feat: add admin-console reset-tls and update-tls commands #3300

banjoh · 2025-12-10T10:48:28Z

What this PR does / why we need it:

Add a new CLI subcommand to securely update Admin Console TLS certificates without using the acceptAnonymousUploads workflow which exposes a security vulnerability.

Usage:
<installer> admin-console update-tls --tls-cert <path> --tls-key <path> [--hostname <hostname>]

The command reads and validates the certificate/key pair, then updates the kotsadm-tls secret. No pod restart is needed as pods using this secret are expected to watch for changes and reload automatically.

Optionally accepts --hostname flag for display URL (not TLS validation).

Which issue(s) this PR fixes:

https://app.shortcut.com/replicated/story/131995/add-cli-subcommand-to-update-admin-console-tls-cert-and-key

Does this PR require a test?

Yes. Automated tests and manual tests

./build/embedded-cluster-darwin-arm64 admin-console update-tls -h
Update the TLS certificate and key used by the embedded-cluster-darwin-arm64 Admin Console.

This command updates the kotsadm-tls secret. Pods using this secret are
expected to watch for changes and automatically reload the TLS configuration.
This provides a secure alternative to the acceptAnonymousUploads workflow.

The --hostname flag is optional and only affects the display URL shown
to users. It does not affect TLS certificate validation.

Usage:
  embedded-cluster-darwin-arm64 admin-console update-tls [flags]

Flags:
  -h, --help              help for update-tls
      --hostname string   Hostname for display in URLs (optional, does not affect TLS validation)
      --tls-cert string   Path to the TLS certificate file (required)
      --tls-key string    Path to the TLS key file (required)

Does this PR require a release note?

Add a new `<installer> admin-console update-tls` CLI subcommand to update Admin Console TLS certificate and key

Does this PR require documentation?

replicatedhq/replicated-docs#3708

Add a new CLI subcommand to securely update Admin Console TLS certificates without using the acceptAnonymousUploads workflow which exposes a security vulnerability. Usage: <installer> admin-console update-tls --tls-cert <path> --tls-key <path> [--hostname <hostname>] The command reads and validates the certificate/key pair, then updates the kotsadm-tls secret. No pod restart is needed as pods using this secret are expected to watch for changes and reload automatically. Optionally accepts --hostname flag for display URL (not TLS validation). Closes: sc-131995 Signed-off-by: Evans Mungai <[email protected]>

cmd/installer/cli/adminconsole_updatetls.go

github-actions · 2025-12-10T11:04:56Z

This PR has been released (on staging) and is available for download with a embedded-cluster-smoke-test-staging-app license ID.

Online Installer:

curl "https://staging.replicated.app/embedded/embedded-cluster-smoke-test-staging-app/ci/appver-dev-50961ed" -H "Authorization: $EC_SMOKE_TEST_LICENSE_ID" -o embedded-cluster-smoke-test-staging-app-ci.tgz

Airgap Installer (may take a few minutes before the airgap bundle is built):

curl "https://staging.replicated.app/embedded/embedded-cluster-smoke-test-staging-app/ci-airgap/appver-dev-50961ed?airgap=true" -H "Authorization: $EC_SMOKE_TEST_LICENSE_ID" -o embedded-cluster-smoke-test-staging-app-ci.tgz

Happy debugging!

Signed-off-by: Evans Mungai <[email protected]>

cmd/installer/cli/adminconsole_updatetls.go

Signed-off-by: Evans Mungai <[email protected]>

JGAntunes · 2025-12-10T14:45:01Z

cmd/installer/cli/adminconsole_updatetls.go

+	cmd := &cobra.Command{
+		Use:   "update-tls",
+		Short: fmt.Sprintf("Update the TLS certificate and key for the %s Admin Console", name),
+		Long: fmt.Sprintf(`Update the TLS certificate and key used by the %s Admin Console.
+
+This command updates the kotsadm-tls secret, or creates it if it does not exist.
+Pods using this secret are expected to watch for changes and automatically reload
+the TLS configuration. This provides a secure alternative to the acceptAnonymousUploads
+workflow.
+
+The --hostname flag is optional and only affects the display URL shown
+to users. It does not affect TLS certificate validation.`, name),
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			if !dryrun.Enabled() && os.Getuid() != 0 {
+				return fmt.Errorf("update-tls command must be run as root")
+			}
+			return nil
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runUpdateTLS(cmd.Context(), tlsCertPath, tlsKeyPath, hostname)
+		},
+	}


Pinging @ajp-io for a 👀 of the copy here.

