Add certificate replacement lifecycle

dns_sync/reconciliation.py

@@ -38,6 +38,7 @@ class PlanningAdapter(Protocol):
 
 class ReconciliationPolicy(Protocol):
     object_type: str
+    mutation_operation: PlanOperation
 
     def reconcile(
         self,
@@ -181,6 +182,7 @@ def group_observations(
 
 class DnsUnionPolicy:
     object_type = DNS_RECORDS
+    mutation_operation = PlanOperation.UPDATE
 
     def reconcile(
         self,
@@ -229,6 +231,7 @@ class DnsUnionPolicy:
 
 class CertificateNewestPolicy:
     object_type = CERTIFICATES
+    mutation_operation = PlanOperation.REPLACE
 
     _PORTABLE_FIELDS = (
         "domain_names",
@@ -247,20 +250,38 @@ class CertificateNewestPolicy:
         )
 
     @staticmethod
-    def _expiry_key(
-        object: NormalizedObject,
+    def _date_key(
+        value: object,
+        field: str,
     ) -> tuple[int, str]:
-        expires_on = object.payload.get("expires_on")
-
-        if expires_on is None:
+        if value is None:
             return (0, "")
 
-        if not isinstance(expires_on, str):
+        if not isinstance(value, str):
             raise ReconciliationConflict(
-                "Certificate expires_on must be normalized text"
+                f"Certificate {field} must be normalized text"
             )
 
-        return (1, expires_on)
+        return (1, value)
+
+    @classmethod
+    def _newest_key(
+        cls,
+        object: NormalizedObject,
+    ) -> tuple[
+        tuple[int, str],
+        tuple[int, str],
+    ]:
+        return (
+            cls._date_key(
+                object.payload.get("valid_from"),
+                "valid_from",
+            ),
+            cls._date_key(
+                object.payload.get("expires_on"),
+                "expires_on",
+            ),
+        )
 
     def reconcile(
         self,
@@ -273,14 +294,14 @@ class CertificateNewestPolicy:
             )
 
         newest_key = max(
-            self._expiry_key(observation.object)
+            self._newest_key(observation.object)
             for observation in observations
         )
 
         newest = [
             observation
             for observation in observations
-            if self._expiry_key(observation.object) == newest_key
+            if self._newest_key(observation.object) == newest_key
         ]
 
         baseline = self._portable_state(newest[0].object)
@@ -296,7 +317,7 @@ class CertificateNewestPolicy:
 
             raise ReconciliationConflict(
                 f"Conflicting {CERTIFICATES} observations for "
-                f"{logical_key!r} at newest expiry from "
+                f"{logical_key!r} at newest issuance from "
                 + ", ".join(sorted(conflicting_endpoints))
             )
 
@@ -324,6 +345,7 @@ class CertificateNewestPolicy:
 
 class ProxyHostConsensusPolicy:
     object_type = PROXY_HOSTS
+    mutation_operation = PlanOperation.UPDATE
 
     def reconcile(
         self,
@@ -540,7 +562,11 @@ def build_endpoint_plans(
                 operation = (
                     PlanOperation.NOOP
                     if equivalent
-                    else PlanOperation.UPDATE
+                    else (
+                        policy.mutation_operation
+                        if policy is not None
+                        else PlanOperation.UPDATE
+                    )
                 )
 
             actions.append(
@@ -552,6 +578,49 @@ def build_endpoint_plans(
                 )
             )
 
+        replaced = {
+            (
+                action.desired.object_type,
+                action.desired.logical_key,
+            )
+            for action in actions
+            if (
+                action.operation == PlanOperation.REPLACE
+                and action.desired is not None
+            )
+        }
+
+        if replaced:
+            promoted: list[PlanAction] = []
+
+            for action in actions:
+                desired = action.desired
+
+                if (
+                    action.operation == PlanOperation.NOOP
+                    and desired is not None
+                    and any(
+                        (
+                            reference.object_type,
+                            reference.logical_key,
+                        )
+                        in replaced
+                        for reference in desired.references
+                        if reference.logical_key is not None
+                    )
+                ):
+                    action = replace(
+                        action,
+                        operation=PlanOperation.UPDATE,
+                        reason=(
+                            "referenced object is being replaced"
+                        ),
+                    )
+
+                promoted.append(action)
+
+            actions = promoted
+
         plans.append(
             EndpointPlan(
                 endpoint_id=endpoint_id,