add audit_cert_parent_parity CLI command#299
Draft
maperu wants to merge 1 commit into
Draft
Conversation
For each valid cert that replaces an older one, compare its destinations, sources, and endpoints with the parent's and emit a metric per mismatch. The metric carries the cert_id, parent_cert_id, owner, and mismatch_type tags so a Datadog monitor can route the alert to the cert owner. Parity violations usually indicate a botched rotation, source-sync drift, or a manual override that left the cert in an inconsistent state — the kind of thing the Lemur team currently has to untangle by hand whenever it surfaces in expiry-monitor noise. Half of a two-part change. The celery beat schedule entry that drives this daily lives in k8s-resources (per the CLAUDE.md convention) and goes in a separate PR. The Datadog monitor over the resulting metric goes in terraform-config (also separate PR).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a new CLI command audit_cert_parent_parity that walks every valid cert with a replaces relationship, compares its destinations/sources/endpoints with the parent's, and emits a metric per mismatch. The metric is tagged with cert_id, parent_cert_id, owner, and mismatch_type so a Datadog monitor can route the alert to the cert owner.
Parity violations usually indicate a botched rotation, source-sync drift, or a manual override that left the cert in an inconsistent state. Today this surfaces as expiry-monitor noise that the Lemur team has to untangle by hand. With this metric in place we can route directly to the cert owner.
Modeled on the existing check_revoked CLI command pattern in the same file. Uses session_query + paginate for large fleets.
This is half of a two-part change:
The function is exposed as a Flask-Script manager command but doesn't run on its own yet, so this PR is safe to merge before the schedule entry is in place.
Verifying locally: run lemur audit_cert_parent_parity in a pod and check the metric appears in Datadog at lemur.certificate_parent_parity_violation.