gsadmin/spinifex
1
0
Fork 0
mirror of https://github.com/mulgadc/spinifex.git synced 2026-10-19 10:52:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: use 1024 bit certs in rds tests to speedup 30%

Browse Source
This commit is contained in:
Julian Sommer
2026-08-19 14:01:13 +10:00
parent 9f74594cb5
commit cf2e259a30
11 changed files with 77 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spinifex/handlers/rds/agent.go
+1
View File
@@ -608,6 +608,7 @@ func (s *Service) mintServingCert(rec *DBInstanceRecord) (*bootstrapCert, error)
DBInstanceIdentifier: rec.DBInstanceIdentifier,
PrivateIP: rec.ENIPrivateIP,
DNSName: rec.DNSName,
KeyBits: s.deps.ServingCertKeyBits,
})
if err != nil {
return nil, err
spinifex/handlers/rds/agent_test.go
+11 -2
View File
@@ -22,6 +22,11 @@ import (
"github.com/stretchr/testify/require"
)
// Every test service mints its serving certs at 1024 bits. The path under test
// is the same one production runs; only the keygen, which dominated it under
// GOFIPS140, gets cheaper.
const testServingCertKeyBits = 1024
const (
testDBID = "orders-db"
testInstance = "i-0abc123"
@@ -68,7 +73,9 @@ func newTestCA(t *testing.T) CALoader {
func newTestService(t *testing.T) *Service {
t.Helper()
_, nc, _ := testutil.StartTestJetStream(t)
return NewService(nc, testRegion).WithDeps(Deps{LoadCA: newTestCA(t), MasterKey: testMasterKey})
return NewService(nc, testRegion).WithDeps(Deps{
LoadCA: newTestCA(t), MasterKey: testMasterKey, ServingCertKeyBits: testServingCertKeyBits,
})
}
// seedInstance writes a DB instance record without the payload a pending
@@ -317,6 +324,7 @@ func TestGetDBBootstrapConfig_BackfillsVpcCIDR(t *testing.T) {
network := newFakeNetwork()
svc := NewService(nc, testRegion).WithDeps(Deps{
LoadCA: newTestCA(t), MasterKey: testMasterKey, Network: network,
ServingCertKeyBits: testServingCertKeyBits,
})
rec := defaultRecord()
rec.VpcID = testDefaultVPC
@@ -381,7 +389,8 @@ func TestGetDBBootstrapConfig_UnloadableCALeavesPasswordRecoverable(t *testing.T
loadErr := errors.New("read CA key /etc/spinifex/ca.key: permission denied")
broken := true
svc := NewService(nc, testRegion).WithDeps(Deps{
MasterKey: testMasterKey,
MasterKey: testMasterKey,
ServingCertKeyBits: testServingCertKeyBits,
LoadCA: func() (*x509.Certificate, *rsa.PrivateKey, error) {
if broken {
return nil, nil, loadErr
spinifex/handlers/rds/backup_sweep_test.go
+7 -6
View File
@@ -246,12 +246,13 @@ func TestSweep_IsBoundedPerPassAndResumes(t *testing.T) {
t.Parallel()
h := newSnapshotHarness(t, false)
h.svc = h.svc.WithDeps(Deps{
LoadCA: newTestCA(t),
MasterKey: testMasterKey,
Launch: h.launch.deps(),
Network: h.network,
Snapshots: h.snaps,
Backup: BackupPolicy{SweepDeleteLimit: 1},
LoadCA: newTestCA(t),
MasterKey: testMasterKey,
Launch: h.launch.deps(),
Network: h.network,
Snapshots: h.snaps,
Backup: BackupPolicy{SweepDeleteLimit: 1},
ServingCertKeyBits: testServingCertKeyBits,
})
seedInstance(t, h.svc, retainingRecord(0))
for _, age := range []time.Duration{oneDay, 2 * oneDay, 3 * oneDay} {
spinifex/handlers/rds/bootstrap_test.go
+13 -6
View File
@@ -304,7 +304,10 @@ func TestAcknowledgeDBBootstrap_NeverDecrypts(t *testing.T) {
svc := newTestService(t)
payloadID := seedPending(t, svc, defaultRecord())
rotated := svc.WithDeps(Deps{LoadCA: newTestCA(t), MasterKey: []byte(testOtherMasterKeyS)})
rotated := svc.WithDeps(Deps{
LoadCA: newTestCA(t), MasterKey: []byte(testOtherMasterKeyS),
ServingCertKeyBits: testServingCertKeyBits,
})
_, err := rotated.AcknowledgeDBBootstrap(t.Context(), &AcknowledgeDBBootstrapInput{
DBInstanceIdentifier: testDBID,
InstanceID: testInstance,
@@ -388,7 +391,10 @@ func TestGetDBBootstrapConfig_UnreadablePayloadAttachesAndReportsWhy(t *testing.
