david/dns-sync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add certificate replacement lifecycle

Browse Source
This commit is contained in:
Lyncoln
2026-09-20 01:44:56 -04:00
parent 4b094820b2
commit 2668651a98
7 changed files with 582 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_reconciliation.py
+15 -9
View File
@@ -326,7 +326,7 @@ class DnsUnionPolicyTests(unittest.TestCase):
)
self.assertIsNone(desired[0].local_key)
def test_certificate_same_expiry_conflict_fails_closed(self):
def test_certificate_policy_prefers_newer_valid_from_over_expiry(self):
observations = [
Observation(
endpoint_id="npm://node-one:81",
@@ -337,7 +337,7 @@ class DnsUnionPolicyTests(unittest.TestCase):
payload={
"domain_names": ["app.example.com"],
"valid_from": "2026-08-01T00:00:00+00:00",
"expires_on": "2026-12-01T00:00:00+00:00",
"expires_on": "2027-01-01T00:00:00+00:00",
},
),
observed_at=NOW,
@@ -350,19 +350,25 @@ class DnsUnionPolicyTests(unittest.TestCase):
local_key="44",
payload={
"domain_names": ["app.example.com"],
"valid_from": "2026-09-01T00:00:00+00:00",
"expires_on": "2026-12-01T00:00:00+00:00",
"valid_from": "2026-09-15T00:00:00+00:00",
"expires_on": "2026-12-15T00:00:00+00:00",
},
),
observed_at=NOW,
),
]
with self.assertRaisesRegex(
ReconciliationConflict,
"newest expiry",
):
reconcile_observations(observations)
desired = reconcile_observations(observations)
self.assertEqual(len(desired), 1)
self.assertEqual(
desired[0].payload["valid_from"],
"2026-09-15T00:00:00+00:00",
)
self.assertEqual(
desired[0].payload["expires_on"],
"2026-12-15T00:00:00+00:00",
)
def test_proxy_consensus_ignores_different_endpoint_local_certificate_ids(self):
observations = []