open-vault/builtin/logical/pki
Alexander Scheel a5fafd8163
Add ability to perform automatic tidy operations (#16900)
* Add ability to perform automatic tidy operations

This enables the PKI secrets engine to allow tidy to be started
periodically by the engine itself, avoiding the need for interaction.
This operation is disabled by default (to avoid load on clusters which
don't need tidy to be run) but can be enabled.

In particular, a default tidy configuration is written (via
/config/auto-tidy) which mirrors the options passed to /tidy. Two
additional parameters, enabled and interval, are accepted, allowing
auto-tidy to be enabled or disabled and controlling the interval
(between successful tidy runs) to attempt auto-tidy.

Notably, a manual execution of tidy will delay additional auto-tidy
operations. Status is reported via the existing /tidy-status endpoint.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add changelog entry

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add documentation on auto-tidy

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add tests for auto-tidy

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Prevent race during parallel testing

We modified the RollbackManager's execution window to allow more
faithful testing of the periodicFunc. However, the TestAutoRebuild and
the new TestAutoTidy would then race against each other for modifying
the period and creating their clusters (before resetting to the old
value).

This changeset adds a lock around this, preventing the races.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Use tidyStatusLock to gate lastTidy time

This prevents a data race between the periodic func and the execution of
the running tidy.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add read lock around tidyStatus gauges

When reading from tidyStatus for computing gauges, since the underlying
values aren't atomics, we really should be gating these with a read lock
around the status access.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
2022-08-30 15:45:54 -04:00
..
cmd/pki
backend.go Add ability to perform automatic tidy operations (#16900) 2022-08-30 15:45:54 -04:00
backend_test.go Clean up behavior of If-Modified-Since header (#16929) 2022-08-30 13:25:36 -04:00
ca_test.go
ca_util.go
cert_util.go
cert_util_test.go
chain_test.go
chain_util.go
config_util.go Clean up behavior of If-Modified-Since header (#16929) 2022-08-30 13:25:36 -04:00
crl_test.go Add ability to perform automatic tidy operations (#16900) 2022-08-30 15:45:54 -04:00
crl_util.go Clean up behavior of If-Modified-Since header (#16929) 2022-08-30 13:25:36 -04:00
fields.go Add ability to perform automatic tidy operations (#16900) 2022-08-30 15:45:54 -04:00
integation_test.go
key_util.go
managed_key_util.go
ocsp.go
ocsp_test.go
path_config_ca.go
path_config_crl.go
path_config_urls.go
path_fetch.go Clean up behavior of If-Modified-Since header (#16929) 2022-08-30 13:25:36 -04:00
path_fetch_issuers.go Clean up behavior of If-Modified-Since header (#16929) 2022-08-30 13:25:36 -04:00
path_fetch_keys.go
path_intermediate.go
path_issue_sign.go
path_manage_issuers.go
path_manage_keys.go
path_manage_keys_test.go
path_revoke.go
path_roles.go
path_roles_test.go
path_root.go
path_sign_issuers.go
path_tidy.go Add ability to perform automatic tidy operations (#16900) 2022-08-30 15:45:54 -04:00
path_tidy_test.go Add ability to perform automatic tidy operations (#16900) 2022-08-30 15:45:54 -04:00
secret_certs.go
storage.go Add ability to perform automatic tidy operations (#16900) 2022-08-30 15:45:54 -04:00
storage_migrations.go
storage_migrations_test.go
storage_test.go
test_helpers.go
util.go Clean up behavior of If-Modified-Since header (#16929) 2022-08-30 13:25:36 -04:00