svc := newTestService(t)
seedPending(t, svc, defaultRecord())
rotated := svc.WithDeps(Deps{LoadCA: newTestCA(t), MasterKey: []byte(testOtherMasterKeyS)})
rotated := svc.WithDeps(Deps{
LoadCA: newTestCA(t), MasterKey: []byte(testOtherMasterKeyS),
ServingCertKeyBits: testServingCertKeyBits,
})
out, err := rotated.GetDBBootstrapConfig(t.Context(), bootstrapInput(), testAccountID)
require.NoError(t, err)
assert.Equal(t, BootstrapModeAttach, out.Mode)
@@ -433,10 +439,11 @@ func TestCreateDBInstance_WithoutAMasterKeyStagesNothing(t *testing.T) {
t.Parallel()
h := newCreateHarness(t, "")
h.svc = h.svc.WithDeps(Deps{
LoadCA: newTestCA(t),
Launch: h.launch.deps(),
Network: h.network,
IAM: testIAMProvider(h.iam),
LoadCA: newTestCA(t),
Launch: h.launch.deps(),
Network: h.network,
IAM: testIAMProvider(h.iam),
ServingCertKeyBits: testServingCertKeyBits,
})
_, err := h.svc.CreateDBInstance(t.Context(), validCreateInput(), testAccountID)
spinifex/handlers/rds/create_test.go
+7 -6
View File
@@ -165,12 +165,13 @@ func newCreateHarness(t *testing.T, baseDomain string) *createHarness {
h.stubDNSWriter(t)
h.svc = NewService(nc, testRegion).WithDeps(Deps{
LoadCA: newTestCA(t),
MasterKey: testMasterKey,
Launch: h.launch.deps(),
Network: h.network,
IAM: testIAMProvider(h.iam),
BaseDomain: baseDomain,
LoadCA: newTestCA(t),
MasterKey: testMasterKey,
Launch: h.launch.deps(),
Network: h.network,
IAM: testIAMProvider(h.iam),
BaseDomain: baseDomain,
ServingCertKeyBits: testServingCertKeyBits,
})
return h
}
spinifex/handlers/rds/lifecycle_test.go
+7 -6
View File
@@ -260,12 +260,13 @@ func newLifecycleHarness(t *testing.T, agentFails bool) *lifecycleHarness {
}
h.agent = newStubAgent(t, nc, testAccountID, testDBID, agentFails)
h.svc = NewService(nc, testRegion).WithDeps(Deps{
LoadCA: newTestCA(t),
MasterKey: testMasterKey,
Instances: h.cmdr,
Snapshots: h.snaps,
InstanceState: h.vmState,
VMStopTimeout: testVMStopTimeout,
LoadCA: newTestCA(t),
MasterKey: testMasterKey,
Instances: h.cmdr,
Snapshots: h.snaps,
InstanceState: h.vmState,
VMStopTimeout: testVMStopTimeout,
ServingCertKeyBits: testServingCertKeyBits,
Launch: LaunchDeps{
Config: &config.Config{Region: testRegion},
SystemVPC: h.sysvpc.deps(),
spinifex/handlers/rds/modify_test.go
+10 -9
View File
@@ -60,15 +60,16 @@ func newModifyHarnessWithAgent(t *testing.T, agentFails bool) *modifyHarness {
}
h.agent = newStubAgent(t, nc, testAccountID, testDBID, agentFails)
h.svc = NewService(nc, testRegion).WithDeps(Deps{
LoadCA: newTestCA(t),
MasterKey: testMasterKey,
Launch: h.launch.deps(),
Network: h.network,
IAM: testIAMProvider(h.iam),
Instances: h.cmdr,
Storage: h.storage,
InstanceState: h.vmState,
VMStopTimeout: testVMStopTimeout,
LoadCA: newTestCA(t),
MasterKey: testMasterKey,
Launch: h.launch.deps(),
Network: h.network,
IAM: testIAMProvider(h.iam),
Instances: h.cmdr,
Storage: h.storage,
