Repository: ratify-project/ratify (go)

Issue:
new helmchart value needed for crl config
### What happened in your environment?

we recently added a new CRL configuration to the configuration file, this config needs to be exposed in the helm chart so this can be configured at ratify install time. Please also add relevant readme/doc.

### What did you expect to happen?

_No response_

### What version of Kubernetes are you running?

_No response_

### What version of Ratify are you running?

_No response_

### Anything else you would like to add?

_No response_

### Are you willing to submit PRs to contribute to this bug fix?

- [ ] Yes, I am willing to implement it.

Pull request:
feat: expose crl config in helm chart
# Description
We recently added a new CRL configuration to the configuration file, this config needs to be exposed in the helm chart so this can be configured at ratify install time.

## What this PR does / why we need it:
1. update the config exposing for helm chart using
2. added description in the chart/readme


## Which issue(s) this PR fixes *(optional, using `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when the PR gets merged)*:
Fixes #2009 

## Type of change

Please delete options that are not relevant.

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [ ] Helm Chart Change (any edit/addition/update that is necessary for changes merged to the `main` branch)
- [ ] This change requires a documentation update

# How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Please also list any relevant details for your test configuration

CI Test: test covered both enable and disable scenarios: 
- [x] Have cache enabled start a case check cache created, remove cache. 
- [x] Start a new test case with cache disabled, valid that cache is not created.


# Checklist:

- [x] Does the affected code have corresponding tests?
- [x] Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
- [ ] Does this introduce breaking changes that would require an announcement or bumping the major version?
- [ ] Do all new files have appropriate license header?

# Post Merge Requirements
- [ ] MAINTAINERS: manually trigger the "Publish Package" workflow after merging any PR that indicates `Helm Chart Change`


Patch:
diff --git a/charts/ratify/README.md b/charts/ratify/README.md
index 721328e..544abe3 100644
--- a/charts/ratify/README.md
+++ b/charts/ratify/README.md
@@ -135,6 +135,7 @@ Values marked `# DEPRECATED` in the `values.yaml` as well as **DEPRECATED** in t
 | logger.formatter                                   | Type of log formatter. Can be set to `text`, `json` or `logstash` output                                                                                                                                                                                                                                                                                               | `text`                            |
 | logger.level                                       | Sets the log level                                                                                                                                                                                                                                                                                                                                                     | `info`                            |
 | logger.requestHeaders.traceIDHeaderName            | List of headers that include the trace ID in the external data requests to Ratify. The same headers will be passed to upstream services like remote registries. e.g. Set it to `x-ms-correlation-request-id` to trace across Azure.                                                                                                                                    | `[]`                              |
+| crl.cache.enabled                                   | Enables/disables CRL Cache                                                                                                                                                                                                                                                                                                                                                      | `true`                           |
 | featureFlags.RATIFY_CERT_ROTATION                  | Enables/disables tls certificate rotation                                                                                                                                                                                                                                                                                                                              | `false`                           |
 | featureFlags.RATIFY_EXPERIMENTAL_HIGH_AVAILABILITY | **EXPERIMENTAL** Enables/disables high availability mode including distributed caching.                                                                                                                                                                                                                                                                                | `false`                           |
 | azureWorkloadIdentity.clientId                     | ClientID of AAD application/Managed identity associated with Workload Identity                                                                                                                                                                                                                                                                                         | ``                                |
diff --git a/charts/ratify/templates/configmap.yaml b/charts/ratify/templates/configmap.yaml
index b1812d0..fab6a49 100644
--- a/charts/ratify/templates/configmap.yaml
+++ b/charts/ratify/templates/configmap.yaml
@@ -14,5 +14,10 @@ data:
       "executor": {
         "verificationRequestTimeout": {{ .Values.provider.timeout.validationTimeoutSeconds | int | mul 1000 | add -100 }},
         "mutationRequestTimeout": {{ .Values.provider.timeout.mutationTimeoutSeconds | int | mul 1000 | add -50 }}
+      },
+      "crl": {
+        "cache": {
+          "enabled": {{ default "true" .Values.crl.cache.enabled }}
+        }
       }
     }
\ No newline at end of file
diff --git a/charts/ratify/values.yaml b/charts/ratify/values.yaml
index 4331702..c60c219 100644
--- a/charts/ratify/values.yaml
+++ b/charts/ratify/values.yaml
@@ -168,6 +168,10 @@ logger:
     traceIDHeaderName: # List of headers that include the trace ID in the external data requests to Ratify. The same headers will be passed to upstream services like remote registries.
       - "" # e.g. Set it to `x-ms-correlation-request-id` to trace across Azure.
 
