Merge ~bjornt/maas:create-certificate-websocket into maas:master

[Björn Tillenius]

Add a websocket function for generating a client certificate.

This can be used to generate a certificate to pass along when creating a VM
host.

[MAAS Lander (maas-lander)]

UNIT TESTS
-b create-certificate-websocket lp:~bjornt/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: a08a820ab61924975f34611a7eb8284e2c1fe969

review: Approve

[Alberto Donato (ack)]

+1

one minor question inline

review: Approve

[MAAS Lander (maas-lander)]

LANDING
-b create-certificate-websocket lp:~bjornt/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci.internal:8080/job/maas/job/branch-tester/10817/consoleText

[MAAS Lander (maas-lander)]

UNIT TESTS
-b create-certificate-websocket lp:~bjornt/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: 329bb4d5a12510a4ed88fab1a332e65d5652f84d

review: Approve

[MAAS Lander (maas-lander)]

LANDING
-b create-certificate-websocket lp:~bjornt/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci.internal:8080/job/maas/job/branch-tester/10821/consoleText

diff --git a/src/maasserver/forms/pods.py b/src/maasserver/forms/pods.py
index d361d01..9a9eee0 100644
--- a/src/maasserver/forms/pods.py
+++ b/src/maasserver/forms/pods.py
@@ -44,7 +44,6 @@ from maasserver.forms import MAASModelForm
 from maasserver.models import (
     BMC,
     BMCRoutableRackControllerRelationship,
-    Config,
     Domain,
     Event,
     Interface,
@@ -66,6 +65,7 @@ from maasserver.node_constraint_filter_forms import (
 )
 from maasserver.rpc import getClientFromIdentifiers
 from maasserver.utils import absolute_reverse
+from maasserver.utils.certificates import get_maas_client_cn
 from maasserver.utils.dns import validate_hostname
 from maasserver.utils.forms import set_form_error
 from maasserver.utils.orm import post_commit_do, transactional
@@ -295,10 +295,8 @@ class PodForm(MAASModelForm):
             and not cleaned_data.get("key")
         )
         if should_generate_cert:
-            maas_name = Config.objects.get_config("maas_name")
             pod_name = cleaned_data.get("name")
-            cn = f"{pod_name}@{maas_name}" if pod_name else maas_name
-            cert = generate_certificate(cn)
+            cert = generate_certificate(get_maas_client_cn(pod_name))
             cleaned_data["certificate"] = cert.certificate_pem()
             cleaned_data["key"] = cert.private_key_pem()
 
diff --git a/src/maasserver/utils/certificates.py b/src/maasserver/utils/certificates.py
new file mode 100644
index 0000000..ad8d225
--- /dev/null
+++ b/src/maasserver/utils/certificates.py
@@ -0,0 +1,15 @@
+from maasserver.models import Config
+
+
+def get_maas_client_cn(object_name):
+    """Get a CN suitable for a client certificate.
+
+    If the certificate is for a model object, like a Pod, the name of
+    the object should be passed in, and the CN will look like
+    '$maas_name@object_name'
+
+    If the client certificate isn't tied to a specific object, None can
+    be passed in, which will result in the CN beeing the MAAS name.
+    """
+    maas_name = Config.objects.get_config("maas_name")
+    return f"{object_name}@{maas_name}" if object_name else maas_name
diff --git a/src/maasserver/utils/tests/test_certificates.py b/src/maasserver/utils/tests/test_certificates.py
new file mode 100644
index 0000000..f9e69a2
--- /dev/null
+++ b/src/maasserver/utils/tests/test_certificates.py
@@ -0,0 +1,14 @@
+from maasserver.models import Config
+from maasserver.testing.testcase import MAASServerTestCase
+from maasserver.utils.certificates import get_maas_client_cn
+
+
+class TestGetMAASClientCN(MAASServerTestCase):
+    def test_with_object(self):
+        Config.objects.set_config("maas_name", "my-maas")
+        object_name = "my-object"
+        self.assertEqual("my-object@my-maas", get_maas_client_cn(object_name))
+
+    def test_no_object(self):
+        Config.objects.set_config("maas_name", "my-maas")
+        self.assertEqual("my-maas", get_maas_client_cn(None))
diff --git a/src/maasserver/websockets/handlers/general.py b/src/maasserver/websockets/handlers/general.py
index cdbc104..c9d06ef 100644
--- a/src/maasserver/websockets/handlers/general.py
+++ b/src/maasserver/websockets/handlers/general.py
@@ -25,6 +25,7 @@ from maasserver.models.node import Node
 from maasserver.models.packagerepository import PackageRepository
 from maasserver.node_action import ACTIONS_DICT
 from maasserver.permissions import NodePermission
+from maasserver.utils.certificates import get_maas_client_cn
 from maasserver.utils.osystems import (
     list_all_usable_hwe_kernels,
     list_all_usable_osystems,
@@ -35,6 +36,7 @@ from maasserver.utils.osystems import (
 )
 from maasserver.websockets.base import Handler
 from provisioningserver.boot import BootMethodRegistry
+from provisioningserver.certificates import generate_certificate
 