InstanceState: h.vmState,
VMStopTimeout: testVMStopTimeout,
ServingCertKeyBits: testServingCertKeyBits,
})
h.rec = NewReconciler(h.svc, "node-a")
return h
spinifex/handlers/rds/reconciler_test.go
+1 -1
View File
@@ -56,7 +56,7 @@ func newReconcileHarness(t *testing.T, opts ...func(*Deps)) *reconcileHarness {
_, nc, _ := testutil.StartTestJetStream(t)
state := &fakeInstanceState{state: instanceStateRunning}
deps := Deps{LoadCA: newTestCA(t), InstanceState: state}
deps := Deps{LoadCA: newTestCA(t), InstanceState: state, ServingCertKeyBits: testServingCertKeyBits}
for _, opt := range opts {
opt(&deps)
}
spinifex/handlers/rds/service.go
+3
View File
@@ -23,6 +23,9 @@ type Deps struct {
CAKeyPath string
// Overrides the file-backed CA loader in tests.
LoadCA CALoader
// Overrides the size of the RSA key each serving cert is minted with. Zero
// takes defaultServingCertKeyBits, which is what production runs.
ServingCertKeyBits int
// The cluster master key the staged bootstrap password is encrypted under.
// Mandatory: without it a create cannot stage a password at all, so it is
// resolved at construction rather than per operation.
spinifex/handlers/rds/servingcert.go
+10 -3
View File
@@ -16,8 +16,8 @@ import (
// The lifetime is deliberately short: the cert is re-minted on every bootstrap
// fetch and never persisted, so a leaked key ages out on its own.
const (
servingCertKeyBits = 2048
servingCertLifetime = 90 * 24 * time.Hour
defaultServingCertKeyBits = 2048
servingCertLifetime = 90 * 24 * time.Hour
)
// Injected so tests mint from a throwaway CA, and so the file-backed
@@ -30,6 +30,9 @@ type ServingCertRequest struct {
DBInstanceIdentifier string
PrivateIP string
DNSName string
// Zero takes defaultServingCertKeyBits. Only tests set it, to buy back the
// keygen a 2048-bit key costs on every mint.
KeyBits int
}
// PEM-encoded, in memory only.
@@ -52,7 +55,11 @@ func MintServingCert(caCert *x509.Certificate, caKey *rsa.PrivateKey, req Servin
return nil, fmt.Errorf("rds serving cert: invalid private IP %q", req.PrivateIP)
}
key, err := rsa.GenerateKey(rand.Reader, servingCertKeyBits)
bits := req.KeyBits
if bits <= 0 {
bits = defaultServingCertKeyBits
}
key, err := rsa.GenerateKey(rand.Reader, bits)
if err != nil {
return nil, fmt.Errorf("rds serving cert: generate key: %w", err)
}
spinifex/handlers/rds/snapshot_test.go
+7 -6
View File
@@ -49,12 +49,13 @@ func newSnapshotHarness(t *testing.T, agentFails bool) *snapshotHarness {
stubDNSWriter(t, nc)
h.svc = NewService(nc, testRegion).WithDeps(Deps{
LoadCA: newTestCA(t),
MasterKey: testMasterKey,
Launch: h.launch.deps(),
Network: h.network,
IAM: testIAMProvider(h.iam),
Snapshots: h.snaps,
LoadCA: newTestCA(t),
MasterKey: testMasterKey,
Launch: h.launch.deps(),
Network: h.network,
IAM: testIAMProvider(h.iam),
Snapshots: h.snaps,
ServingCertKeyBits: testServingCertKeyBits,
})
return h
}