+crl:
+  cache:
+    enabled: true # Enable CRL cache
+
 # See https://ratify.dev/docs/reference/usage#feature-flags for a list of available feature flags
 featureFlags:
   # RATIFY_FEATURE_NAME: true
diff --git a/config/crlConfig.go b/config/crlConfig.go
index 6059721..f000349 100644
--- a/config/crlConfig.go
+++ b/config/crlConfig.go
@@ -16,5 +16,9 @@ limitations under the License.
 package config
 
 type CRLConfig struct {
-	CacheEnabled bool `json:"cacheEnabled,omitempty"`
+	Cache Cache `json:"cache,omitempty"`
+}
+
+type Cache struct {
+	Enabled bool `json:"enabled,omitempty"`
 }
diff --git a/pkg/verifier/notation/notationrevocationfactory.go b/pkg/verifier/notation/notationrevocationfactory.go
index 80dd621..1a9683a 100644
--- a/pkg/verifier/notation/notationrevocationfactory.go
+++ b/pkg/verifier/notation/notationrevocationfactory.go
@@ -39,7 +39,7 @@ var (
 // The CRLHandler will have its CacheDisabled field set based on the configuration,
 // and it will use a default HTTP client.
 func CreateCRLHandlerFromConfig() RevocationFactory {
-	return &CRLHandler{CacheEnabled: config.CRLConf.CacheEnabled, httpClient: &http.Client{}}
+	return &CRLHandler{CacheEnabled: config.CRLConf.Cache.Enabled, httpClient: &http.Client{}}
 }
 
 // NewFetcher creates a new instance of a Fetcher if it doesn't already exist.
diff --git a/pkg/verifier/notation/revocationfactory.go b/pkg/verifier/notation/revocationfactory.go
index c64cf94..73486bb 100644
--- a/pkg/verifier/notation/revocationfactory.go
+++ b/pkg/verifier/notation/revocationfactory.go
@@ -44,7 +44,7 @@ func CreateCRLFetcher(httpClient *http.Client, cacheRoot string) (corecrl.Fetche
 	if err != nil {
 		return nil, err
 	}
-	if !config.CRLConf.CacheEnabled {
+	if !config.CRLConf.Cache.Enabled {
 		return crlFetcher, nil
 	}
 	cache, err := newFileCache(cacheRoot)


Test patch:
diff --git a/pkg/verifier/notation/revocationfactory_test.go b/pkg/verifier/notation/revocationfactory_test.go
index b443c21..79f9766 100644
--- a/pkg/verifier/notation/revocationfactory_test.go
+++ b/pkg/verifier/notation/revocationfactory_test.go
@@ -118,7 +118,7 @@ func TestCreateCRLFetcher(t *testing.T) {
 
 	t.Run("successful fetcher creation without cache", func(t *testing.T) {
 		// Disable cache
-		config.CRLConf.CacheEnabled = false
+		config.CRLConf.Cache.Enabled = false
 		fetcher, err := CreateCRLFetcher(httpClient, cacheRoot)
 		assert.NoError(t, err)
 		assert.NotNil(t, fetcher)
@@ -126,7 +126,7 @@ func TestCreateCRLFetcher(t *testing.T) {
 
 	t.Run("successful fetcher creation with cache", func(t *testing.T) {
 		// Enable cache
-		config.CRLConf.CacheEnabled = true
+		config.CRLConf.Cache.Enabled = true
 		fetcher, err := CreateCRLFetcher(httpClient, cacheRoot)
 		assert.NoError(t, err)
 		assert.NotNil(t, fetcher)
diff --git a/scripts/generate-crl-testing-certs.sh b/scripts/generate-crl-testing-certs.sh
index a02391a..79ee0c8 100755
--- a/scripts/generate-crl-testing-certs.sh
+++ b/scripts/generate-crl-testing-certs.sh
@@ -146,8 +146,8 @@ basicConstraints       = critical,CA:TRUE,pathlen:0
 keyUsage               = critical,keyCertSign,cRLSign
 subjectKeyIdentifier   = hash
 authorityKeyIdentifier = keyid:always,issuer:always
-crlDistributionPoints  = URI:http://localhost:10086/intermediate.crl
-authorityInfoAccess    = OCSP;URI:http://localhost.test/ocsp
+crlDistributionPoints  = URI:http://yourhost:10086/intermediate.crl
+authorityInfoAccess    = OCSP;URI:http://yourhost.test/ocsp
 
 [ crl_ext ]
 authorityKeyIdentifier = keyid:always
@@ -187,7 +187,7 @@ CN = LeafCert
 [ v3_req ]
 basicConstraints = critical,CA:FALSE
 keyUsage = critical,digitalSignature
-crlDistributionPoints = URI:http://localhost:10086/leaf.crl
+crlDistributionPoints = URI:http://yourhost:10086/leaf.crl
 EOF
 
