Add unified /api/certificates inventory endpoint (#782)

* Add /api/certificates: unified cert-manager + TLS-secret inventory

A cluster's serving certs come from two sources: cert-manager.io
Certificate CRs and raw kubernetes.io/tls secrets (cloud-LB, webhook,
gateway, or hand-rolled). Expose a single endpoint that unifies them so
consumers don't have to know which a cluster uses.

pkg/certs.Aggregate owns the merge — dedup of a TLS secret against the
cert-manager Certificate that owns it (by secretName), health rating,
domain formatting, and most-urgent-first sort. The handler does only k8s
I/O: lists cert-manager CRs (absent CRD is fine) and TLS secrets,
skipping sealed-secrets controller keypairs and emitting only public
cert metadata (issuer/domains/expiry), never tls.key. Read with the SA
(inventory pattern) so cert hygiene doesn't vanish for cloud:viewer.

* certs: namespace-scope inventory, surface read errors, add tests

Review follow-ups on handleCertificates:
- Post-filter both legs to the caller's RBAC-allowed namespaces
  (parseNamespacesForUser + MatchesNamespace), matching
  handleSecretCertExpiry / handleListPackages. Previously returned every
  namespace's cert metadata regardless of the caller's scope.
- Stop swallowing read errors uniformly: ignore only ErrUnknownDynamicKind
  (cert-manager absent); log other cert-manager list errors and secret
  list errors; 503 when both legs fail so the fleet view marks the cluster
  errored instead of rendering a misleading empty 'no certs'.
- Extract secretToCertInput so the skip-chain is unit-testable.
- Tests: projectCertManagerCert (issued + not-yet-issued), secretToCertInput
  skip-chain, namespace-scoped dedup, and exact 7/30-day health boundaries.

* certs: floor day count so a just-expired cert reads as expired

int(Hours()/24) truncates toward zero, so a cert that expired an hour ago
got daysLeft=0 ('expires today') instead of -1. Use math.Floor to match
topology.ParsePEMCertificates' semantics; add a test pinning it.

* certs: don't return empty 200 when a cert read failed

handleCertificates only 503'd when BOTH legs failed. On a cluster without
cert-manager the CR leg is benignly absent (cmFailed stays false), so a
failed TLS-secret read fell through to an empty 200 — indistinguishable
from a healthy cluster with no certs, despite secrets being the only
source there. Surface 503 when the result is empty and either leg errored;
a partial success (one leg returned certs) still passes through.

Author: nadaverell

internal/server/certificate.go

@@ -1,13 +1,24 @@
 package server
 
 import (
+	"errors"
 	"log"
 	"net/http"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
 
 	"github.com/skyhook-io/radar/internal/k8s"
+	"github.com/skyhook-io/radar/pkg/certs"
 	"github.com/skyhook-io/radar/pkg/topology"
 )
 
+// sealedSecretsKeyLabel marks a sealed-secrets controller keypair. Those are
+// type=kubernetes.io/tls and parse as real (long-lived, self-signed) x509, but
+// they're an internal encryption key, not a serving certificate anyone renews —
+// so the certificate inventory skips them to stay signal, not noise.
+const sealedSecretsKeyLabel = "sealedsecrets.bitnami.com/sealed-secrets-key"
+
 const (
 	certExpiryWarningDays  = 30
 	certExpiryCriticalDays = 7
@@ -18,6 +29,165 @@ type CertificateInfo = topology.CertificateInfo
 type SecretCertificateInfo = topology.SecretCertificateInfo
 type CertExpiry = topology.CertExpiry
 
