Update nodeenrollment to fix TLS issue; add debug (#3231)

* Add more logging to worker auth rotation and test flags

This makes it much easier to figure out when and why rotation is
happening and control it for tests/debugging.

* Update auth rotation logic

Because we were looking at validity period of client certs, which may
not have matched the actual rotation interval, it was possible (mostly
in test scenarios) for the rotation to happen multiple times on the
roots before we actually hit the worker rotation interval.

This changes how the interval is calculated by looking at the difference
between not-after values on the certs to understand the rotation
interval being used by the controller. We then use that as the starting
point for calculating a next-rotation time.

internal/server/job/options_test.go

@@ -10,15 +10,15 @@ import (
 func Test_GetOpts(t *testing.T) {
 	t.Parallel()
 	t.Run("WithRotationFrequency", func(t *testing.T) {
-		opts := getOpts(WithRotationFrequency(time.Minute))
 		testOpts := getDefaultOptions()
 		assert.Equal(t, testOpts.withRotationFrequency, defaultRotationFrequency)
+		opts := getOpts(WithRotationFrequency(time.Minute))
 		assert.Equal(t, time.Minute, opts.withRotationFrequency)
 	})
 	t.Run("WithCertificateLifetime", func(t *testing.T) {
-		opts := getOpts(WithCertificateLifetime(time.Minute))
 		testOpts := getDefaultOptions()
-		assert.Equal(t, testOpts.withCertificateLifetime, defaultRotationFrequency)
+		assert.Equal(t, testOpts.withCertificateLifetime, time.Duration(0))
+		opts := getOpts(WithCertificateLifetime(time.Minute))
 		assert.Equal(t, time.Minute, opts.withCertificateLifetime)
 	})
 }

internal/server/service_rotate_roots.go

@@ -34,8 +34,6 @@ func RotateRoots(ctx context.Context, workerAuthRepo *WorkerAuthRepositoryStorag
 	}
 	opt = append(opt,
 		nodeenrollment.WithState(rootCerts.GetState()),
-		nodeenrollment.WithNotAfterClockSkew(0),
-		nodeenrollment.WithNotBeforeClockSkew(0),
 	)
 
 	var current, next string