Fix cert update by making certificate fields mutually exclusive

[mpanchajanya]

What this PR does / why we need it

• Implement tanzu config cert update command when ca-cert and skip-cert-verify being mutually exclusive i.e. only one of the option should be set

Examples of valid and invalid usages: -

Invalid usage - tanzu config cert update --ca-cert test.cert --skip-cert-verify true
Valid usage - tanzu config cert update --ca-cert test.cert --skip-cert-verify false
Valid usage - tanzu config cert update --ca-cert test.cert
Valid usage - tanzu config cert update --skip-cert-verify false
Valid usage - tanzu config cert update --skip-cert-verify true

Which issue(s) this PR fixes

Fixes #

Describe testing done for PR

-- Added unit tests

mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz version
version: v1.2.0-dev
buildDate: 2024-01-30
sha: d53572db-dirty
arch: arm64
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert list
[i] Refreshing plugin inventory cache for "projects.registry.vmware.com/tanzu_cli/plugins/plugin-inventory:latest", this will take a few seconds.
  HOST            CA-CERTIFICATE  SKIP-CERT-VERIFICATION  INSECURE  
  localhost:9876  <REDACTED>      false                   false     
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert add --host test.vmware.com --ca-cert test.cert --skip-cert-verify true
[x] : please specify only one valid option either '--skip-cert-verify' or '--ca-cert'
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update) [1]> tz config cert add --host test.vmware.com --ca-cert test.cert --skip-cert-verify false
[ok] successfully added certificate data for host test.vmware.com
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert add --host test.vmware.com --ca-cert test.cert
[x] : certificate configuration for host "test.vmware.com" already exist
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update) [1]> tz config cert add --host testv2.vmware.com --ca-cert test.cert
[ok] successfully added certificate data for host testv2.vmware.com
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert list
  HOST               CA-CERTIFICATE  SKIP-CERT-VERIFICATION  INSECURE  
  localhost:9876     <REDACTED>      false                   false     
  test.vmware.com    <REDACTED>      false                   false     
  testv2.vmware.com  <REDACTED>      false                   false     
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert update test.vmware.com --ca-cert test.cert
[ok] updated certificate data for host test.vmware.com
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert list
  HOST               CA-CERTIFICATE  SKIP-CERT-VERIFICATION  INSECURE  
  localhost:9876     <REDACTED>      false                   false     
  testv2.vmware.com  <REDACTED>      false                   false     
  test.vmware.com    <REDACTED>      false                   false     
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert update test.vmware.com --ca-cert test.cert --skip-cert-verify false
[ok] updated certificate data for host test.vmware.com
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert list
  HOST               CA-CERTIFICATE  SKIP-CERT-VERIFICATION  INSECURE  
  localhost:9876     <REDACTED>      false                   false     
  testv2.vmware.com  <REDACTED>      false                   false     
  test.vmware.com    <REDACTED>      false                   false     
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert update test.vmware.com --ca-cert test.cert --skip-cert-verify true
[x] : please specify only one valid option either '--skip-cert-verify' or '--ca-cert'
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update) [1]> tz config cert update test.vmware.com --skip-cert-verify true
[ok] updated certificate data for host test.vmware.com
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert list
  HOST               CA-CERTIFICATE  SKIP-CERT-VERIFICATION  INSECURE  
  localhost:9876     <REDACTED>      false                   false     
  testv2.vmware.com  <REDACTED>      false                   false     
  test.vmware.com    Not configured  true                    false     
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert update test.vmware.com --skip-cert-verify false
[x] : please specify at least one update option
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update) [1]> tz config cert update test.vmware.com --skip-cert-verify false --ca-cert test.cert 
[ok] updated certificate data for host test.vmware.com
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> tz config cert list
  HOST               CA-CERTIFICATE  SKIP-CERT-VERIFICATION  INSECURE  
  localhost:9876     <REDACTED>      false                   false     
  testv2.vmware.com  <REDACTED>      false                   false     
  test.vmware.com    <REDACTED>      false                   false     
mpanchajanya@mpanchajanF09MK ~/v/r/tanzu-cli (bug-fix/cert-update)> 

Release note

tanzu config cert options --ca-cert and --skip-cert-verify are mutually exclusive

Additional information

Special notes for your reviewer

[marckhouzam]

@mpanchajanya Do you know if the insecure setting should also be mutually exclusive?
Or is it ok to have both skip-verify/ca-cert configure along with insecure?

[mpanchajanya]

@mpanchajanya Do you know if the insecure setting should also be mutually exclusive? Or is it ok to have both skip-verify/ca-cert configure along with insecure?

Yea I'm not sure about that. Tagging @prkalle he might have more insights on this feature

[prkalle]

@mpanchajanya Do you know if the insecure setting should also be mutually exclusive? Or is it ok to have both skip-verify/ca-cert configure along with insecure?

Yea I'm not sure about that. Tagging @prkalle he might have more insights on this feature

If user use insecure, then http scheme would be used to interact with registry, then ca-cert and skip-verify configuration would be irrelavant. The issue that this PR is solving occured because the http transport would give priority to RootCAs(ca-cert) if both RootCAs(ca-cert) and InsecureSkipVerify(skip-verify) options of http.Transport.TLSClientConfig are configured. Hence making ca-cert and skip-verify options of tanzu config cert add and tanzu config cert update command is necessary.

[prkalle]

LGTM. Thanks!

[marckhouzam]

If user use insecure, then http scheme would be used to interact with registry, then ca-cert and skip-verify configuration would be irrelevant.

So should they be removed from the configuration?
If both are configured, the user may be confused as to which takes precedence.

[mpanchajanya]

If user use insecure, then http scheme would be used to interact with registry, then ca-cert and skip-verify configuration would be irrelevant.

So should they be removed from the configuration? If both are configured, the user may be confused as to which takes precedence.

@prkalle Any thoughts ?

[marckhouzam]

Just the comments to fix.
LGTM after that

[marckhouzam]

If user use insecure, then http scheme would be used to interact with registry, then ca-cert and skip-verify configuration would be irrelevant.

So should they be removed from the configuration? If both are configured, the user may be confused as to which takes precedence.

We have discussed this verbally and it was not clear if the ca-cert could end up being used if an insecure connection was redirected by a proxy to an https one. So, to avoid limiting the user's options, we decided to allow setting insecure and either other two options at the same time. A follow-up PR will document that insecure takes priority.