Add format version flag & rework payload creation #1096
Merged
+2,851
−702
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CHANGES
NOTE: All of the following changes pertain to the `cert_check` plugin
and associated dependencies.
Primary changes:
- create certificate metadata payload (if requested) regardless of
successful certificate chain validation attempt
- e.g., even if the connection attempt times out or DNS resolution
fails
- add `payload-format` flag to allow explicitly specifying which
certificate metadata payload format version will be used when
generating the payload for inclusion in plugin output
- this is intended to provide stability when updating the
`cert-payload` dependency as it "locks-in" the format version
instead of just always using the latest format and creating a
conflict with reporting tools that expect to work with specific
formats
- enable full `go-nagios` dependency debug logging *if* debug logging
is requested plugin
- *heavily* refactor `addCertChainPayload` function
- to outsource bulk of certificate metadata payload generation to
the `cert-payload` project
- to record the resolved IP Address used to retrieve the certificate
chain
- add warning if (unstable) certificate metadata payload format 0 is
chosen
- while format version 1 is not *yet* stable (and serves mostly as
a stub entry to test against), the plan is to stabilize it
fairly soon
- emit "pretty printed" JSON payload if debug or trace logging
levels is requested
Additional changes:
- misordered certificate chain detection is now performed by the
cert-payload project and recorded in the certificate metadata
payload
- the `check_cert` plugin is not (yet) flagging the service check as
passing/failing based on this criteria; misordered chain
validation is to be added in a future project release
REFERENCES
- atc0005/cert-payload#19
- atc0005/cert-payload#31
- atc0005/cert-payload#46
- #1004
atc0005
added
documentation
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
NOTE: All of the following changes pertain to the
cert_checkplugin and associated dependencies.Primary changes:
payload-formatflag to allow explicitly specifying which certificate metadata payload format version will be used when generating the payload for inclusion in plugin outputcert-payloaddependency as it "locks-in" the format version instead of just always using the latest format and creating a conflict with reporting tools that expect to work with specific formatsgo-nagiosdependency debug logging if debug logging is requested pluginaddCertChainPayloadfunctioncert-payloadprojectAdditional changes:
check_certplugin is not (yet) flagging the service check as passing/failing based on this criteria; misordered chain validation is to be added in a future project releaseReferences
CertificateChainIssues.MisorderedCertsfield cert-payload#19