Drop roxctl dependency, use Central REST API for CRS

.github/workflows/e2e-tests.yml

@@ -60,16 +60,6 @@ jobs:
           chmod +x /usr/local/bin/roxie
           roxie version
 
-      - name: Install roxctl
-        env:
-          ROXCTL_VERSION: "4.10.0"
-          ROXCTL_SHA256: "5db647b14569465866c0162522e83393ebf02f671f4556b1b3ed551b9f8433bc"
-        run: |
-          curl -fsSLo /usr/local/bin/roxctl \
-            "https://mirror.openshift.com/pub/rhacs/assets/${ROXCTL_VERSION}/bin/Linux/roxctl"
-          echo "${ROXCTL_SHA256}  /usr/local/bin/roxctl" | sha256sum -c -
-          chmod +x /usr/local/bin/roxctl
-          roxctl version
 
       - name: Authenticate to GCloud
         if: inputs.cluster-type == 'gke'

README.md

@@ -116,7 +116,6 @@ the cluster to succeed.
 
 Prerequisites:
 - `kubectl` configured to point at your target cluster
-- `roxctl` CLI is installed
 - `roxie` CLI is installed
 
 Deploy using:

go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/fatih/color v1.19.0
 	github.com/google/go-containerregistry v0.21.7
 	github.com/moby/moby/client v0.5.0
+	github.com/pkg/errors v0.9.1
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
@@ -44,7 +45,6 @@ require (
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/x448/float16 v0.8.4 // indirect

internal/deployer/crs.go

@@ -2,43 +2,239 @@ package deployer
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
 	"errors"
 	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"slices"
 	"strings"
+	"time"
 
+	"github.com/stackrox/roxie/internal/errorhelpers"
 	"github.com/stackrox/roxie/internal/k8s"
 )
 
-// generateCRS generates the Central Resource Secret using roxctl
+const (
+	ServiceCACommonName string = `StackRox Certificate Authority`
+	CentralCommonName   string = `CENTRAL_SERVICE: Central`
+)
+
+type crsGenRequest struct {
+	Name string `json:"name"`
+}
+
+type crsGenResponse struct {
+	CRS []byte `json:"crs"`
+}
+
+// generateCRS generates a Cluster Registration Secret via Central's REST API.
 func (d *Deployer) generateCRS(ctx context.Context, clusterName string) (string, error) {
-	crsName := fmt.Sprintf("%s-crs", clusterName)
-	d.logger.Infof("Generating CRS named %q with roxctl...", crsName)
-
-	result, err := d.runRoxctl(ctx, RoxctlOptions{
-		Args: []string{
-			"-e", d.centralEndpoint,
-			"central",
-			"crs",
-			"generate",
-			crsName,
-			"--output=-", // Output to stdout
-		},
-		UseAuthentication: true,
-		MaxAttempts:       5,
-		RetryDelay:        10,
-	})
+	const maxAttempts = 5
+	const baseRetryDelay = 10
 