JGAntunes · 2025-12-10T15:01:27Z

cmd/installer/cli/adminconsole_updatetls.go

+		secret = &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:        kotsadmTLSSecretName,
+				Namespace:   namespace,
+				Labels:      adminconsole.GetKotsadmLabels(),
+				Annotations: adminconsole.GetTLSSecretAnnotations(),
+			},
+			Type: corev1.SecretTypeTLS,
+			Data: map[string][]byte{
+				"tls.crt": certBytes,
+				"tls.key": keyBytes,
+			},
+		}
+		if hostname != "" {
+			secret.StringData = map[string]string{"hostname": hostname}
+		}
+		if err := kcli.Create(ctx, secret); err != nil {
+			return fmt.Errorf("creating kotsadm-tls secret: %w", err)
+		}
+		return nil


What do you think about having methods within the adminconsole package that handle creating the secret object (the actual corev1.Secret not the actual kcli.Create albeit that's just an extra step I guess) and also return the name of the kotsadm-tls secret? This means that if/whenever we change any of the aspects around the secret creation (e.g. add labels, change its name, etc.) we don't need to run around in multiple places in the code, everything is scoped to a single place:

embedded-cluster/pkg/addons/adminconsole/install.go

Lines 224 to 249 in 138ce52

secret := &corev1.Secret{

TypeMeta: metav1.TypeMeta{

Kind: "Secret",

APIVersion: "v1",

},

ObjectMeta: metav1.ObjectMeta{

Name: "kotsadm-tls",

Namespace: a.Namespace(),

Labels: map[string]string{

"kots.io/kotsadm": "true",

"replicated.com/disaster-recovery": "infra",

"replicated.com/disaster-recovery-chart": "admin-console",

},

Annotations: map[string]string{

"acceptAnonymousUploads": "0",

},

},

Type: "kubernetes.io/tls",

Data: map[string][]byte{

"tls.crt": a.TLSCertBytes,

"tls.key": a.TLSKeyBytes,

},

StringData: map[string]string{

"hostname": a.Hostname,

},

}

A recent example of something similar I've tried to do:

https://github.com/replicatedhq/embedded-cluster/pull/3301/files#diff-f583e60a6f6d3f406bb80a0799a5583b027ad763f85ce08619d7d22321a5055f

The general idea being that external components shouldn't need to worry about the particular structure of the secret object, its name, namespace, etc.

Good call. I'll make that change

Signed-off-by: Evans Mungai <[email protected]>

cmd/installer/cli/adminconsole_updatetls.go

Co-authored-by: Alex Parker <[email protected]>

cmd/installer/cli/adminconsole_updatetls_test.go

cursor · 2025-12-10T16:22:32Z

cmd/installer/cli/adminconsole_updatetls_test.go

+	assert.Contains(t, cmd.Short, "Update the TLS certificate")
+	assert.Contains(t, cmd.Long, "kotsadm-tls secret")
+	assert.Contains(t, cmd.Long, "creates it if it does not exist")
+	assert.Contains(t, cmd.Long, "watch for changes")


Bug: Test assertions check for text not in command Long

The test TestAdminConsoleUpdateTLSCmd asserts that cmd.Long contains "kotsadm-tls secret", "creates it if it does not exist", and "watch for changes", but the actual Long string defined in AdminConsoleUpdateTLSCmd doesn't contain any of these phrases. The Long description only mentions the hostname flag behavior. These test assertions will fail.

Additional Locations (1)

cmd/installer/cli/adminconsole_updatetls.go#L28-L32

Signed-off-by: Evans Mungai <[email protected]>

Add a new CLI subcommand to regenerate the Admin Console TLS certificate with a fresh self-signed certificate. Usage: <installer> admin-console reset-tls The command generates a new self-signed certificate using tlsutils.GenerateCertificate with all valid host IP addresses as SANs, then updates the kotsadm-tls secret. Useful for certificate expiry or when host IP addresses have changed. Signed-off-by: Evans Mungai <[email protected]>

cmd/installer/cli/adminconsole_resettls_test.go

Signed-off-by: Evans Mungai <[email protected]>

JGAntunes

Small comment on the tests. IMO I don't know how worthwhile is to validate the cmd config, other than that LGTM 👍 thanks! Love the secret creation cleanup.

JGAntunes · 2025-12-12T11:30:49Z

cmd/installer/cli/adminconsole_resettls_test.go

+func TestAdminConsoleResetTLSCmd(t *testing.T) {
+	ctx := context.Background()
+	cmd := AdminConsoleResetTLSCmd(ctx, "Test App")
+
+	assert.Equal(t, "reset-tls", cmd.Use)
+	assert.Contains(t, cmd.Short, "Reset the TLS certificate")
+	assert.Contains(t, cmd.Short, "self-signed")
+	assert.Contains(t, cmd.Long, "self-signed TLS certificate")


I don't know how worthwhile this test is since we're mostly asserting on the cmd configuration

JGAntunes · 2025-12-12T11:33:47Z

cmd/installer/cli/adminconsole_updatetls_test.go

+func TestAdminConsoleUpdateTLSCmd(t *testing.T) {
+	ctx := context.Background()
+	cmd := AdminConsoleUpdateTLSCmd(ctx, "Test App")
+
+	assert.Equal(t, "update-tls", cmd.Use)
+	assert.Contains(t, cmd.Short, "Update the TLS certificate")
+	assert.Contains(t, cmd.Long, "Update the TLS certificate and key")
+	assert.Contains(t, cmd.Long, "--hostname flag is optional")
+


Same as above.

