From bac0c59a43dc29f5da2c82b9192d39a470731163 Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Mon, 21 Sep 2026 16:44:22 +0000 Subject: [PATCH] Print the certificate SHA-1 thumbprint in the VCP e2e test When the certificate never appears in the inventory, the thumbprint is what identifies it in the platform. The common name is not a reliable search key, so without the thumbprint a failed run cannot be followed up. It has to be printed by this script. The job deletes its GKE cluster when it finishes, so once the run is over there is no copy of the certificate left to compute the thumbprint from. - Print the thumbprint alongside the common name after creating the Secret. - Repeat it in the timeout message, which is where it is needed. Co-Authored-By: Claude Signed-off-by: Richard Wall --- hack/e2e/test.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hack/e2e/test.sh b/hack/e2e/test.sh index 1d041e0c..83e75d16 100755 --- a/hack/e2e/test.sh +++ b/hack/e2e/test.sh @@ -209,6 +209,13 @@ commonname="venafi-kubernetes-agent-e2e.$(uuidgen | tr '[:upper:]' '[:lower:]')" openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /tmp/tls.key -out /tmp/tls.crt -subj "/CN=$commonname" kubectl create secret tls "$commonname" --cert=/tmp/tls.crt --key=/tmp/tls.key -o yaml --dry-run=client | kubectl apply -f - +# Print the SHA-1 thumbprint, the usual way to identify a certificate once it has left this script. +# It has to be printed here: the job deletes its cluster on the way out, so after a failed run there +# is no copy of the certificate left to compute it from. +fingerprint="$(openssl x509 -in /tmp/tls.crt -outform DER | openssl dgst -sha1 | awk '{print toupper($NF)}')" +echo "Certificate common name: ${commonname}" +echo "Certificate SHA-1 fingerprint: ${fingerprint}" + # --max-time bounds the poll itself. curl has no default overall limit, and the # deadline below is only checked between polls, so a connection that stalls # after being accepted would hang here and never reach it. @@ -245,6 +252,7 @@ deadline=$((SECONDS + certificate_timeout_seconds)) until getCertificate; do if ((SECONDS >= deadline)); then echo "Timed out after ${certificate_timeout_seconds}s waiting for certificate ${commonname} to appear in the Venafi inventory" >&2 + echo "Search backend logs for the SHA-1 thumbprint ${fingerprint}, not the common name" >&2 exit 1 fi sleep 30