From cf2e259a30b9c7fd3f20350d6df5d2f08e68d3fa Mon Sep 17 00:00:00 2001 From: Julian Sommer <115516918+juliansommer@users.noreply.github.com> Date: Wed, 19 Aug 2026 14:01:13 +1000 Subject: [PATCH] fix: use 1024 bit certs in rds tests to speedup 30% --- spinifex/handlers/rds/agent.go | 1 + spinifex/handlers/rds/agent_test.go | 13 +++++++++++-- spinifex/handlers/rds/backup_sweep_test.go | 13 +++++++------ spinifex/handlers/rds/bootstrap_test.go | 19 +++++++++++++------ spinifex/handlers/rds/create_test.go | 13 +++++++------ spinifex/handlers/rds/lifecycle_test.go | 13 +++++++------ spinifex/handlers/rds/modify_test.go | 19 ++++++++++--------- spinifex/handlers/rds/reconciler_test.go | 2 +- spinifex/handlers/rds/service.go | 3 +++ spinifex/handlers/rds/servingcert.go | 13 ++++++++++--- spinifex/handlers/rds/snapshot_test.go | 13 +++++++------ 11 files changed, 77 insertions(+), 45 deletions(-) diff --git a/spinifex/handlers/rds/agent.go b/spinifex/handlers/rds/agent.go index e2914f65a..17f42ff6d 100644 --- a/spinifex/handlers/rds/agent.go +++ b/spinifex/handlers/rds/agent.go @@ -608,6 +608,7 @@ func (s *Service) mintServingCert(rec *DBInstanceRecord) (*bootstrapCert, error) DBInstanceIdentifier: rec.DBInstanceIdentifier, PrivateIP: rec.ENIPrivateIP, DNSName: rec.DNSName, + KeyBits: s.deps.ServingCertKeyBits, }) if err != nil { return nil, err diff --git a/spinifex/handlers/rds/agent_test.go b/spinifex/handlers/rds/agent_test.go index c6be90570..1bfe14bc8 100644 --- a/spinifex/handlers/rds/agent_test.go +++ b/spinifex/handlers/rds/agent_test.go @@ -22,6 +22,11 @@ import ( "github.com/stretchr/testify/require" ) +// Every test service mints its serving certs at 1024 bits. The path under test +// is the same one production runs; only the keygen, which dominated it under +// GOFIPS140, gets cheaper. +const testServingCertKeyBits = 1024 + const ( testDBID = "orders-db" testInstance = "i-0abc123" @@ -68,7 +73,9 @@ func newTestCA(t *testing.T) CALoader { func newTestService(t *testing.T) *Service { t.Helper() _, nc, _ := testutil.StartTestJetStream(t) - return NewService(nc, testRegion).WithDeps(Deps{LoadCA: newTestCA(t), MasterKey: testMasterKey}) + return NewService(nc, testRegion).WithDeps(Deps{ + LoadCA: newTestCA(t), MasterKey: testMasterKey, ServingCertKeyBits: testServingCertKeyBits, + }) } // seedInstance writes a DB instance record without the payload a pending @@ -317,6 +324,7 @@ func TestGetDBBootstrapConfig_BackfillsVpcCIDR(t *testing.T) { network := newFakeNetwork() svc := NewService(nc, testRegion).WithDeps(Deps{ LoadCA: newTestCA(t), MasterKey: testMasterKey, Network: network, + ServingCertKeyBits: testServingCertKeyBits, }) rec := defaultRecord() rec.VpcID = testDefaultVPC @@ -381,7 +389,8 @@ func TestGetDBBootstrapConfig_UnloadableCALeavesPasswordRecoverable(t *testing.T loadErr := errors.New("read CA key /etc/spinifex/ca.key: permission denied") broken := true svc := NewService(nc, testRegion).WithDeps(Deps{ - MasterKey: testMasterKey, + MasterKey: testMasterKey, + ServingCertKeyBits: testServingCertKeyBits, LoadCA: func() (*x509.Certificate, *rsa.PrivateKey, error) { if broken { return nil, nil, loadErr diff --git a/spinifex/handlers/rds/backup_sweep_test.go b/spinifex/handlers/rds/backup_sweep_test.go index fcb3b049f..1c65c0547 100644 --- a/spinifex/handlers/rds/backup_sweep_test.go +++ b/spinifex/handlers/rds/backup_sweep_test.go @@ -246,12 +246,13 @@ func TestSweep_IsBoundedPerPassAndResumes(t *testing.T) { t.Parallel() h := newSnapshotHarness(t, false) h.svc = h.svc.WithDeps(Deps{ - LoadCA: newTestCA(t), - MasterKey: testMasterKey, - Launch: h.launch.deps(), - Network: h.network, - Snapshots: h.snaps, - Backup: BackupPolicy{SweepDeleteLimit: 1}, + LoadCA: newTestCA(t), + MasterKey: testMasterKey, + Launch: h.launch.deps(), + Network: h.network, + Snapshots: h.snaps, + Backup: BackupPolicy{SweepDeleteLimit: 1}, + ServingCertKeyBits: testServingCertKeyBits, }) seedInstance(t, h.svc, retainingRecord(0)) for _, age := range []time.Duration{oneDay, 2 * oneDay, 3 * oneDay} { diff --git a/spinifex/handlers/rds/bootstrap_test.go b/spinifex/handlers/rds/bootstrap_test.go index f18d4fee2..f3101d47a 100644 --- a/spinifex/handlers/rds/bootstrap_test.go +++ b/spinifex/handlers/rds/bootstrap_test.go @@ -304,7 +304,10 @@ func TestAcknowledgeDBBootstrap_NeverDecrypts(t *testing.T) { svc := newTestService(t) payloadID := seedPending(t, svc, defaultRecord()) - rotated := svc.WithDeps(Deps{LoadCA: newTestCA(t), MasterKey: []byte(testOtherMasterKeyS)}) + rotated := svc.WithDeps(Deps{ + LoadCA: newTestCA(t), MasterKey: []byte(testOtherMasterKeyS), + ServingCertKeyBits: testServingCertKeyBits, + }) _, err := rotated.AcknowledgeDBBootstrap(t.Context(), &AcknowledgeDBBootstrapInput{ DBInstanceIdentifier: testDBID, InstanceID: testInstance, @@ -388,7 +391,10 @@ func TestGetDBBootstrapConfig_UnreadablePayloadAttachesAndReportsWhy(t *testing. svc := newTestService(t) seedPending(t, svc, defaultRecord()) - rotated := svc.WithDeps(Deps{LoadCA: newTestCA(t), MasterKey: []byte(testOtherMasterKeyS)}) + rotated := svc.WithDeps(Deps{ + LoadCA: newTestCA(t), MasterKey: []byte(testOtherMasterKeyS), + ServingCertKeyBits: testServingCertKeyBits, + }) out, err := rotated.GetDBBootstrapConfig(t.Context(), bootstrapInput(), testAccountID) require.NoError(t, err) assert.Equal(t, BootstrapModeAttach, out.Mode) @@ -433,10 +439,11 @@ func TestCreateDBInstance_WithoutAMasterKeyStagesNothing(t *testing.T) { t.Parallel() h := newCreateHarness(t, "") h.svc = h.svc.WithDeps(Deps{ - LoadCA: newTestCA(t), - Launch: h.launch.deps(), - Network: h.network, - IAM: testIAMProvider(h.iam), + LoadCA: newTestCA(t), + Launch: h.launch.deps(), + Network: h.network, + IAM: testIAMProvider(h.iam), + ServingCertKeyBits: testServingCertKeyBits, }) _, err := h.svc.CreateDBInstance(t.Context(), validCreateInput(), testAccountID) diff --git a/spinifex/handlers/rds/create_test.go b/spinifex/handlers/rds/create_test.go index 4112ba421..ecb1744fe 100644 --- a/spinifex/handlers/rds/create_test.go +++ b/spinifex/handlers/rds/create_test.go @@ -165,12 +165,13 @@ func newCreateHarness(t *testing.T, baseDomain string) *createHarness { h.stubDNSWriter(t) h.svc = NewService(nc, testRegion).WithDeps(Deps{ - LoadCA: newTestCA(t), - MasterKey: testMasterKey, - Launch: h.launch.deps(), - Network: h.network, - IAM: testIAMProvider(h.iam), - BaseDomain: baseDomain, + LoadCA: newTestCA(t), + MasterKey: testMasterKey, + Launch: h.launch.deps(), + Network: h.network, + IAM: testIAMProvider(h.iam), + BaseDomain: baseDomain, + ServingCertKeyBits: testServingCertKeyBits, }) return h } diff --git a/spinifex/handlers/rds/lifecycle_test.go b/spinifex/handlers/rds/lifecycle_test.go index bd04075a6..234e55c6d 100644 --- a/spinifex/handlers/rds/lifecycle_test.go +++ b/spinifex/handlers/rds/lifecycle_test.go @@ -260,12 +260,13 @@ func newLifecycleHarness(t *testing.T, agentFails bool) *lifecycleHarness { } h.agent = newStubAgent(t, nc, testAccountID, testDBID, agentFails) h.svc = NewService(nc, testRegion).WithDeps(Deps{ - LoadCA: newTestCA(t), - MasterKey: testMasterKey, - Instances: h.cmdr, - Snapshots: h.snaps, - InstanceState: h.vmState, - VMStopTimeout: testVMStopTimeout, + LoadCA: newTestCA(t), + MasterKey: testMasterKey, + Instances: h.cmdr, + Snapshots: h.snaps, + InstanceState: h.vmState, + VMStopTimeout: testVMStopTimeout, + ServingCertKeyBits: testServingCertKeyBits, Launch: LaunchDeps{ Config: &config.Config{Region: testRegion}, SystemVPC: h.sysvpc.deps(), diff --git a/spinifex/handlers/rds/modify_test.go b/spinifex/handlers/rds/modify_test.go index 5d4f7ff53..558f8b8d3 100644 --- a/spinifex/handlers/rds/modify_test.go +++ b/spinifex/handlers/rds/modify_test.go @@ -60,15 +60,16 @@ func newModifyHarnessWithAgent(t *testing.T, agentFails bool) *modifyHarness { } h.agent = newStubAgent(t, nc, testAccountID, testDBID, agentFails) h.svc = NewService(nc, testRegion).WithDeps(Deps{ - LoadCA: newTestCA(t), - MasterKey: testMasterKey, - Launch: h.launch.deps(), - Network: h.network, - IAM: testIAMProvider(h.iam), - Instances: h.cmdr, - Storage: h.storage, - InstanceState: h.vmState, - VMStopTimeout: testVMStopTimeout, + LoadCA: newTestCA(t), + MasterKey: testMasterKey, + Launch: h.launch.deps(), + Network: h.network, + IAM: testIAMProvider(h.iam), + Instances: h.cmdr, + Storage: h.storage, + InstanceState: h.vmState, + VMStopTimeout: testVMStopTimeout, + ServingCertKeyBits: testServingCertKeyBits, }) h.rec = NewReconciler(h.svc, "node-a") return h diff --git a/spinifex/handlers/rds/reconciler_test.go b/spinifex/handlers/rds/reconciler_test.go index d624b5b81..48b0c49e1 100644 --- a/spinifex/handlers/rds/reconciler_test.go +++ b/spinifex/handlers/rds/reconciler_test.go @@ -56,7 +56,7 @@ func newReconcileHarness(t *testing.T, opts ...func(*Deps)) *reconcileHarness { _, nc, _ := testutil.StartTestJetStream(t) state := &fakeInstanceState{state: instanceStateRunning} - deps := Deps{LoadCA: newTestCA(t), InstanceState: state} + deps := Deps{LoadCA: newTestCA(t), InstanceState: state, ServingCertKeyBits: testServingCertKeyBits} for _, opt := range opts { opt(&deps) } diff --git a/spinifex/handlers/rds/service.go b/spinifex/handlers/rds/service.go index 580638513..33cb12a59 100644 --- a/spinifex/handlers/rds/service.go +++ b/spinifex/handlers/rds/service.go @@ -23,6 +23,9 @@ type Deps struct { CAKeyPath string // Overrides the file-backed CA loader in tests. LoadCA CALoader + // Overrides the size of the RSA key each serving cert is minted with. Zero + // takes defaultServingCertKeyBits, which is what production runs. + ServingCertKeyBits int // The cluster master key the staged bootstrap password is encrypted under. // Mandatory: without it a create cannot stage a password at all, so it is // resolved at construction rather than per operation. diff --git a/spinifex/handlers/rds/servingcert.go b/spinifex/handlers/rds/servingcert.go index 7cd9e9ea0..05652ad9a 100644 --- a/spinifex/handlers/rds/servingcert.go +++ b/spinifex/handlers/rds/servingcert.go @@ -16,8 +16,8 @@ import ( // The lifetime is deliberately short: the cert is re-minted on every bootstrap // fetch and never persisted, so a leaked key ages out on its own. const ( - servingCertKeyBits = 2048 - servingCertLifetime = 90 * 24 * time.Hour + defaultServingCertKeyBits = 2048 + servingCertLifetime = 90 * 24 * time.Hour ) // Injected so tests mint from a throwaway CA, and so the file-backed @@ -30,6 +30,9 @@ type ServingCertRequest struct { DBInstanceIdentifier string PrivateIP string DNSName string + // Zero takes defaultServingCertKeyBits. Only tests set it, to buy back the + // keygen a 2048-bit key costs on every mint. + KeyBits int } // PEM-encoded, in memory only. @@ -52,7 +55,11 @@ func MintServingCert(caCert *x509.Certificate, caKey *rsa.PrivateKey, req Servin return nil, fmt.Errorf("rds serving cert: invalid private IP %q", req.PrivateIP) } - key, err := rsa.GenerateKey(rand.Reader, servingCertKeyBits) + bits := req.KeyBits + if bits <= 0 { + bits = defaultServingCertKeyBits + } + key, err := rsa.GenerateKey(rand.Reader, bits) if err != nil { return nil, fmt.Errorf("rds serving cert: generate key: %w", err) } diff --git a/spinifex/handlers/rds/snapshot_test.go b/spinifex/handlers/rds/snapshot_test.go index a503df9aa..761915381 100644 --- a/spinifex/handlers/rds/snapshot_test.go +++ b/spinifex/handlers/rds/snapshot_test.go @@ -49,12 +49,13 @@ func newSnapshotHarness(t *testing.T, agentFails bool) *snapshotHarness { stubDNSWriter(t, nc) h.svc = NewService(nc, testRegion).WithDeps(Deps{ - LoadCA: newTestCA(t), - MasterKey: testMasterKey, - Launch: h.launch.deps(), - Network: h.network, - IAM: testIAMProvider(h.iam), - Snapshots: h.snaps, + LoadCA: newTestCA(t), + MasterKey: testMasterKey, + Launch: h.launch.deps(), + Network: h.network, + IAM: testIAMProvider(h.iam), + Snapshots: h.snaps, + ServingCertKeyBits: testServingCertKeyBits, }) return h }