Signed-off-by: Evans Mungai <[email protected]>

banjoh · 2025-12-16T19:33:06Z

@ajp-io all changes asked for have been addressed

banjoh added the type::feature label Dec 10, 2025

cursor bot reviewed Dec 10, 2025

View reviewed changes

cmd/installer/cli/adminconsole_updatetls.go Show resolved Hide resolved

Review comments

8ef5e84

Signed-off-by: Evans Mungai <[email protected]>

cursor bot reviewed Dec 10, 2025

View reviewed changes

cmd/installer/cli/adminconsole_updatetls.go Show resolved Hide resolved

Add correct labels and annotations to the kotsadm-tls secret

b97bcd9

Signed-off-by: Evans Mungai <[email protected]>

banjoh mentioned this pull request Dec 10, 2025

feat: add CLI subcommand to update admin console TLS certificates replicatedhq/replicated-docs#3708

Open

JGAntunes reviewed Dec 10, 2025

View reviewed changes

DRY tls secret creation code

94b3722

Signed-off-by: Evans Mungai <[email protected]>

ajp-io requested changes Dec 10, 2025

View reviewed changes

cmd/installer/cli/adminconsole_updatetls.go Show resolved Hide resolved

Update cmd/installer/cli/adminconsole_updatetls.go

f4dc40d

Co-authored-by: Alex Parker <[email protected]>

cursor bot reviewed Dec 10, 2025

View reviewed changes

banjoh added 3 commits December 10, 2025 18:28

Fix failing test

a5986e4

Signed-off-by: Evans Mungai <[email protected]>

Set k8s env before running update-tls command

46d0faf

Signed-off-by: Evans Mungai <[email protected]>

cursor bot reviewed Dec 12, 2025

View reviewed changes

cmd/installer/cli/adminconsole_resettls_test.go Outdated Show resolved Hide resolved

cmd/installer/cli/adminconsole_resettls_test.go Outdated Show resolved Hide resolved

Fix failing test

a0edf14

Signed-off-by: Evans Mungai <[email protected]>

banjoh changed the title ~~feat: add admin-console update-tls command~~ feat: add admin-console reset-tls and update-tls commands Dec 12, 2025

JGAntunes reviewed Dec 12, 2025

View reviewed changes

Remove unnecessary tests

50961ed

Signed-off-by: Evans Mungai <[email protected]>

JGAntunes approved these changes Dec 12, 2025

View reviewed changes

ajp-io approved these changes Dec 16, 2025

View reviewed changes

banjoh merged commit 5bf586f into main Dec 16, 2025
54 checks passed

banjoh deleted the evansmungai/sc-131995/add-cli-subcommand-to-update-admin-console branch December 16, 2025 19:35

	secret := &corev1.Secret{
	TypeMeta: metav1.TypeMeta{
	Kind: "Secret",
	APIVersion: "v1",
	},
	ObjectMeta: metav1.ObjectMeta{
	Name: "kotsadm-tls",
	Namespace: a.Namespace(),
	Labels: map[string]string{
	"kots.io/kotsadm": "true",
	"replicated.com/disaster-recovery": "infra",
	"replicated.com/disaster-recovery-chart": "admin-console",
	},
	Annotations: map[string]string{
	"acceptAnonymousUploads": "0",
	},
	},
	Type: "kubernetes.io/tls",
	Data: map[string][]byte{
	"tls.crt": a.TLSCertBytes,
	"tls.key": a.TLSKeyBytes,
	},
	StringData: map[string]string{
	"hostname": a.Hostname,
	},
	}

feat: add admin-console reset-tls and update-tls commands #3300

feat: add admin-console reset-tls and update-tls commands #3300

Uh oh!

Conversation

banjoh commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Does this PR require a test?

Does this PR require a release note?

Does this PR require documentation?

Uh oh!

Uh oh!

github-actions bot commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

JGAntunes Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

JGAntunes Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

banjoh Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor bot Dec 10, 2025

Choose a reason for hiding this comment

Bug: Test assertions check for text not in command Long

Uh oh!

Uh oh!

Uh oh!

JGAntunes left a comment

Choose a reason for hiding this comment

Uh oh!

JGAntunes Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

JGAntunes Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

banjoh commented Dec 16, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

banjoh commented Dec 10, 2025 •

edited

Loading

github-actions bot commented Dec 10, 2025 •

edited

Loading