Try to narrow down trust bundle cache flake (#46377)

gravitational · Sep 10, 2024 · feec425 · feec425
1 parent da781bf
commit feec425
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 2 deletions.
diff --git a/lib/tbot/spiffe/trust_bundle_cache.go b/lib/tbot/spiffe/trust_bundle_cache.go
@@ -473,6 +473,11 @@ func (m *TrustBundleCache) processEvent(ctx context.Context, event types.Event)
 				)
 				return
 			}
+			log.DebugContext(
+				ctx,
+				"Processing update for local trust bundle",
+				"trusted_tls_key_pairs", len(ca.GetTrustedTLSKeyPairs()),
+			)
 
 			bundle, err := convertSPIFFECAToBundle(ca)
 			if err != nil {
@@ -494,7 +499,11 @@ func (m *TrustBundleCache) processEvent(ctx context.Context, event types.Event)
 				)
 				return
 			}
-			log.InfoContext(ctx, "Processed update for local trust bundle")
+			log.InfoContext(
+				ctx,
+				"Processed update for local trust bundle",
+				"x509_authorities", len(bundle.X509Authorities()),
+			)
 			bundleSet.Local = bundle
 			m.setAndBroadcastBundleSet(bundleSet)
 		case types.KindSPIFFEFederation:
@@ -516,6 +525,11 @@ func (m *TrustBundleCache) processEvent(ctx context.Context, event types.Event)
 				)
 				return
 			}
+			log.DebugContext(
+				ctx,
+				"Processing update for federated trust bundle",
+			)
+
 			bundle, err := convertSPIFFEFederationToBundle(federation)
 			if err != nil {
 				// TODO: Should we match the behavior for the local trust
@@ -538,7 +552,9 @@ func (m *TrustBundleCache) processEvent(ctx context.Context, event types.Event)
 				return
 			}
 			log.InfoContext(
-				ctx, "Processed update for federated trust bundle",
+				ctx,
+				"Processed update for federated trust bundle",
+				"x509_authorities", len(bundle.X509Authorities()),
 			)
 			bundleSet.Federated[federation.Metadata.Name] = bundle
 			m.setAndBroadcastBundleSet(bundleSet)

diff --git a/lib/tbot/spiffe/trust_bundle_cache_test.go b/lib/tbot/spiffe/trust_bundle_cache_test.go
@@ -250,6 +250,7 @@ func TestTrustBundleCache_Run(t *testing.T) {
 	require.True(t, gotFederatedBundle.Equal(preInitFed))
 
 	// Update the local bundle with a new additional cert
+	ca = ca.Clone()
 	additionalCAKey, additionalCACertPEM, err := tlsca.GenerateSelfSignedCA(pkix.Name{}, []string{}, time.Hour)
 	require.NoError(t, err)
 	additionalCACert, err := tlsca.ParseCertificatePEM(additionalCACertPEM)