• pkg/util/cryptomaterial/certchains/inventory.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

Changes

Certificate inventory migration

Layer / File(s)	Summary
Inventory model and traversal pkg/util/cryptomaterial/certchains/inventory.go	Adds certificate roles, inventory entries, deterministic chain traversal, role filtering, and certificate classification.
Lifecycle checks use inventory pkg/cmd/init.go, pkg/util/cryptomaterial/certchains/certchains.go	Updates regeneration and rotation checks to iterate over inventory entries and return without traversal errors.
Inventory and regeneration validation pkg/util/cryptomaterial/certchains/inventory_test.go, pkg/cmd/init_test.go	Tests inventory ordering, roles, certificate metadata, role filtering, and the updated regeneration return value.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 8e185

This change introduces deterministic certificate inventory traversal for regeneration and rotation checks. No current merge-readiness risk is identified.

Sequence Diagram(s)

sequenceDiagram
  participant initCerts
  participant CertificateChains
  participant CertificateInventory
  participant LifecycleChecks
  initCerts->>CertificateChains: request inventory
  CertificateChains->>CertificateInventory: build ordered classified entries
  CertificateInventory-->>LifecycleChecks: return paths and certificates
  LifecycleChecks->>LifecycleChecks: evaluate regeneration or rotation dates

Loading

Suggested labels: ready-for-human-review

Suggested reviewers: copejon

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 11.11% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: adding a deterministic PKI certificate inventory. It matches the pull request objectives and changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request adds or updates only standard Go tests in the inspected files. It introduces no Ginkgo Describe, Context, When, It, Specify, or Entry titles. The table-driven t.Run labe…
Test Structure And Quality	✅ Passed	PASS. The pull request adds and updates standard Go tests using testing.T and testify, not Ginkgo It blocks. The changed tests use t.TempDir() for temporary filesystem cleanup and perform no c…
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds only standard Go unit tests (TestCertificateChains_Inventory and TestCertificateInventory_ByRole) and updates Test_certsToRegenerate. It adds no Ginkgo It, `Describ…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request adds standard Go unit tests (TestCertificateChains_Inventory and TestCertificateInventory_ByRole) only. It adds no Ginkgo e2e tests, node operations, scheduling assumptions,…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS. The pull request changes only certificate-chain inventory, certificate regeneration, rotation inspection, and tests. The diff adds or modifies no deployment manifests, operator code, controllers…
Ote Binary Stdout Contract	✅ Passed	PASS. The pull request adds no stdout writes in main, init(), or suite setup. The changed production code only iterates certificate inventory entries and changes return handling. The klog.Errorf call …
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request adds standard Go unit tests only. It adds no Ginkgo It, Describe, Context, or When tests. The tests use temporary directories and in-process certificate data. They conta…
No-Weak-Crypto	✅ Passed	PASS. The PR adds certificate inventory and changes traversal logic only. The added code uses crypto/x509 certificate metadata and role classification. The diff introduces no MD5, SHA1, DES, 3DES, R…
Container-Privileges	✅ Passed	The PR changes only Go source and test files. It adds no container or Kubernetes manifest. Added lines contain none of the specified settings: privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMI…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request adds no new logging calls and does not log certificate contents, keys, tokens, passwords, or customer data. The existing klog.Errorf in WhenToRotateAtEarliest still logs cer…

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

level=warning msg="The linter 'gomodguard' is deprecated (since v2.12.0) due to: new major version. Replaced by gomodguard_v2."
level=warning msg="Suggested new configuration:\nlinters:\n enable:\n - gomodguard_v2\n"
level=error msg="Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: err: exit status 1: stderr: go: inconsistent vendoring in :\n\tgithub.com/apparentlymart/go-cidr@v1.1.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/coreos/go-systemd@v0.0.0-20190321100706-95778dfbb74e: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/google/go-cmp@v0.7.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/miekg/dns@v1.1.63: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/openshift/api@v0.0.0-20260715165912-72066cc9718b: is

... [truncated 30939 characters] ...

: is replaced in go.mod, but not marked as replaced in vendor/modules.txt\n\tk8s.io/pod-security-admission: is replaced in go.mod, but not marked as replaced in vendor/modules.txt\n\tk8s.io/sample-apiserver: is replaced in go.mod, but not marked as replaced in vendor/modules.txt\n\tk8s.io/sample-cli-plugin: is replaced in go.mod, but not marked as replaced in vendor/modules.txt\n\tk8s.io/sample-controller: is replaced in go.mod, but not marked as replaced in vendor/modules.txt\n\tk8s.io/cri-streaming: is replaced in go.mod, but not marked as replaced in vendor/modules.txt\n\tk8s.io/streaming: is replaced in go.mod, but not marked as replaced in vendor/modules.txt\n\n\tTo ignore the vendor directory, use -mod=readonly or -mod=mod.\n\tTo sync the vendor directory, run:\n\t\tgo mod vendor\n"

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: eggfoobar
Once this PR has been reviewed and has the lgtm label, please assign kasturinarra for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@eggfoobar: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.