Add skupper debug cert subcommand to inspect X.509 certificates by AryanP123 · Pull Request #2575 · skupperproject/skupper

AryanP123 · 2026-09-15T19:07:35Z

Fixes #2569

Summary by CodeRabbit

New Features
- Added the debug cert-inspect command for inspecting certificates.
- View certificates from Kubernetes resources, local files, or configured certificate directories.
- Inspect DNS names, IP addresses, email addresses, and URI subject alternative names.
- Display certificate details in table, detailed, or structured output formats.
- Select a certificate by name or inspect all available certificates.
- Identify certificates designated for signing.
- Added validation for certificate names, file paths, and output formats.

Fixes skupperproject#2569

coderabbitai · 2026-09-15T19:07:53Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: fb59a453-a69b-438d-92de-4f38a8afe1c1

📥 Commits

Reviewing files that changed from the base of the PR and between dc103aa and eb054ab.

📒 Files selected for processing (4)

internal/cmd/skupper/debug/cert/display.go
internal/cmd/skupper/debug/kube/cert.go
internal/cmd/skupper/debug/kube/cert_test.go
internal/cmd/skupper/debug/nonkube/cert.go

🚧 Files skipped from review as they are similar to previous changes (1)

internal/cmd/skupper/debug/cert/display.go

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Walkthrough

Walkthrough

The PR adds a debug cert-inspect command. It parses and displays X.509 certificates from local files, Kubernetes resources, or non-Kubernetes certificate directories. It supports named inspection, listing, and output format selection.

Changes

Certificate Debugging

Layer / File(s)	Summary
Certificate parsing and display `internal/cmd/skupper/common/flags.go`, `internal/cmd/skupper/debug/cert/*`	Adds shared certificate flags, parses DNS, IP, email, and URI SANs, updates SAN rendering, and adds parsing tests.
Debug command registration and flags `internal/cmd/skupper/debug/debug.go`, `internal/cmd/skupper/debug/debug_test.go`	Registers `debug cert-inspect`, adds `output` and `file` flags, and tests command construction.
Kubernetes certificate inspection `internal/cmd/skupper/debug/kube/cert.go`, `internal/cmd/skupper/debug/kube/cert_test.go`	Retrieves Certificate resources and backing Secrets, parses `tls.crt`, attaches status and signing information, and validates command input.
Non-Kubernetes certificate inspection `internal/cmd/skupper/debug/nonkube/cert.go`	Reads certificates from configured directories, input Secret files, or a local file. It supports named selection, duplicate handling, and certificate display.

Priority: ⬇️ Low

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Operator
  participant DebugCertCommand
  participant CertificateSource
  participant certdisplay
  Operator->>DebugCertCommand: run debug cert-inspect
  DebugCertCommand->>CertificateSource: retrieve file, Secret, Certificate resource, or directory certificate
  CertificateSource-->>DebugCertCommand: certificate bytes and metadata
  DebugCertCommand->>certdisplay: parse and format certificate information
  certdisplay-->>Operator: formatted certificate output

Merge Risk: ⚪ Minimal · up to eb054

This change adds a new read-only certificate inspection subcommand for debugging. Existing behavior is unaffected, and no blocking problems were found in the certificate collection or display paths.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 4.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 8 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a Skupper debug subcommand for inspecting X.509 certificates.
Linked Issues check	✅ Passed	The pull request meets the coding requirements in issue `#2569`. `NewCmdDebug` registers `debug cert-inspect`. The command inspects local PEM files, Kubernetes `Certificate` resources and TLS Secrets, a…
Out of Scope Changes check	✅ Passed	The changes stay within issue `#2569`. Command registration, certificate-source discovery, X.509 decoding, field rendering, signing status, validation, and automated tests directly support certificate i…

Fix all pre-merge checks with AI

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 3ca8a54f-8e13-4328-8ee7-d77e5f804bfb

📥 Commits

Reviewing files that changed from the base of the PR and between b50fd85 and ed406d5.

📒 Files selected for processing (8)

internal/cmd/skupper/common/flags.go
internal/cmd/skupper/debug/cert/display.go
internal/cmd/skupper/debug/cert/display_test.go
internal/cmd/skupper/debug/debug.go
internal/cmd/skupper/debug/debug_test.go
internal/cmd/skupper/debug/kube/cert.go
internal/cmd/skupper/debug/kube/cert_test.go
internal/cmd/skupper/debug/nonkube/cert.go

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

Run go fmt on cert_test.go, include email/URI SANs in cert output, and fix non-kube input cert deduplication by display name.

ajssmith · 2026-09-16T15:15:21Z

Suggest sub-command name convey the scope e.g. "cert-inspect" or similar

fgiorgetti

Along with my other comments, I have two other suggestions that could be useful here:

Flag to export the public certificate as a file

Something like --dump-certificate=tls.crt.

Flag to validate-cert-authority

If the provided certificate is a CA we could also verify if it has authority over the provided --validate-cert-authority=tls.crt.

