Upgrade fulcios to use of the google privateca api at v1

[n3wscott]

Signed-off-by: Scott Nichols n3wscott@chainguard.dev

Summary

We were still on a v1beta1 api for the googleca private ca. This adds a flag to use the v1 of the api. We are still needing to update the cert to v1.

The new flag --gcp_private_ca_version selects v1 by default to allow us to drop the flag when we move to v1 certs and then delete the flag and the v1beta1 codepaths.

Ticket Link

Relates to a checkbox in #191

Release Note

Fulcio now can use the v1 api for google privateca.

[dlorenc]

This needs a hold until we move off of the beta1 cert right?

[n3wscott]

This needs a hold until we move off of the beta1 cert right?

hm, let me look into that. As far as the docs talked about it, it is the api to talk with the cert issuer and I did not see anything about v1 vs v1beta1 certs but.... let me look

[dlorenc]

hm, let me look into that. As far as the docs talked about it, it is the api to talk with the cert issuer and I did not see anything about v1 vs v1beta1 certs but.... let me look

The "collection path" to actually address the cert changed (they added a "certpool" concept), so that's why very few things work with both...

[bobcallaway]

I tried this a couple weeks ago and it did not work for me with the beta objects

[n3wscott]

Okay, how about this strat @bobcallaway and @dlorenc? We can select which version and use that API. We are free to upgrade to v1 and not need to change the code. When we do that we can drop the code path.

[bobcallaway]

+1 to the concept. we should probably write a proper interface for the CA as the code as it stands is a bit wonky. I have a fair bit of that work done but if this unblocks you we can start with this and generalize later.

[dlorenc]

Awesome, this is great.

[n3wscott]

updated the title and description to include the fact that there is a flag now.

[bobcallaway]

@n3wscott I took a pass at breaking this apart in #220 more cleanly - I'd appreciate any comments you have on that

[haydentherapper]

I'm working on updating this PR.

[n3wscott]

sorry @haydentherapper I just updated it!

[haydentherapper]

Thanks @n3wscott! Is there anything else that needs to be updated with the PR now?

[mattmoor]

This LGTM. @bobcallaway anything else?

[bobcallaway]

LGTM

[n3wscott]

@haydentherapper we need to use the new V1 cert and change the flags we use to start the server. I am a little unclear how that works

[dlorenc]

@asraa and I caught up yesterday. There's one more missing PR in cosign to add the new root cert, then we can test this!