pki: add unit tests for configurable PKI feature

Add tests covering PKI validation, feature gate enforcement,
certificate generation with PKI configs, and cross-algorithm
certificate signing.

Key additions:
- Test ValidatePKIConfig catches invalid configs and empty PKI
- Test ConfigurablePKI feature gate with TechPreview and CustomNoUpgrade
- Test ValidateInstallConfig catches invalid PKI with field paths
- Test SelfSignedCertKey.Generate() with non-nil PKI configs
- Test ECDSA CA signing RSA leaf certificate with chain verification
- Test RSA/ECDSA key generation, KeyUsage flags, signature algorithm detection
- Test PEM encode/decode roundtrip for RSA and ECDSA keys

Assisted-by: Claude Code (Opus 4.6)

Author: hasbro17

pkg/asset/tls/certkey_test.go

@@ -2,12 +2,17 @@ package tls
 
 import (
 	"context"
+	"crypto/ecdsa"
+	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"net"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+
+	configv1alpha1 "github.com/openshift/api/config/v1alpha1"
+	"github.com/openshift/installer/pkg/types"
 )
 
 func TestSignedCertKeyGenerate(t *testing.T) {
@@ -46,8 +51,14 @@ func TestSignedCertKeyGenerate(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			rootCA := &RootCA{}
-			err := rootCA.Generate(context.Background(), nil)
+			rootCA := &SelfSignedCertKey{}
+			rootCACfg := &CertCfg{
+				Subject:   pkix.Name{CommonName: "test-root-ca", OrganizationalUnit: []string{"openshift"}},
+				KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+				Validity:  ValidityTenYears(),
+				IsCA:      true,
+			}
+			err := rootCA.Generate(context.Background(), rootCACfg, "test-root-ca", nil)
 			assert.NoError(t, err, "failed to generate root CA")
 
 			certKey := &SignedCertKey{}
@@ -90,3 +101,120 @@ func TestSignedCertKeyGenerate(t *testing.T) {
 		})
 	}
 }
+
+func TestSelfSignedCertKeyGenerateWithPKIConfig(t *testing.T) {
+	cases := []struct {
+		name            string
+		pkiConfig       *types.PKIConfig
+		expectKeyType   interface{}
+		expectPubKeyAlg x509.PublicKeyAlgorithm
+	}{
+		{
+			name: "RSA 4096",
+			pkiConfig: &types.PKIConfig{
+				SignerCertificates: configv1alpha1.CertificateConfig{
+					Key: configv1alpha1.KeyConfig{
+						Algorithm: configv1alpha1.KeyAlgorithmRSA,
+						RSA:       configv1alpha1.RSAKeyConfig{KeySize: 4096},
+					},
+				},
+			},
+			expectKeyType:   &rsa.PrivateKey{},
+			expectPubKeyAlg: x509.RSA,
+		},
+		{
+			name: "ECDSA P384",
+			pkiConfig: &types.PKIConfig{
+				SignerCertificates: configv1alpha1.CertificateConfig{
+					Key: configv1alpha1.KeyConfig{
+						Algorithm: configv1alpha1.KeyAlgorithmECDSA,
+						ECDSA:     configv1alpha1.ECDSAKeyConfig{Curve: configv1alpha1.ECDSACurveP384},
+					},
+				},
+			},
+			expectKeyType:   &ecdsa.PrivateKey{},
+			expectPubKeyAlg: x509.ECDSA,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := &CertCfg{
+				Subject:  pkix.Name{CommonName: "test-pki-ca", OrganizationalUnit: []string{"openshift"}},
+				Validity: ValidityTenYears(),
+				IsCA:     true,
+			}
+
+			ca := &SelfSignedCertKey{}
+			err := ca.Generate(context.Background(), cfg, "test-pki-ca", tc.pkiConfig)
+			assert.NoError(t, err)
+
+			key, err := PemToPrivateKey(ca.Key())
+			assert.NoError(t, err)
+			assert.IsType(t, tc.expectKeyType, key)
+
+			cert, err := PemToCertificate(ca.Cert())
+			assert.NoError(t, err)
+			assert.Equal(t, tc.expectPubKeyAlg, cert.PublicKeyAlgorithm)
+			assert.True(t, cert.IsCA)
+		})
+	}
+}
+
+func TestCrossAlgorithmCertificateSigning(t *testing.T) {
+	// Generate ECDSA P384 CA
+	ecdsaPKI := &types.PKIConfig{
+		SignerCertificates: configv1alpha1.CertificateConfig{
+			Key: configv1alpha1.KeyConfig{
+				Algorithm: configv1alpha1.KeyAlgorithmECDSA,
+				ECDSA:     configv1alpha1.ECDSAKeyConfig{Curve: configv1alpha1.ECDSACurveP384},
+			},
+		},
+	}
+	rootCA := &SelfSignedCertKey{}
+	rootCACfg := &CertCfg{
+		Subject:  pkix.Name{CommonName: "ecdsa-ca", OrganizationalUnit: []string{"openshift"}},
+		Validity: ValidityTenYears(),
+		IsCA:     true,
+	}
+	err := rootCA.Generate(context.Background(), rootCACfg, "ecdsa-ca", ecdsaPKI)
+	assert.NoError(t, err)
+
+	// Verify CA key is ECDSA
+	caKey, err := PemToPrivateKey(rootCA.Key())
+	assert.NoError(t, err)
+	assert.IsType(t, &ecdsa.PrivateKey{}, caKey)
+
+	// Generate RSA leaf signed by ECDSA CA
+	leafCfg := &CertCfg{
+		Subject:   pkix.Name{CommonName: "leaf-cert", OrganizationalUnit: []string{"openshift"}},
+		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		Validity:  ValidityTenYears(),
+		DNSNames:  []string{"test.openshift.io"},
+	}
+	certKey := &SignedCertKey{}
+	err = certKey.Generate(context.Background(), leafCfg, rootCA, "cross-algo-leaf", DoNotAppendParent)
+	assert.NoError(t, err)
+
+	// Verify leaf key is RSA (SignedCertKey always generates RSA leaf keys)
+	leafKey, err := PemToPrivateKey(certKey.Key())
+	assert.NoError(t, err)
+	assert.IsType(t, &rsa.PrivateKey{}, leafKey)
+
+	// Verify the leaf cert was signed by the ECDSA CA
+	leafCert, err := PemToCertificate(certKey.Cert())
+	assert.NoError(t, err)
+	assert.Equal(t, x509.ECDSAWithSHA384, leafCert.SignatureAlgorithm)
+
+	// Verify cert chain: leaf validates against CA
+	caCert, err := PemToCertificate(rootCA.Cert())
+	assert.NoError(t, err)
+	certPool := x509.NewCertPool()
+	certPool.AddCert(caCert)
+	_, err = leafCert.Verify(x509.VerifyOptions{
+		Roots:     certPool,
+		DNSName:   "test.openshift.io",
+		KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
+	})
+	assert.NoError(t, err, "leaf cert should validate against ECDSA CA")
+}

