🤖 fix: date the serving CA's NotAfter from the injected clock

[ThomasK33]

Summary

The serving CA's NotAfter now comes from the injected clock, like its NotBefore since #223. Generate(namespace, now) builds the CA template itself instead of calling certutil.NewSelfSignedCACert, so both ends of the CA's validity derive from now.

Fixes #224

Background

certutil.NewSelfSignedCACert takes NotAfter from its own time.Now() + 10 years (vendor/k8s.io/client-go/util/cert/cert.go:61,79), and certutil.Config has no field to override it. The serving certificate is clamped to the CA's NotAfter. Today this only moves a 10-year boundary, but it makes long-horizon tests and clock-skewed replicas harder to reason about.

Implementation

• New exported constant CAValidity = 10 * 365 * 24h: the same 10 years that certutil uses.
• Generate creates the self-signed CA with x509.CreateCertificate. Every field is the same as certutil's: subject CN and organization, DNSNames: [CN], key usages, basic constraints, IsCA. NotBefore = now - 1h (unchanged from 🤖 fix: date the serving CA from the injected clock and backdate it #223), and NotAfter = now + CAValidity.
• A small randomSerial() helper now generates the serial for both the CA and the serving certificate (same algorithm as before: uniform in [1, MaxInt64)).
• New test TestGenerateDatesCAValidityWindowFromFarPastClock uses now = 2001-02-03T04:05:06Z. It asserts the CA's NotBefore and NotAfter and the serving NotAfter exactly, that Parse and NeedsRenewal accept the bundle at now, and that Parse at the wall clock reports an expired CA.

Validation

• The new test fails on main (CA NotAfter = 2036-10-10 ..., want 2011-02-01 04:05:06) and passes with the fix.
• A throwaway test (not committed) generated a CA with Generate and one with certutil.NewSelfSignedCACert from the same key and NotBefore. After the raw bytes, signature, serial and NotAfter were cleared, the two parsed x509.Certificate values were reflect.DeepEqual. So the extensions, the subject key ID and the key usages did not change.
• Local gates: make verify-vendor, make test, make test-integration, make build, make lint, GOFLAGS=-mod=vendor go tool govulncheck ./..., and go test -race on internal/aggregated/servingcert and internal/app/apiserverapp.

Risks

Low. Only newly generated CAs change, and only by the time between now and certutil's wall clock (normally zero). Existing Secrets are parsed as before. The docs statement "The CA is valid for 10 years" stays true.

---

Generated with mux • Model: anthropic:claude-opus-5-5 • Thinking: high

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T10:55:33.247875Z	bd34fd9	Manual request
🔒 Security Review	✅ Completed 2026-10-13T10:57:07.880394Z	bd34fd9	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: bd34fd9e12

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: bd34fd9e12

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.