Errors are unnecessarily logged on client prior to certificate being injected

[eranha]

Afte the CSR is sent the server and the response is being sent out-of-band, the client yields errors to log while attempting to load the certificate, until the server injects the certificate to the client. This type of output can be alarming to see and unhelpful so it would be good to only show this when there is a real problem getting the certificate.

AC:

• Certificate reading errors should only be logged when we are sure that the server failed to inject the signed cert

INFO: 2020/04/20 08:23:44 main.go:43: CAKC006I Authenticating as user '&{host/conjur/authn-k8s/conjur-5-e799170e-f-test/apps/test-app-5-e799170e-f/service_account/oc-test-app-summon-init host.conjur.authn-k8s.conjur-5-e799170e-f-test.apps test-app-5-e799170e-f.service_account.oc-test-app-summon-init}'
INFO: 2020/04/20 08:23:44 authenticator.go:181: CAKC005I Trying to login Conjur...
INFO: 2020/04/20 08:23:44 authenticator.go:113: CAKC007I Logging in as user &{host/conjur/authn-k8s/conjur-5-e799170e-f-test/apps/test-app-5-e799170e-f/service_account/oc-test-app-summon-init host.conjur.authn-k8s.conjur-5-e799170e-f-test.apps test-app-5-e799170e-f.service_account.oc-test-app-summon-init}.
INFO: 2020/04/20 08:23:44 requests.go:23: CAKC011I Login request to: https://conjur-follower.conjur-5-e799170e-f-test.svc.cluster.local/api/authn-k8s/conjur-5-e799170e-f-test/inject_client_cert
ERROR: 2020/04/20 08:23:44 authenticator.go:140: CAKC011E Client certificate not found at '/etc/conjur/ssl/client.pem'
ERROR: 2020/04/20 08:23:44 authenticator.go:184: CAKC015E Login failed
ERROR: 2020/04/20 08:23:44 main.go:46: CAKC016E Failed to authenticate
INFO: 2020/04/20 08:23:46 main.go:43: CAKC006I Authenticating as user '&{host/conjur/authn-k8s/conjur-5-e799170e-f-test/apps/test-app-5-e799170e-f/service_account/oc-test-app-summon-init host.conjur.authn-k8s.conjur-5-e799170e-f-test.apps test-app-5-e799170e-f.service_account.oc-test-app-summon-init}'
INFO: 2020/04/20 08:23:46 authenticator.go:181: CAKC005I Trying to login Conjur...
INFO: 2020/04/20 08:23:46 authenticator.go:113: CAKC007I Logging in as user &{host/conjur/authn-k8s/conjur-5-e799170e-f-test/apps/test-app-5-e799170e-f/service_account/oc-test-app-summon-init host.conjur.authn-k8s.conjur-5-e799170e-f-test.apps test-app-5-e799170e-f.service_account.oc-test-app-summon-init}.
INFO: 2020/04/20 08:23:46 requests.go:23: CAKC011I Login request to: https://conjur-follower.conjur-5-e799170e-f-test.svc.cluster.local/api/authn-k8s/conjur-5-e799170e-f-test/inject_client_cert
INFO: 2020/04/20 08:23:46 authenticator.go:187: CAKC002I Logged in
INFO: 2020/04/20 08:23:46 authenticator.go:170: CAKC008I Cert expires: 2020-04-23 08:23:44 +0000 UTC
INFO: 2020/04/20 08:23:46 authenticator.go:171: CAKC009I Current date: 2020-04-20 08:23:46.685910936 +0000 UTC
INFO: 2020/04/20 08:23:46 authenticator.go:172: CAKC010I Buffer time:  30s
INFO: 2020/04/20 08:23:46 requests.go:47: CAKC012I Authn request to: https://conjur-follower.conjur-5-e799170e-f-test.svc.cluster.local/api/authn-k8s/conjur-5-e799170e-f-test/my-account/host%2Fconjur%2Fauthn-k8s%2Fconjur-5-e799170e-f-test%2Fapps%2Ftest-app-5-e799170e-f%2Fservice_account%2Foc-test-app-summon-init/authenticate
INFO: 2020/04/20 08:23:46 authenticator.go:250: CAKC001I Successfully authenticated

[sgnn7]

Hi @eranha,
The problem here is that to avoid using "secret zero" and prevent DoSing the server with open connections, we have to do the injection of the certificate in an out-of-band async fashion into the container.

With that pre-requisite as a starting point, we do not have too many reliable options available to us from the authenticator. Are you suggesting that we use a different type of checks? If so, there is room for improvement here for sure but as-is described, this behavior is not exactly a bug. Let us know what you wanted to specifically to see here and we can try to refine the issue.

[eranha]

The error is logged because the certificate has not been injected yet. You can wait/retry for it, and only log an error after timeout

[sgnn7]

Hi @eranha,
I think I see what you mean. I will update the issue with clearer info then.

[sigalsax]

See more detail here: #146
Solution design by @oburstein-hub here