pkg/asset/tls/tls_test.go

@@ -1,11 +1,18 @@
 package tls
 
 import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/rand"
+	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	configv1alpha1 "github.com/openshift/api/config/v1alpha1"
 )
 
 func TestSelfSignedCertificate(t *testing.T) {
@@ -105,3 +112,197 @@ func TestSignedCertificate(t *testing.T) {
 		}
 	}
 }
+
+func TestGenerateRSAPrivateKey(t *testing.T) {
+	cases := []struct {
+		name    string
+		keySize int32
+	}{
+		{"RSA 2048", 2048},
+		{"RSA 4096", 4096},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			key, err := GenerateRSAPrivateKey(tc.keySize)
+			assert.NoError(t, err)
+			assert.IsType(t, &rsa.PrivateKey{}, key)
+			assert.Equal(t, int(tc.keySize), key.N.BitLen())
+		})
+	}
+}
+
+func TestGenerateECDSAPrivateKey(t *testing.T) {
+	cases := []struct {
+		name      string
+		curve     configv1alpha1.ECDSACurve
+		expected  elliptic.Curve
+		expectErr bool
+	}{
+		{"P256", configv1alpha1.ECDSACurveP256, elliptic.P256(), false},
+		{"P384", configv1alpha1.ECDSACurveP384, elliptic.P384(), false},
+		{"P521", configv1alpha1.ECDSACurveP521, elliptic.P521(), false},
+		{"invalid", "P224", nil, true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			key, err := GenerateECDSAPrivateKey(tc.curve)
+			if tc.expectErr {
+				assert.Error(t, err)
+				return
+			}
+			assert.NoError(t, err)
+			assert.IsType(t, &ecdsa.PrivateKey{}, key)
+			assert.Equal(t, tc.expected, key.Curve)
+		})
+	}
+}
+
+func TestGenerateSelfSignedCertificateWithParams(t *testing.T) {
+	cases := []struct {
+		name            string
+		params          PrivateKeyParams
+		expectKeyType   interface{}
+		expectPubKeyAlg x509.PublicKeyAlgorithm
+	}{
+		{
+			name: "RSA 4096 CA",
+			params: PrivateKeyParams{
+				Algorithm:  configv1alpha1.KeyAlgorithmRSA,
+				RSAKeySize: 4096,
+			},
+			expectKeyType:   &rsa.PrivateKey{},
+			expectPubKeyAlg: x509.RSA,
+		},
+		{
+			name: "ECDSA P384 CA",
+			params: PrivateKeyParams{
+				Algorithm:  configv1alpha1.KeyAlgorithmECDSA,
+				ECDSACurve: configv1alpha1.ECDSACurveP384,
+			},
+			expectKeyType:   &ecdsa.PrivateKey{},
+			expectPubKeyAlg: x509.ECDSA,
+		},
+		{
+			name: "RSA 2048 CA (default)",
+			params: PrivateKeyParams{
+				Algorithm:  configv1alpha1.KeyAlgorithmRSA,
+				RSAKeySize: 2048,
+			},
+			expectKeyType:   &rsa.PrivateKey{},
+			expectPubKeyAlg: x509.RSA,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := &CertCfg{
+				Subject:  pkix.Name{CommonName: "test-ca", OrganizationalUnit: []string{"openshift"}},
+				Validity: time.Hour,
+				IsCA:     true,
+			}
+			key, cert, err := GenerateSelfSignedCertificate(cfg, tc.params)
+			assert.NoError(t, err)
+			assert.IsType(t, tc.expectKeyType, key)
+			assert.Equal(t, tc.expectPubKeyAlg, cert.PublicKeyAlgorithm)
+			assert.True(t, cert.IsCA)
+		})
+	}
+}
+
+func TestKeyUsageForAlgorithm(t *testing.T) {
+	cases := []struct {
+		name      string