+// handleCertificates returns the cluster's unified certificate inventory:
+// cert-manager.io Certificate CRs + raw kubernetes.io/tls secrets, deduped and
+// health-rated by pkg/certs. Backs Radar Hub's fleet Certs view; the merge
+// lives in pkg/certs so the hub stays a thin pivot.
+//
+// Read pattern mirrors handleListPackages: the ServiceAccount-backed cache
+// performs the read (so cert hygiene survives cloud:viewer, whose K8s `view`
+// role excludes secrets), but the response is post-filtered to the caller's
+// RBAC-allowed namespaces. Only public certificate metadata (issuer / domains
+// / expiry) is emitted — never tls.key. A cluster without cert-manager simply
+// contributes no CR rows; that's not an error.
+func (s *Server) handleCertificates(w http.ResponseWriter, r *http.Request) {
+	if !s.requireConnected(w) {
+		return
+	}
+	cache := k8s.GetResourceCache()
+	if cache == nil {
+		s.writeError(w, http.StatusServiceUnavailable, "Resource cache not available")
+		return
+	}
+
+	namespaces := s.parseNamespacesForUser(r)
+	if noNamespaceAccess(namespaces) {
+		s.writeJSON(w, []certs.Cert{})
+		return
+	}
+
+	src := certs.Sources{Now: time.Now().UTC()}
+
+	// cert-manager Certificate CRs. ?group disambiguates from other ecosystems'
+	// "Certificate" kinds. An absent CRD (ErrUnknownDynamicKind) just means the
+	// cluster doesn't run cert-manager — not an error; the TLS-secret leg still
+	// answers. Any OTHER error (RBAC denial, discovery not ready, transient)
+	// would silently drop real cert-manager certs, so log it and remember the
+	// failure rather than rendering a misleadingly-empty inventory.
+	cmFailed := false
+	items, err := cache.ListDynamicWithGroup(r.Context(), "certificates", "", "cert-manager.io")
+	switch {
+	case err == nil:
+		for _, it := range items {
+			if in := projectCertManagerCert(it.Object); topology.MatchesNamespace(namespaces, in.Namespace) {
+				src.CertManager = append(src.CertManager, in)
+			}
+		}
+	case errors.Is(err, k8s.ErrUnknownDynamicKind):
+		// cert-manager not installed — expected.
+	default:
+		log.Printf("[certificate] cert-manager Certificate list failed: %v", err)
+		cmFailed = true
+	}
+
+	// kubernetes.io/tls secrets. We only read tls.crt (the public chain) and
+	// emit metadata; tls.key never leaves the cluster. A nil error with no
+	// secrets is a benign deferred-cache state; a non-nil error means we
+	// genuinely couldn't read secrets.
+	secFailed := false
+	provider := k8s.NewTopologyResourceProvider(cache)
+	if secrets, err := provider.Secrets(); err == nil {
+		for _, sec := range secrets {
+			if !topology.MatchesNamespace(namespaces, sec.Namespace) {
+				continue
+			}
+			if in, ok := secretToCertInput(sec); ok {
+				src.TLSSecrets = append(src.TLSSecrets, in)
+			}
+		}
+	} else {
+		log.Printf("[certificate] TLS secret list failed: %v", err)
+		secFailed = true
+	}
+
+	// An empty result caused by a read error reads as a healthy "no certs"
+	// cluster. Surface it so the fleet view marks the cluster errored rather