@ajssmith @AryanP123 let me know your thoughts on this. And if you guys believe it is useful, feel free to use better names for the suggested flags.

fgiorgetti · 2026-09-16T13:47:51Z

+	}
+
+	if cmd.certName != "" {
+		certificate, err := cmd.Client.Certificates(cmd.Namespace).Get(context.TODO(), cmd.certName, metav1.GetOptions{})


Should we return an error here, requiring a "Certificate" resource to exist, or should we try to read a Secret with the given name?
The reason why I am asking this, is to validate a Secret resource that might be used by a Link resource, which won't have a corresponding Certificate resource.

fgiorgetti · 2026-09-16T14:22:09Z

+		basePath api.InternalPath
+		prefix   string
+	}{
+		{api.CertificatesPath, ""},


Also include: api.IssuersPath, api.InputIssuersPath.
Along with that, I have a similar comment to add.
System site users can also provide custom certificates through Secrets.
Maybe we should also include Secrets provided through: api.InputSiteStatePath.

Thanks @fgiorgetti makes sense.

For kube, I'll try the Certificate CR first, then fall back to a TLS Secret with the same name, and include standalone TLS secrets in list output.

For non-kube, I'll add runtime/issuers, input/issuers, and TLS secrets from input/resources.

Happy to do --dump-certificate / --validate-cert-authority in a follow-up unless you want them here in this PR.

@AryanP123 it can be done separately for sure, thanks!

Rename cert to cert-inspect, fall back to TLS Secrets on kube, and scan issuers and input resource secrets on non-kube.

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f2429f07-994b-489a-8d7b-fa621d013e89

📥 Commits

Reviewing files that changed from the base of the PR and between aca857d and dc103aa.

📒 Files selected for processing (4)

internal/cmd/skupper/debug/debug.go
internal/cmd/skupper/debug/kube/cert.go
internal/cmd/skupper/debug/kube/cert_test.go
internal/cmd/skupper/debug/nonkube/cert.go

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

pwright · 2026-09-17T17:17:00Z

Given that some users bring their own certs, does it make sense to also report 'signing capability', or as LLM says:

Since CertificateSpec.Signing is already available on the kube-side CR (used to distinguish CA-generation vs leaf-signing in mgr.go's generateSecret: mgr.go:363-371 ), consider surfacing it as an explicit Is Signing Cert field in cert-inspect output for kube, distinct from the x509-derived IsCA. For nonkube, note that this would currently need to be inferred from directory (issuers/ vs certs/) since no Certificate spec is loaded there.

Surface Is Signing Cert from Certificate CR (kube) or issuers path (non-kube), and only ignore missing directories when scanning certs.

Add skupper debug cert subcommand to inspect X.509 certificates

ed406d5

Fixes skupperproject#2569

AryanP123 requested review from c-kruse, fgiorgetti and nluaces as code owners September 15, 2026 19:07

coderabbitai Bot reviewed Sep 15, 2026

View reviewed changes

Comment thread internal/cmd/skupper/debug/cert/display.go

Comment thread internal/cmd/skupper/debug/nonkube/cert.go Outdated

Fix formatting and address review feedback for debug cert

aca857d

Run go fmt on cert_test.go, include email/URI SANs in cert output, and fix non-kube input cert deduplication by display name.

fgiorgetti reviewed Sep 16, 2026

View reviewed changes

Address review feedback for debug cert-inspect

dc103aa

Rename cert to cert-inspect, fall back to TLS Secrets on kube, and scan issuers and input resource secrets on non-kube.

coderabbitai Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread internal/cmd/skupper/debug/nonkube/cert.go Outdated

Address cert-inspect review feedback for signing and errors

eb054ab

Surface Is Signing Cert from Certificate CR (kube) or issuers path (non-kube), and only ignore missing directories when scanning certs.

Navigation Menu

Add skupper debug cert subcommand to inspect X.509 certificates - #2575

Add skupper debug cert subcommand to inspect X.509 certificates#2575
AryanP123 wants to merge 4 commits into
skupperproject:mainfrom
AryanP123:debug-cert-subcommand

AryanP123 commented Sep 15, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Sep 15, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

ajssmith commented Sep 16, 2026

Uh oh!

fgiorgetti left a comment •

edited

Loading

Uh oh!

fgiorgetti Sep 16, 2026

Uh oh!

fgiorgetti Sep 16, 2026

Uh oh!

AryanP123 Sep 17, 2026

Uh oh!

fgiorgetti Sep 17, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

pwright commented Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

AryanP123 commented Sep 15, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ajssmith commented Sep 16, 2026

Uh oh!

fgiorgetti left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fgiorgetti Sep 16, 2026

Choose a reason for hiding this comment

Uh oh!

fgiorgetti Sep 16, 2026

Choose a reason for hiding this comment

Uh oh!

AryanP123 Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

fgiorgetti Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pwright commented Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

AryanP123 commented Sep 15, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 15, 2026 •

edited

Loading

fgiorgetti left a comment •

edited

Loading