Add test ability to reinitialize worker auth roots on startup (#4895)

internal/cmd/commands/server/server.go

@@ -69,6 +69,7 @@ type Command struct {
 	presetConfig                         *atomic.String // for tests
 	flagWorkerAuthWorkerRotationInterval time.Duration  // for tests
 	flagWorkerAuthCaCertificateLifetime  time.Duration  // for tests
+	flagWorkerAuthCaReinitialize         bool           // for tests
 }
 
 func (c *Command) Synopsis() string {
@@ -140,6 +141,11 @@ func (c *Command) Flags() *base.FlagSets {
 		Target: &c.flagWorkerAuthCaCertificateLifetime,
 		Hidden: true,
 	})
+	f.BoolVar(&base.BoolVar{
+		Name:   "worker-auth-ca-reinitialize",
+		Target: &c.flagWorkerAuthCaReinitialize,
+		Hidden: true,
+	})
 
 	f.BoolVar(&base.BoolVar{
 		Name:   "skip-plugins",
@@ -629,6 +635,7 @@ func (c *Command) StartController(ctx context.Context) error {
 		RawConfig: c.Config,
 		Server:    c.Server,
 		TestOverrideWorkerAuthCaCertificateLifetime: c.flagWorkerAuthCaCertificateLifetime,
+		TestWorkerAuthCaReinitialize:                c.flagWorkerAuthCaReinitialize,
 	}
 
 	var err error

internal/daemon/controller/config.go

@@ -21,6 +21,8 @@ type Config struct {
 	DisableAuthorizationFailures bool
 	// Override worker auth CA certificate lifetime for testing
 	TestOverrideWorkerAuthCaCertificateLifetime time.Duration
+	// Reinitialize the roots at startup
+	TestWorkerAuthCaReinitialize bool
 
 	// This is derived from the config.Config. It tracks the state of the
 	// rate limiter's configuration, and is updated if the config changes via a

internal/daemon/controller/controller.go

@@ -475,7 +475,7 @@ func New(ctx context.Context, conf *Config) (*Controller, error) {
 	if err != nil {
 		return nil, fmt.Errorf("unable to instantiate worker auth repository: %w", err)
 	}
-	_, err = server.RotateRoots(ctx, serversRepo, nodeenrollment.WithCertificateLifetime(conf.TestOverrideWorkerAuthCaCertificateLifetime))
+	_, err = server.RotateRoots(ctx, serversRepo, nodeenrollment.WithCertificateLifetime(conf.TestOverrideWorkerAuthCaCertificateLifetime), nodeenrollment.WithReinitializeRoots(conf.TestWorkerAuthCaReinitialize))
 	if err != nil {
 		event.WriteSysEvent(ctx, op, "unable to ensure worker auth roots exist, may be due to multiple controllers starting at once, continuing")
 	}