+	// than silently green. This matters most on a cluster without cert-manager,
+	// where TLS secrets are the only source: there cmFailed stays false (an
+	// absent CRD is benign), so gating on both legs would miss a failed secret
+	// read. Gate on "no data AND something errored" instead — which still lets
+	// a partial success (one leg returned certs) through.
+	result := certs.Aggregate(src)
+	if len(result) == 0 && (cmFailed || secFailed) {
+		s.writeError(w, http.StatusServiceUnavailable, "certificate inventory temporarily unavailable")
+		return
+	}
+
+	s.writeJSON(w, result)
+}
+
+// secretToCertInput projects a kubernetes.io/tls secret into a certs.Input.
+// ok=false for secrets that aren't serving certs: non-TLS types, sealed-secrets
+// controller keypairs (encryption keys, not renew-able certs), and secrets
+// whose tls.crt is missing or unparseable. Reads only tls.crt — never tls.key.
+func secretToCertInput(sec *corev1.Secret) (certs.Input, bool) {
+	if sec.Type != corev1.SecretTypeTLS {
+		return certs.Input{}, false
+	}
+	if _, sealed := sec.Labels[sealedSecretsKeyLabel]; sealed {
+		return certs.Input{}, false
+	}
+	pem, ok := sec.Data["tls.crt"]
+	if !ok || len(pem) == 0 {
+		return certs.Input{}, false
+	}
+	leaf := topology.ParsePEMCertificates(pem)
+	if len(leaf) == 0 {
+		return certs.Input{}, false
+	}
+	in := certs.Input{
+		Name:      sec.Name,
+		Namespace: sec.Namespace,
+		Issuer:    leaf[0].Issuer,
+		Domains:   leaf[0].SANs,
+		Source:    certs.SourceTLSSecret,
+	}
+	if t, err := time.Parse(time.RFC3339, leaf[0].NotAfter); err == nil {
+		in.NotAfter = &t
+	}
+	return in, true
+}
+
+// projectCertManagerCert maps a cert-manager.io Certificate CR (unstructured)
+// to a certs.Input. status.notAfter is absent when the cert has no issued
+// secret yet (and during some renewal-failure states), in which case NotAfter
+// stays nil (pkg/certs renders it as unknown expiry).
+func projectCertManagerCert(obj map[string]any) certs.Input {
+	md, _ := obj["metadata"].(map[string]any)
+	spec, _ := obj["spec"].(map[string]any)
+	status, _ := obj["status"].(map[string]any)
+	in := certs.Input{
+		Name:       mapString(md, "name"),
+		Namespace:  mapString(md, "namespace"),
+		SecretName: mapString(spec, "secretName"),
+		Source:     certs.SourceCertManager,
+	}
+	if ir, ok := spec["issuerRef"].(map[string]any); ok {
+		in.Issuer = mapString(ir, "name")
+	}
+	if dns, ok := spec["dnsNames"].([]any); ok {
+		for _, d := range dns {
+			if ds, ok := d.(string); ok {
+				in.Domains = append(in.Domains, ds)
+			}
+		}
+	}
+	if na := mapString(status, "notAfter"); na != "" {
+		if t, err := time.Parse(time.RFC3339, na); err == nil {
+			in.NotAfter = &t
+		}
+	}
+	return in
+}
+
+func mapString(m map[string]any, key string) string {
+	if m == nil {
+		return ""
+	}
+	s, _ := m[key].(string)
+	return s
+}
+
 // handleSecretCertExpiry returns certificate expiry for all TLS secrets.
 // Used by the frontend secrets list to show an "Expires" column without
 // parsing certificates client-side.

internal/server/certificate_test.go

@@ -0,0 +1,151 @@
+package server
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"testing"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/skyhook-io/radar/pkg/certs"
+)
+
+// selfSignedPEM returns a PEM-encoded self-signed cert for use as a secret's
+// tls.crt, so secretToCertInput's parse path has a real leaf to read.
+func selfSignedPEM(t *testing.T, cn string, dns []string, notAfter time.Time) []byte {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("gen key: %v", err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: cn},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     notAfter,
+		DNSNames:     dns,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatalf("create cert: %v", err)
+	}
+	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+}
+
+func TestProjectCertManagerCert_Issued(t *testing.T) {
+	notAfter := time.Now().Add(45 * 24 * time.Hour).UTC().Format(time.RFC3339)
+	obj := map[string]any{
+		"metadata": map[string]any{"name": "api-prod", "namespace": "default"},
+		"spec": map[string]any{
+			"secretName": "api-prod-tls",
+			"issuerRef":  map[string]any{"name": "letsencrypt"},
+			"dnsNames":   []any{"api.example.com", "www.example.com"},
+		},
+		"status": map[string]any{"notAfter": notAfter},
+	}
+	in := projectCertManagerCert(obj)
+	if in.Name != "api-prod" || in.Namespace != "default" {
+		t.Errorf("name/namespace = %q/%q, want api-prod/default", in.Name, in.Namespace)
+	}
+	if in.SecretName != "api-prod-tls" {
+		t.Errorf("secretName = %q, want api-prod-tls", in.SecretName)
+	}
+	if in.Issuer != "letsencrypt" {
+		t.Errorf("issuer = %q, want letsencrypt", in.Issuer)
+	}
+	if len(in.Domains) != 2 || in.Domains[0] != "api.example.com" {
+		t.Errorf("domains = %v, want [api.example.com www.example.com]", in.Domains)
+	}
+	if in.Source != certs.SourceCertManager {
+		t.Errorf("source = %q, want cert-manager", in.Source)
+	}
+	if in.NotAfter == nil {
+		t.Error("NotAfter = nil, want parsed time")
+	}
+}
+
+func TestProjectCertManagerCert_NotYetIssued(t *testing.T) {
+	// No status block at all — a Certificate that hasn't been issued.
+	obj := map[string]any{
+		"metadata": map[string]any{"name": "pending", "namespace": "default"},
+		"spec":     map[string]any{"secretName": "pending-tls", "issuerRef": map[string]any{"name": "letsencrypt"}},
+	}
+	in := projectCertManagerCert(obj)
+	if in.Name != "pending" {
+		t.Fatalf("name = %q, want pending", in.Name)
+	}
+	if in.NotAfter != nil {
+		t.Errorf("NotAfter = %v, want nil (no status.notAfter)", in.NotAfter)
+	}
+}
+
+func TestSecretToCertInput_SkipsNonServingSecrets(t *testing.T) {
+	valid := selfSignedPEM(t, "svc.example", []string{"svc.example"}, time.Now().Add(40*24*time.Hour))
+	cases := []struct {
+		name   string
+		secret *corev1.Secret
+		wantOK bool
+	}{
+		{
+			name:   "non-TLS type skipped",
+			secret: &corev1.Secret{Type: corev1.SecretTypeOpaque, Data: map[string][]byte{"tls.crt": valid}},
+			wantOK: false,
+		},
+		{
+			name: "sealed-secrets keypair skipped",
+			secret: &corev1.Secret{
+				Type: corev1.SecretTypeTLS,
+				Data: map[string][]byte{"tls.crt": valid},
+			},
+			wantOK: false, // label set below
+		},
+		{
+			name:   "missing tls.crt skipped",
+			secret: &corev1.Secret{Type: corev1.SecretTypeTLS, Data: map[string][]byte{}},
+			wantOK: false,
+		},
+		{
+			name:   "unparseable tls.crt skipped",
+			secret: &corev1.Secret{Type: corev1.SecretTypeTLS, Data: map[string][]byte{"tls.crt": []byte("not a pem")}},
+			wantOK: false,
+		},
+		{
+			name: "valid TLS serving cert accepted",
+			secret: &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{Name: "web-tls", Namespace: "prod"},
+				Type:       corev1.SecretTypeTLS,
+				Data:       map[string][]byte{"tls.crt": valid},
+			},
+			wantOK: true,
+		},
+	}
+	// Attach the sealed-secrets label to the dedicated case.
+	cases[1].secret.Labels = map[string]string{sealedSecretsKeyLabel: "active"}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			in, ok := secretToCertInput(tc.secret)
+			if ok != tc.wantOK {
+				t.Fatalf("ok = %v, want %v", ok, tc.wantOK)
+			}
+			if tc.wantOK {
+				if in.Name != "web-tls" || in.Namespace != "prod" {
+					t.Errorf("name/namespace = %q/%q, want web-tls/prod", in.Name, in.Namespace)
+				}
+				if in.Source != certs.SourceTLSSecret {
+					t.Errorf("source = %q, want tls-secret", in.Source)
+				}
+				if in.NotAfter == nil {
+					t.Error("NotAfter = nil, want parsed expiry from the leaf cert")
+				}
+			}
+		})
+	}
+}

internal/server/server.go

@@ -291,6 +291,7 @@ func (s *Server) setupRoutes() {
 			r.Get("/resources/{kind}/{namespace}/{name}/cascade-preview", s.handleCascadeDeletePreview)
 			r.Delete("/resources/{kind}/{namespace}/{name}", s.handleDeleteResource)
 			r.Get("/secrets/certificate-expiry", s.handleSecretCertExpiry)
+			r.Get("/certificates", s.handleCertificates)
 
 			// Cluster audit
 			r.Get("/audit", s.handleAudit)