Skip to content

Make sure SenderStatusCertMiss is not overwritten#5906

Merged
eriknordmark merged 1 commit intolf-edge:masterfrom
eriknordmark:tlsroot
May 6, 2026
Merged

Make sure SenderStatusCertMiss is not overwritten#5906
eriknordmark merged 1 commit intolf-edge:masterfrom
eriknordmark:tlsroot

Conversation

@eriknordmark
Copy link
Copy Markdown
Contributor

@eriknordmark eriknordmark commented May 5, 2026

Description

This is needed to fetch new controller certificates. Without it certificate rotation can fail to propagate to
EVE devices in a timely manner (the 24 h timer will do it as a fallback).

Fixes the failures we see in the ctrl_cert_change test.

This was introduced in #5584 but the manual testing of those fixes always had a .bak file, and the eden smoke tests have had several cases of flaky tests preceeding the crtl_cert_change test so it has not been getting to the point of trying crtl_cert_change until recently.

How to test and validate this PR

Should be part of the normal regression testing, but in this case we need to run the manual
test which updates the controller signing certificate in addition to the eden test.

Changelog notes

None (part of the PR 5584)

PR Backports

MUST be backported where #5584 is backported wich is:

  • 16.0-stable - yes
  • 14.5-stable - yes
  • 13.4-stable - no

Checklist

  • I've provided a proper description

  • I've added the proper documentation

  • I've tested my PR on amd64 device

  • I've tested my PR on arm64 device

  • I've written the test verification instructions

  • I've set the proper labels to this PR

  • I've checked the boxes above, or I've provided a good reason why I didn't
    check them.

@eriknordmark eriknordmark requested a review from milan-zededa as a code owner May 5, 2026 22:19
@eriknordmark eriknordmark added bug Something isn't working stable Should be backported to stable release(s) labels May 5, 2026
@github-actions github-actions Bot requested a review from christoph-zededa May 5, 2026 22:20
@eriknordmark eriknordmark requested review from rene and shjala May 5, 2026 22:22
@codecov
Copy link
Copy Markdown

codecov Bot commented May 5, 2026

Codecov Report

❌ Patch coverage is 0% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 17.10%. Comparing base (2281599) to head (26037e9).
⚠️ Report is 676 commits behind head on master.

Files with missing lines Patch % Lines
pkg/pillar/controllerconn/authen.go 0.00% 5 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5906      +/-   ##
==========================================
- Coverage   19.52%   17.10%   -2.43%     
==========================================
  Files          19      474     +455     
  Lines        3021    85692   +82671     
==========================================
+ Hits          590    14657   +14067     
- Misses       2310    69516   +67206     
- Partials      121     1519    +1398     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

// prepare intermediate certs and validate the payload
var signCertBytes []byte
var keyCnt, signKeyCnt, encrKeyCnt int
interm := x509.NewCertPool()
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's take this opportunity to fix these Yetus issues....

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rene
Why? This is a priority 1 bug AFAICT.

Copy link
Copy Markdown
Contributor

@rene rene left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kicking off tests....

This is needed to fetch new controller certificates.

Signed-off-by: eriknordmark <erik@zededa.com>
@rene
Copy link
Copy Markdown
Contributor

rene commented May 6, 2026

Storage (zfs) is consistently timing out: https://github.com/lf-edge/eve/actions/runs/25430843709/job/74686298784#step:4:1011

Perhaps you could increase from 10min to 20min?

@eriknordmark
Copy link
Copy Markdown
Contributor Author

Storage (zfs) is consistently timing out: https://github.com/lf-edge/eve/actions/runs/25430843709/job/74686298784#step:4:1011

Perhaps you could increase from 10min to 20min?

Exploring ways to make that more robust in lf-edge/eden#1155, which is undoing/redoing a previous attempt to fix another issue in the ZFS storage test.

@eriknordmark
Copy link
Copy Markdown
Contributor Author

Storage (zfs) is consistently timing out: https://github.com/lf-edge/eve/actions/runs/25430843709/job/74686298784#step:4:1011
Perhaps you could increase from 10min to 20min?

Exploring ways to make that more robust in lf-edge/eden#1155, which is undoing/redoing a previous attempt to fix another issue in the ZFS storage test.

https://github.com/lf-edge/eden/actions/runs/25460237740/job/74700236782?pr=1155 is looking good so merging this PR and those Storage(zfs) tests will become more robust with 1155.

@eriknordmark eriknordmark merged commit 894e9c3 into lf-edge:master May 6, 2026
41 of 47 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working stable Should be backported to stable release(s)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants