Adds basic federation status health check

cmd/cofidectl/cmd/federation/federation.go

@@ -4,11 +4,15 @@
 package federation
 
 import (
+	"context"
 	"os"
 
 	federation_proto "github.com/cofide/cofide-api-sdk/gen/go/proto/federation/v1alpha1"
+	trust_zone_proto "github.com/cofide/cofide-api-sdk/gen/go/proto/trust_zone/v1alpha1"
 	cmdcontext "github.com/cofide/cofidectl/cmd/cofidectl/cmd/context"
 
+	kubeutil "github.com/cofide/cofidectl/internal/pkg/kube"
+	"github.com/cofide/cofidectl/internal/pkg/spire"
 	"github.com/olekukonko/tablewriter"
 	"github.com/spf13/cobra"
 )
@@ -57,17 +61,37 @@ func (c *FederationCommand) GetListCommand() *cobra.Command {
 				return err
 			}
 
+			kubeConfig, err := cmd.Flags().GetString("kube-config")
+			if err != nil {
+				return err
+			}
+
 			federations, err := ds.ListFederations()
 			if err != nil {
 				return err
 			}
 
 			data := make([][]string, len(federations))
 			for i, federation := range federations {
+				from, err := ds.GetTrustZone(federation.From)
+				if err != nil {
+					return err
+				}
+
+				to, err := ds.GetTrustZone(federation.To)
+				if err != nil {
+					return err
+				}
+
+				status, err := checkFederationStatus(cmd.Context(), kubeConfig, from, to)
+				if err != nil {
+					return err
+				}
+
 				data[i] = []string{
 					federation.From,
 					federation.To,
-					"Healthy", // TODO
+					status,
 				}
 			}
 
@@ -83,6 +107,47 @@ func (c *FederationCommand) GetListCommand() *cobra.Command {
 	return cmd
 }
 
+type bundles struct {
+	serverCABundle   string
+	federatedBundles map[string]string
+}
+
+// checkFederationStatus builds a comparison map between two trust domains, retrieves there server CA bundle and any federated bundles available
+// locally from the SPIRE server, and then compares the bundles on each to verify SPIRE has the correct bundles on each side of the federation
+func checkFederationStatus(ctx context.Context, kubeConfig string, from *trust_zone_proto.TrustZone, to *trust_zone_proto.TrustZone) (string, error) {
+	compare := make(map[*trust_zone_proto.TrustZone]bundles)
+
+	for _, tz := range []*trust_zone_proto.TrustZone{from, to} {
+		client, err := kubeutil.NewKubeClientFromSpecifiedContext(kubeConfig, tz.GetKubernetesContext())
+		if err != nil {
+			return "", err
+		}
+
+		serverCABundle, federatedBundles, err := spire.GetServerCABundleAndFederatedBundles(ctx, client)
+		if err != nil {
+			return "", err
+		}
+
+		compare[tz] = bundles{
+			serverCABundle:   serverCABundle,
+			federatedBundles: federatedBundles,
+		}
+	}
+
+	// Bundle does not exist at all on opposite trust domain
+	_, ok := compare[from].federatedBundles[to.TrustDomain]
+	if !ok {
+		return "Unhealthy", nil
+	}
+
+	// Bundle does not match entry on opposite trust domain
+	if compare[from].federatedBundles[to.TrustDomain] != compare[to].serverCABundle {
+		return "Unhealthy", nil
+	}
+
+	return "Healthy", nil
+}
+
 var federationAddCmdDesc = `
 This command will add a new federation to the Cofide configuration state.
 `

internal/pkg/spire/spire.go

@@ -5,11 +5,13 @@ package spire
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"log/slog"
 	"strings"
 	"time"
 
