Add undeletetree command

[pgporada]

While going through the steps to freeze testflume 2019 and 2020, I misstepped requiring me to undelete those shards. Thankfully you've all provided the UndeleteTree api call which made this far less stressful. The misstep was figuring out how to get a frozen_sth for certificate-transparency-go.

Here's how I detected that I needed this

$ curl -s https://testflume.ct.letsencrypt.org/2019/ct/v1/get-sth
Not Found
rpc error: code = NotFound desc = tree 7098813260217451818 not found

$ ./undeletetree --admin_server log-server:8090 --log_id=${LOG_ID}

MariaDB [database]> select TreeId,TreeState,DisplayName,Deleted from Trees;
+---------------------+-----------+-------------+---------+
| TreeId              | TreeState | DisplayName | Deleted |
+---------------------+-----------+-------------+---------+
| 2115833961257890595 | FROZEN    | 2020        |       1 |  
| 7098813260217451818 | FROZEN    | 2019        |       0 |   <==== undeleted
+---------------------+-----------+-------------+---------+
2 rows in set (0.001 sec)

$ curl -s https://testflume.ct.letsencrypt.org/2019/ct/v1/get-sth
{"tree_size":666628491,"timestamp":1614610745490,"sha256_root_hash":"ul1sABvz3nsF6GhyCPDOC2keQPQ8JWDKWIZXqqEWBcM=","tree_head_signature":"BAMARzBFAiAzRHa5zMh0g80Do0U51mGlzoK8uvbCLVgcYHfVdTKlsAIhAMnqPQ53hW9P5bnhksrxUI1yU8fwvt/lkr92bF9Oq84k"}

Here's what I should have done instead:

1. Run updatetree --admin_server log-server:8090 --tree_id=${LOG_ID} -print -tree_state DRAINING
2. Run updatetree --admin_server log-server:8090 --tree_id=${LOG_ID} -print -tree_state FROZEN
3. Get the STH
4. Run deletetree --admin_server log-server:8090 --tree_id=${LOG_ID}

[Martin2112]

If you're just freezing the tree then you don't need to call delete on it, it can stay in frozen state. There is a doc for this process. The draining state is to wait for integration of previous submissions to complete, new ones are blocked.

Maybe the code in this PR could be added to the deletetree command as a flag to avoid duplicating all the gRPC boilerplate?

[pgporada]

@Martin2112 Good idea. I've pushed a change that adds a new flag to deletetree.

[pgporada]

If you're just freezing the tree then you don't need to call delete on it, it can stay in frozen state. There is a doc for this process. The draining state is to wait for integration of previous submissions to complete, new ones are blocked.

I followed the doc and built one tailored to our specific environment. We want to have the treeGC delete the frozen data hence the deletetree call. However, upon running deletetree I was unable to get an STH prompting me to use undeletetree.

Currently our shards are frozen, not deleted. When I find a solution to google/certificate-transparency-go#773 I will be deleting the shards.

[pgporada]

@mhutchinson Could you do a /gcbrun for this please?

[mhutchinson]

/gcbrun

[mhutchinson]

This is failing cloudbuild with errors unrelated to this change:

Running: kubectl apply --server-dry-run -f=examples/deployment/kubernetes/etcd-deployment.yaml
Error: unknown flag: --server-dry-run

This appears to be Praqma/helmsman#607, which is old, but does align with the time this PR was first created.

@pgporada can you rebase this and we'll try again?

[mhutchinson]

Actually it's even simpler than that. It's just that the flag format was actually changed in this repo to work around the change upstream: 54802f7. Once we have that change in this PR we should be golden.

[mhutchinson]

This rebase seems to have gone awry and all of the recent history in the repo is showing as being applied. When I check this out locally the diff against master is fine, but I don't know what's going to happen with the commit history here. I've cherry picked the logical changes on top of HEAD and proposed #2638 in the interests of getting this in. If you are able to fix the git history then we can drop the other and merge this. In case it's helpful, the flow I use for updating branches for github is:

• git checkout master
• git pull
• git checkout $workingbranch
• git rebase -i master
• git push -f

[mhutchinson]

#2638 is merged. Going to close this one now. Thanks for adding this Phil :-)