Use duration and renewBefore to control API cert rotation

These configuration knobs are much more human-understandable than the
previous percentage-based threshold flag.

We now allow users to set the lifetime of the serving cert via a ConfigMap.
Previously this was hardcoded to 1 year.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>

internal/server/server.go

@@ -10,11 +10,9 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"strconv"
 	"time"
 
 	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
 	genericapiserver "k8s.io/apiserver/pkg/server"
 	genericoptions "k8s.io/apiserver/pkg/server/options"
 	"k8s.io/apiserver/plugin/pkg/authenticator/token/webhook"
@@ -23,7 +21,6 @@ import (
 
 	"github.com/suzerain-io/pinniped/internal/apiserver"
 	"github.com/suzerain-io/pinniped/internal/certauthority/kubecertauthority"
-	"github.com/suzerain-io/pinniped/internal/constable"
 	"github.com/suzerain-io/pinniped/internal/controllermanager"
 	"github.com/suzerain-io/pinniped/internal/downward"
 	"github.com/suzerain-io/pinniped/internal/provider"
@@ -32,39 +29,13 @@ import (
 	"github.com/suzerain-io/pinniped/pkg/config"
 )
 
-type percentageValue struct {
-	percentage float32
-}
-
-var _ pflag.Value = &percentageValue{}
-
-func (p *percentageValue) String() string {
-	return fmt.Sprintf("%.2f%%", p.percentage*100)
-}
-
-func (p *percentageValue) Set(s string) error {
-	f, err := strconv.ParseFloat(s, 32)
-	if err != nil || f < 0 || f > 1 {
-		return constable.Error("must pass real number between 0 and 1")
-	}
-
-	p.percentage = float32(f)
-
-	return nil
-}
-
-func (p *percentageValue) Type() string {
-	return "percentage"
-}
-
 // App is an object that represents the pinniped-server application.
 type App struct {
 	cmd *cobra.Command
 
 	// CLI flags
-	configPath                   string
-	downwardAPIPath              string
-	servingCertRotationThreshold percentageValue
+	configPath      string
+	downwardAPIPath string
 }
 
 // This is ignored for now because we turn off etcd storage below, but this is
@@ -118,13 +89,6 @@ func addCommandlineFlagsToCommand(cmd *cobra.Command, app *App) {
 		"/etc/podinfo",
 		"path to Downward API volume mount",
 	)
-
-	app.servingCertRotationThreshold.percentage = .70 // default
-	cmd.Flags().Var(
-		&app.servingCertRotationThreshold,
-		"serving-cert-rotation-threshold",
-		"real number between 0 and 1 indicating percentage of lifetime before rotation of serving cert",
-	)
 }
 
 // Boot the aggregated API server, which will in turn boot the controllers.
@@ -168,7 +132,8 @@ func (a *App) runServer(ctx context.Context) error {
 		serverInstallationNamespace,
 		cfg.DiscoveryInfo.URL,
 		dynamicCertProvider,
-		a.servingCertRotationThreshold.percentage,
+		time.Duration(*cfg.APIConfig.ServingCertificateConfig.DurationSeconds)*time.Second,
+		time.Duration(*cfg.APIConfig.ServingCertificateConfig.RenewBeforeSeconds)*time.Second,
 	)
 	if err != nil {
 		return fmt.Errorf("could not prepare controllers: %w", err)

internal/server/server_test.go

@@ -25,11 +25,10 @@ Usage:
   pinniped-server [flags]
 
 Flags:
-  -c, --config string                                path to configuration file (default "pinniped.yaml")
-      --downward-api-path string                     path to Downward API volume mount (default "/etc/podinfo")
-  -h, --help                                         help for pinniped-server
-      --log-flush-frequency duration                 Maximum number of seconds between log flushes (default 5s)
-      --serving-cert-rotation-threshold percentage   real number between 0 and 1 indicating percentage of lifetime before rotation of serving cert (default 70.00%)
+  -c, --config string                  path to configuration file (default "pinniped.yaml")
+      --downward-api-path string       path to Downward API volume mount (default "/etc/podinfo")
+  -h, --help                           help for pinniped-server
+      --log-flush-frequency duration   Maximum number of seconds between log flushes (default 5s)
 `
 
 func TestCommand(t *testing.T) {
@@ -69,30 +68,6 @@ func TestCommand(t *testing.T) {
 			},
 			wantErr: `unknown command "tuna" for "pinniped-server"`,
 		},
-		{
-			name: "PercentageIsNotRealNumber",
-			args: []string{
-				"--config", "some/path/to/config.yaml",
-				"--serving-cert-rotation-threshold", "tuna",
-			},
-			wantErr: `invalid argument "tuna" for "--serving-cert-rotation-threshold" flag: must pass real number between 0 and 1`,
-		},
-		{
-			name: "PercentageIsTooSmall",
-			args: []string{
-				"--config", "some/path/to/config.yaml",
-				"--serving-cert-rotation-threshold", "-1",
-			},
-			wantErr: `invalid argument "-1" for "--serving-cert-rotation-threshold" flag: must pass real number between 0 and 1`,
-		},
-		{
-			name: "PercentageIsTooLarge",
-			args: []string{
-				"--config", "some/path/to/config.yaml",
-				"--serving-cert-rotation-threshold", "75",
-			},
-			wantErr: `invalid argument "75" for "--serving-cert-rotation-threshold" flag: must pass real number between 0 and 1`,
-		},
 	}
 	for _, test := range tests {
 		test := test