+	"github.com/cofide/cofidectl/internal/pkg/kube"
 	kubeutil "github.com/cofide/cofidectl/internal/pkg/kube"
 	"github.com/spiffe/go-spiffe/v2/spiffeid"
 	types "github.com/spiffe/spire-api-sdk/proto/spire/api/types"
@@ -415,3 +417,61 @@ func formatIdUrl(id *types.SPIFFEID) (string, error) {
 		return id.String(), nil
 	}
 }
+
+// GetServerCABundleAndFederatedBundles retrieves the server CA bundle (i.e. bundle of the host) and any available
+// federated bundles from the SPIRE server, in order to do a federation health check
+func GetServerCABundleAndFederatedBundles(ctx context.Context, client *kube.Client) (string, map[string]string, error) {
+	serverCABundle, err := getServerCABundle(ctx, client)
+	if err != nil {
+		return "", nil, err
+	}
+	federatedBundles, err := getFederatedBundles(ctx, client)
+	if err != nil {
+		return "", nil, err
+	}
+	return serverCABundle, federatedBundles, err
+}
+
+// getServerCABundle retrives the x509_authorities component of the server CA trust bundle
+func getServerCABundle(ctx context.Context, client *kube.Client) (string, error) {
+	command := []string{"bundle", "show", "-output", "json"}
+	stdout, _, err := execInServerContainer(ctx, client, command)
+	if err != nil {
+		return "", err
+	}
+	return parseServerCABundle(stdout)
+}
+
+func parseServerCABundle(stdout []byte) (string, error) {
+	var data map[string]interface{}
+	if err := json.Unmarshal(stdout, &data); err != nil {
+		return "", err
+	}
+	return fmt.Sprint(data["x509_authorities"]), nil
+}
+
+type federatedBundles struct {
+	Bundles []map[string]interface{} `json:"bundles"`
+}
+
+func getFederatedBundles(ctx context.Context, client *kube.Client) (map[string]string, error) {
+	command := []string{"bundle", "list", "-output", "json"}
+	stdout, _, err := execInServerContainer(ctx, client, command)
+	if err != nil {
+		return nil, err
+	}
+	return parseFederatedBundles(stdout)
+}
+
+func parseFederatedBundles(stdout []byte) (map[string]string, error) {
+	result := make(map[string]string)
+	var data federatedBundles
+	if err := json.Unmarshal(stdout, &data); err != nil {
+		return nil, err
+	}
+	for _, bundle := range data.Bundles {
+		// Store x509_authorities for comparison, keyed by trust domain
+		result[bundle["trust_domain"].(string)] = fmt.Sprint(bundle["x509_authorities"])
+	}
+	return result, nil
+}

internal/pkg/spire/spire_test.go

@@ -10,6 +10,8 @@ import (
 	"time"
 