 
 class GeneralHandler(Handler):
@@ -47,6 +49,7 @@ class GeneralHandler(Handler):
             "components_to_disable",
             "default_min_hwe_kernel",
             "device_actions",
+            "generate_client_certificate",
             "hwe_kernels",
             "known_architectures",
             "known_boot_architectures",
@@ -236,3 +239,22 @@ class GeneralHandler(Handler):
             for _, boot_method in BootMethodRegistry
             if boot_method.arch_octet or boot_method.user_class
         ]
+
+    def generate_client_certificate(self, params):
+        """Generate a client X509 client certificate.
+
+        This can be used for something like a LXD VM host. The
+        certificate is not stored in the DB, so that caller is
+        responsible for keeping track of it and pass it around.
+
+        If object_name is passed, the certificate's CN will be
+        $objectname@$maas_name. If not, the CN will be $maas_name.
+        """
+        cert = generate_certificate(
+            get_maas_client_cn(params.get("object_name"))
+        )
+        return {
+            "CN": cert.cn(),
+            "certificate": cert.certificate_pem(),
+            "private_key": cert.private_key_pem(),
+        }
diff --git a/src/maasserver/websockets/handlers/tests/test_general.py b/src/maasserver/websockets/handlers/tests/test_general.py
index 2edad9b..4789e5e 100644
--- a/src/maasserver/websockets/handlers/tests/test_general.py
+++ b/src/maasserver/websockets/handlers/tests/test_general.py
@@ -365,3 +365,31 @@ class TestGeneralHandler(MAASServerTestCase):
             ],
             handler.known_boot_architectures({}),
         )
+
+    def test_generate_certificate_no_name(self):
+        Config.objects.set_config("maas_name", "mymaas")
+        handler = GeneralHandler(factory.make_User(), {}, None)
+        result = handler.generate_client_certificate({})
+        self.assertEqual(result["CN"], "mymaas")
+        self.assertTrue(
+            result["certificate"].startswith("-----BEGIN CERTIFICATE-----"),
+            result["certificate"],
+        )
+        self.assertTrue(
+            result["private_key"].startswith("-----BEGIN PRIVATE KEY-----"),
+            result["private_key"],
+        )
+
+    def test_generate_certificate_with_name(self):
+        Config.objects.set_config("maas_name", "mymaas")
+        handler = GeneralHandler(factory.make_User(), {}, None)
+        result = handler.generate_client_certificate({"object_name": "mypod"})
+        self.assertEqual(result["CN"], "mypod@mymaas")
+        self.assertTrue(
+            result["certificate"].startswith("-----BEGIN CERTIFICATE-----"),
+            result["certificate"],
+        )
+        self.assertTrue(
+            result["private_key"].startswith("-----BEGIN PRIVATE KEY-----"),
+            result["private_key"],
+        )