 # Generate leaf private key
diff --git a/test/bats/base-test.bats b/test/bats/base-test.bats
index 424137a..483bb09 100644
--- a/test/bats/base-test.bats
+++ b/test/bats/base-test.bats
@@ -18,6 +18,7 @@ load helpers
 BATS_TESTS_DIR=${BATS_TESTS_DIR:-test/bats/tests}
 WAIT_TIME=60
 SLEEP_TIME=1
+RATIFY_NAME=ratify
 RATIFY_NAMESPACE=gatekeeper-system
 
 @test "base test without cert rotator" {
@@ -246,6 +247,9 @@ EOF
         # restore the original notation verifier for other tests
         wait_for_process ${WAIT_TIME} ${SLEEP_TIME} 'kubectl replace -f ./config/samples/clustered/verifier/config_v1beta1_verifier_notation.yaml'
     }
+    TARGET_IP=$(ip -4 addr show "eth0" | awk '/inet/ {print $2}' | cut -d'/' -f1)
+    # RATIFY_POD=$(kubectl get pods -n ${RATIFY_NAMESPACE} --no-headers -o custom-columns=":metadata.name" | grep ratify)
+    run kubectl patch deployment ${RATIFY_NAME} -n ${RATIFY_NAMESPACE} --type='merge' -p '{"spec":{"template":{"spec":{"hostAliases":[{"ip":"'"${TARGET_IP}"'","hostnames":["yourhost"]}]}}}}'
 
     # add the tsaroot certificate as an inline key management provider
     cat ./test/bats/tests/config/config_v1beta1_keymanagementprovider_inline.yaml >> crlkmprovider.yaml
diff --git a/test/bats/cli-test.bats b/test/bats/cli-test.bats
index 94b42dd..31f7d80 100644
--- a/test/bats/cli-test.bats
+++ b/test/bats/cli-test.bats
@@ -35,19 +35,22 @@ load helpers
 }
 
 @test "notation verifier crl test" {
+    sudo sed -i '1i 127.0.0.1 yourhost' /etc/hosts
     revoke_crl
 
     run bin/ratify verify -c $RATIFY_DIR/config_notation_crl.json -s $TEST_REGISTRY/notation:crl
     assert_cmd_verify_failure
-
+    
+    check_crl_cache_created
+    
     delete_crl_cache
     check_crl_cache_deleted
     unrevoke_crl
 
-    run bin/ratify verify -c $RATIFY_DIR/config_notation_crl.json -s $TEST_REGISTRY/notation:crl
+    run bin/ratify verify -c $RATIFY_DIR/config_notation_crl_cache_disabled.json -s $TEST_REGISTRY/notation:crl
     assert_cmd_verify_success
 
-    check_crl_cache_created
+    check_crl_cache_deleted
 }
 
 @test "notation verifier with type test" {
diff --git a/test/bats/tests/config/config_notation_crl.json b/test/bats/tests/config/config_notation_crl.json
index cc038e1..3122c49 100644
--- a/test/bats/tests/config/config_notation_crl.json
+++ b/test/bats/tests/config/config_notation_crl.json
@@ -48,6 +48,8 @@
         ]
     },
     "crl": {
-        "cacheEnabled": true
+        "cache":{
+            "enabled": true
+        }
     }
 }
\ No newline at end of file
diff --git a/test/bats/tests/config/config_notation_crl_cache_disabled.json b/test/bats/tests/config/config_notation_crl_cache_disabled.json
new file mode 100644
index 0000000..61b7ac6
--- /dev/null
+++ b/test/bats/tests/config/config_notation_crl_cache_disabled.json
@@ -0,0 +1,55 @@
+{
+    "store": {
+        "version": "1.0.0",
+        "plugins": [
+            {
+                "name": "oras",
+                "cosignEnabled": true,
+                "useHttp": true
+            }
+        ]
+    },
+    "policy": {
+        "version": "1.0.0",
+        "plugin": {
+            "name": "configPolicy"
+        }
+    },
+    "verifier": {
+        "version": "1.0.0",
+        "plugins": [
+            {
+                "name": "notation",
+                "artifactTypes": "application/vnd.cncf.notary.signature",
+                "verificationCerts": [
+                    "~/.config/notation/truststore/x509/ca/crl-test/root.crt"
+                ],
+                "trustPolicyDoc": {
+                    "version": "1.0",
+                    "trustPolicies": [
+                        {
+                            "name": "default",
+                            "registryScopes": [
+                                "*"
+                            ],
+                            "signatureVerification": {
+                                "level": "strict"
+                            },
+                            "trustStores": [
+                                "ca:certs"
+                            ],
+                            "trustedIdentities": [
+                                "*"
+                            ]
+                        }
+                    ]
+                }
+            }
+        ]
+    },
+    "crl": {
+        "cache":{
+            "enabled": false
+        }
+    }
+}
\ No newline at end of file