 	kubeutil "github.com/cofide/cofidectl/internal/pkg/kube"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	applyv1 "k8s.io/client-go/applyconfigurations/apps/v1"
 	v1 "k8s.io/client-go/applyconfigurations/core/v1"
@@ -216,3 +218,20 @@ func Test_addAgentK8sStatus(t *testing.T) {
 		t.Errorf("unexpected status got = %v, want = %v", got, want)
 	}
 }
+
+func TestSpire_parseServerCABundle_parseFederatedBundles(t *testing.T) {
+	// Example output from /opt/spire/bin/spire-server bundle show -output json
+	// trust_domain: td1
+	testServerCAJSONOutput := `{"jwt_authorities":[{"expires_at":"1732178926","key_id":"1eEODyZCgwlYD7PfzP3fV5svASUUJMsz","public_key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvv4ljaugt9hjVMYGIURByGVvVFQOstjtqXrtVAqo/uBiSBbm7Zq3B4a+7sMJL93zqe7DNuF3qmXWchKfBGZ+8gkB9/zSSszBrpOFSFQYgslCBwI/PNyKtPDMpYt2EdvesjJh9MZIoTqZ0nPyY/fM1yBx0mlIf7gTYJqzB0q/banoD2Ruxc/R3vru8yXPM84bIv3oyYzCNlc52k32EAGasRI580SJRnJ1ukb4GkuAkLxZXQjwwLiXhMGlZDfzxhy0foGVF64ANFyjCRpf5CTC65Cegc2UsCoI89ykVY5nLB/LuDwse1jXc4mtWiWkHZ+wwYlNHK4QuPWWZCb5B+cN4wIDAQAB","tainted":false}],"refresh_hint":"0","sequence_number":"1","trust_domain":"td1","x509_authorities":[{"asn1":"MIIDtTCCAp2gAwIBAgIQE4Hqzopq+emwuVOnc52dDDANBgkqhkiG9w0BAQsFADBoMQ0wCwYDVQQGEwRBUlBBMRAwDgYDVQQKEwdFeGFtcGxlMRQwEgYDVQQDEwtleGFtcGxlLm9yZzEvMC0GA1UEBRMmMjU5Mjk5MDA2NjIzNTEzODQ0NTA4OTAxOTEzOTEyMDQxNTQ2MzYwHhcNMjQxMTIwMjA0ODM2WhcNMjQxMTIxMDg0ODQ2WjBoMQ0wCwYDVQQGEwRBUlBBMRAwDgYDVQQKEwdFeGFtcGxlMRQwEgYDVQQDEwtleGFtcGxlLm9yZzEvMC0GA1UEBRMmMjU5Mjk5MDA2NjIzNTEzODQ0NTA4OTAxOTEzOTEyMDQxNTQ2MzYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDV1RlLOGjoheNKC+gia2vPGiBhDu4uHEXLRHMQ7Vqi+GEPhnl4R9MvJKnF1Au2ltkRO3o8qX9/Zy78ht5OitMBk1XaaEWTMwvGXYmlr4WksAan21rVb0b20qb5BTDVqFNPiWtGqMRnH0hwoGXX39ioOzYS1zU2WrtxohWYl9rxBPToDooHGg2k7pkGn0tkeyPkYHroOe1XU61cEAOelcoGeCipqQd+eFCCf16V/HemQKfiWb8tJZjHLEnvx0DBVPA33FngOsisIkwpGVA2Ycq7vRG35vyTH6Pa7Ryoom3ZvjCVV0eyZJvL3JznVMCoyCb3z1P4pypFT6XK1YRfz5tlAgMBAAGjWzBZMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTJdjj10TsO2JLYv1bycXz4dfFbdjAXBgNVHREEEDAOhgxzcGlmZmU6Ly90ZDEwDQYJKoZIhvcNAQELBQADggEBAB8u7hiIfT4SPCHAwPXdMrqv2Z/ivyLMtwFYJAgg0/HdSWmm0IaaMPN/ZzoN+lHtomY9trGZqw5I6zRyY03EwcGR+etpzi6nPDqeuMR35rK39q2aBTVLWAwcJSV7NEUMJDQ4vgQlQZ3iO41H48zHtdJYMh9p00elIRPJdd7AdHZb9lFs4Y+cxAJSYBQxMVwYkD65fdddF850QgESx2z74zVgmPMpia63khH8L5mY9+9evPw9bXo/xr4qUo8Mj2PFg4+GUPJobqN2eGkFr886+HeE67cjd77k8cHoQ/ZLFrYAT26qd7diJFNuR9R0zrDV0kfgdFiH6sfIao22ISM2d2Y=","tainted":false}]}`
+
+	// Example from /opt/spire/bin/spire-server bundle list -output json with td1 successfully federated
+	testBundleListJSONOutput := `{"bundles":[{"jwt_authorities":[{"expires_at":"0","key_id":"1eEODyZCgwlYD7PfzP3fV5svASUUJMsz","public_key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvv4ljaugt9hjVMYGIURByGVvVFQOstjtqXrtVAqo/uBiSBbm7Zq3B4a+7sMJL93zqe7DNuF3qmXWchKfBGZ+8gkB9/zSSszBrpOFSFQYgslCBwI/PNyKtPDMpYt2EdvesjJh9MZIoTqZ0nPyY/fM1yBx0mlIf7gTYJqzB0q/banoD2Ruxc/R3vru8yXPM84bIv3oyYzCNlc52k32EAGasRI580SJRnJ1ukb4GkuAkLxZXQjwwLiXhMGlZDfzxhy0foGVF64ANFyjCRpf5CTC65Cegc2UsCoI89ykVY5nLB/LuDwse1jXc4mtWiWkHZ+wwYlNHK4QuPWWZCb5B+cN4wIDAQAB","tainted":false}],"refresh_hint":"300","sequence_number":"0","trust_domain":"td1","x509_authorities":[{"asn1":"MIIDtTCCAp2gAwIBAgIQE4Hqzopq+emwuVOnc52dDDANBgkqhkiG9w0BAQsFADBoMQ0wCwYDVQQGEwRBUlBBMRAwDgYDVQQKEwdFeGFtcGxlMRQwEgYDVQQDEwtleGFtcGxlLm9yZzEvMC0GA1UEBRMmMjU5Mjk5MDA2NjIzNTEzODQ0NTA4OTAxOTEzOTEyMDQxNTQ2MzYwHhcNMjQxMTIwMjA0ODM2WhcNMjQxMTIxMDg0ODQ2WjBoMQ0wCwYDVQQGEwRBUlBBMRAwDgYDVQQKEwdFeGFtcGxlMRQwEgYDVQQDEwtleGFtcGxlLm9yZzEvMC0GA1UEBRMmMjU5Mjk5MDA2NjIzNTEzODQ0NTA4OTAxOTEzOTEyMDQxNTQ2MzYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDV1RlLOGjoheNKC+gia2vPGiBhDu4uHEXLRHMQ7Vqi+GEPhnl4R9MvJKnF1Au2ltkRO3o8qX9/Zy78ht5OitMBk1XaaEWTMwvGXYmlr4WksAan21rVb0b20qb5BTDVqFNPiWtGqMRnH0hwoGXX39ioOzYS1zU2WrtxohWYl9rxBPToDooHGg2k7pkGn0tkeyPkYHroOe1XU61cEAOelcoGeCipqQd+eFCCf16V/HemQKfiWb8tJZjHLEnvx0DBVPA33FngOsisIkwpGVA2Ycq7vRG35vyTH6Pa7Ryoom3ZvjCVV0eyZJvL3JznVMCoyCb3z1P4pypFT6XK1YRfz5tlAgMBAAGjWzBZMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTJdjj10TsO2JLYv1bycXz4dfFbdjAXBgNVHREEEDAOhgxzcGlmZmU6Ly90ZDEwDQYJKoZIhvcNAQELBQADggEBAB8u7hiIfT4SPCHAwPXdMrqv2Z/ivyLMtwFYJAgg0/HdSWmm0IaaMPN/ZzoN+lHtomY9trGZqw5I6zRyY03EwcGR+etpzi6nPDqeuMR35rK39q2aBTVLWAwcJSV7NEUMJDQ4vgQlQZ3iO41H48zHtdJYMh9p00elIRPJdd7AdHZb9lFs4Y+cxAJSYBQxMVwYkD65fdddF850QgESx2z74zVgmPMpia63khH8L5mY9+9evPw9bXo/xr4qUo8Mj2PFg4+GUPJobqN2eGkFr886+HeE67cjd77k8cHoQ/ZLFrYAT26qd7diJFNuR9R0zrDV0kfgdFiH6sfIao22ISM2d2Y=","tainted":false}]}],"next_page_token":""}`
+
+	gotServerCA, err := parseServerCABundle([]byte(testServerCAJSONOutput))
+	require.Nil(t, err)
+	gotFederated, err := parseFederatedBundles([]byte(testBundleListJSONOutput))
+	require.Nil(t, err)
+
+	assert.NotNil(t, gotFederated["td1"])
+	assert.Equal(t, gotServerCA, gotFederated["td1"])
+}

tests/integration/federation/test.sh

@@ -79,6 +79,13 @@ function wait_for_pong() {
   return 1
 }
 
+function post_deploy() {
+  federations=$(./cofidectl federation list)
+  if echo "$federations" | grep Unhealthy >/dev/null; then 
+      return 1
+  fi
+}
+
 function down() {
   ./cofidectl down
 }
@@ -90,6 +97,7 @@ function main() {
   show_config
   show_status
   run_tests
+  post_deploy
   down
   echo "Success!"
 }