+		params    PrivateKeyParams
+		isCA      bool
+		wantUsage x509.KeyUsage
+		notUsage  x509.KeyUsage
+	}{
+		{
+			name:      "RSA signer",
+			params:    PrivateKeyParams{Algorithm: configv1alpha1.KeyAlgorithmRSA, RSAKeySize: 2048},
+			isCA:      true,
+			wantUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageCertSign,
+		},
+		{
+			name:      "ECDSA signer",
+			params:    PrivateKeyParams{Algorithm: configv1alpha1.KeyAlgorithmECDSA, ECDSACurve: configv1alpha1.ECDSACurveP256},
+			isCA:      true,
+			wantUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+			notUsage:  x509.KeyUsageKeyEncipherment,
+		},
+		{
+			name:      "RSA non-CA",
+			params:    PrivateKeyParams{Algorithm: configv1alpha1.KeyAlgorithmRSA, RSAKeySize: 2048},
+			isCA:      false,
+			wantUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+			notUsage:  x509.KeyUsageCertSign,
+		},
+		{
+			name:      "ECDSA non-CA",
+			params:    PrivateKeyParams{Algorithm: configv1alpha1.KeyAlgorithmECDSA, ECDSACurve: configv1alpha1.ECDSACurveP384},
+			isCA:      false,
+			wantUsage: x509.KeyUsageDigitalSignature,
+			notUsage:  x509.KeyUsageKeyEncipherment | x509.KeyUsageCertSign,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := &CertCfg{
+				Subject:  pkix.Name{CommonName: "test", OrganizationalUnit: []string{"openshift"}},
+				Validity: time.Hour,
+				IsCA:     tc.isCA,
+			}
+			_, cert, err := GenerateSelfSignedCertificate(cfg, tc.params)
+			assert.NoError(t, err)
+			assert.Equal(t, tc.wantUsage, cert.KeyUsage, "KeyUsage mismatch")
+			if tc.notUsage != 0 {
+				assert.Zero(t, cert.KeyUsage&tc.notUsage, "unexpected KeyUsage bits set")
+			}
+		})
+	}
+}
+
+func TestSignatureAlgorithmAutoDetection(t *testing.T) {
+	cases := []struct {
+		name     string
+		params   PrivateKeyParams
+		expected x509.SignatureAlgorithm
+	}{
+		{
+			name:     "RSA",
+			params:   PrivateKeyParams{Algorithm: configv1alpha1.KeyAlgorithmRSA, RSAKeySize: 2048},
+			expected: x509.SHA256WithRSA,
+		},
+		{
+			name:     "ECDSA P256",
+			params:   PrivateKeyParams{Algorithm: configv1alpha1.KeyAlgorithmECDSA, ECDSACurve: configv1alpha1.ECDSACurveP256},
+			expected: x509.ECDSAWithSHA256,
+		},
+		{
+			name:     "ECDSA P384",
+			params:   PrivateKeyParams{Algorithm: configv1alpha1.KeyAlgorithmECDSA, ECDSACurve: configv1alpha1.ECDSACurveP384},
+			expected: x509.ECDSAWithSHA384,
+		},
+		{
+			name:     "ECDSA P521",
+			params:   PrivateKeyParams{Algorithm: configv1alpha1.KeyAlgorithmECDSA, ECDSACurve: configv1alpha1.ECDSACurveP521},
+			expected: x509.ECDSAWithSHA512,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := &CertCfg{
+				Subject:  pkix.Name{CommonName: "test-sig", OrganizationalUnit: []string{"openshift"}},
+				Validity: time.Hour,
+				IsCA:     true,
+			}
+			_, cert, err := GenerateSelfSignedCertificate(cfg, tc.params)
+			assert.NoError(t, err)
+			assert.Equal(t, tc.expected, cert.SignatureAlgorithm)
+		})
+	}
+}