+	retryableSubstrings := []string{
+		"connection refused",
+		"connection reset",
+		"connection timed out",
+		"timed out",
+		"timeout",
+		"network is unreachable",
+		"temporary failure in name resolution",
+		"no route to host",
+		"tls handshake timeout",
+		"eof",
+		"bad gateway",
+		"service unavailable",
+		"context deadline exceeded",
+		"no such host",
+	}
+
+	client, err := d.centralHTTPClient()
 	if err != nil {
-		return "", fmt.Errorf("failed to generate CRS: %w", err)
+		return "", fmt.Errorf("failed to create HTTP client: %w", err)
+	}
+
+	url := fmt.Sprintf("https://%s/v1/cluster-init/crs", d.centralEndpoint)
+
+	var lastErr error
+	for attempt := 1; attempt <= maxAttempts; attempt++ {
+		if attempt > 1 {
+			waitTime := time.Duration(attempt*baseRetryDelay) * time.Second
+			d.logger.Infof("Retrying CRS generation (attempt %d/%d) after %v...", attempt, maxAttempts, waitTime)
+			select {
+			case <-ctx.Done():
+				return "", ctx.Err()
+			case <-time.After(waitTime):
+			}
+		}
+
+		// Include attempt in name for uniqueness, in case a failure is between addition to DB and reading response.
+		crsName := fmt.Sprintf("%s-crs-%d", clusterName, attempt)
+		d.logger.Infof("Generating CRS named %q via Central API...", crsName)
+
+		reqBody, err := json.Marshal(crsGenRequest{Name: crsName})
+		if err != nil {
+			return "", fmt.Errorf("failed to marshal CRS request: %w", err)
+		}
+
+		req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, strings.NewReader(string(reqBody)))
+		if err != nil {
+			return "", fmt.Errorf("failed to create HTTP request: %w", err)
+		}
+		req.Header.Set("Content-Type", "application/json")
+		req.SetBasicAuth(AdminUsername, d.centralPassword)
+
+		resp, err := client.Do(req)
+		if err != nil {
+			lastErr = err
+			errLower := strings.ToLower(err.Error())
+			if attempt < maxAttempts && slices.ContainsFunc(retryableSubstrings, func(sub string) bool {
+				return strings.Contains(errLower, sub)
+			}) {
+				d.logger.Warningf("Transient error generating CRS: %v", err)
+				continue
+			}
+			return "", fmt.Errorf("failed to generate CRS: %w", err)
+		}
+
+		body, readErr := io.ReadAll(resp.Body)
+		closeErr := resp.Body.Close()
+		if readErr != nil {
+			return "", fmt.Errorf("failed to read CRS response body: %w", readErr)
+		}
+		if closeErr != nil {
+			return "", fmt.Errorf("failed to close CRS response body: %w", closeErr)
+		}
+
+		if resp.StatusCode == http.StatusBadGateway || resp.StatusCode == http.StatusServiceUnavailable {
+			lastErr = fmt.Errorf("server returned %s", resp.Status)
+			if attempt < maxAttempts {
+				d.logger.Warningf("Transient HTTP error generating CRS: %s", resp.Status)
+				continue
+			}
+			return "", lastErr
+		}
+
+		if resp.StatusCode != http.StatusOK {
+			return "", fmt.Errorf("CRS generation failed with status %s: %s", resp.Status, string(body))
+		}
+
+		var crsResp crsGenResponse
+		if err := json.Unmarshal(body, &crsResp); err != nil {
+			return "", fmt.Errorf("failed to parse CRS response: %w", err)
+		}
+
+		crsContent := strings.TrimSpace(string(crsResp.CRS))
+		if crsContent == "" {
+			return "", errors.New("CRS content is empty")
+		}
+
+		d.logger.Success("✓ CRS generated")
+		return crsContent, nil
 	}
 
-	crsContent := strings.TrimSpace(result.Stdout)
-	if crsContent == "" {
-		return "", errors.New("CRS content is empty")
+	return "", fmt.Errorf("CRS generation failed after %d attempts: %w", maxAttempts, lastErr)
+}
+
+// centralHTTPClient returns an HTTP client configured for talking to Central.
+func (d *Deployer) centralHTTPClient() (*http.Client, error) {
+	tlsConfig := &tls.Config{}
+
+	if d.roxCACertFile != "" {
+		pemData, err := os.ReadFile(d.roxCACertFile)
+		if err != nil {
+			return nil, fmt.Errorf("reading CA cert file %s: %w", d.roxCACertFile, err)
+		}
+		pool := x509.NewCertPool()
+		var caCertsAdded int
+		for block, rest := pem.Decode(pemData); block != nil; block, rest = pem.Decode(rest) {
+			cert, err := x509.ParseCertificate(block.Bytes)
+			if err != nil {
+				return nil, fmt.Errorf("parsing CA certificate from %s: %w", d.roxCACertFile, err)
+			}
+			pool.AddCert(cert)
+			caCertsAdded++
+		}
+		d.logger.Infof("Loaded %d CA certificate(s) from %q", caCertsAdded, d.roxCACertFile)
+		tlsConfig.RootCAs = pool
+		tlsConfig.InsecureSkipVerify = true
+		tlsConfig.VerifyPeerCertificate = verifyFunc(tlsConfig)
 	}
 
-	d.logger.Success("✓ CRS generated")
-	return crsContent, nil
+	return &http.Client{
+		Timeout: 30 * time.Second,
+		Transport: &http.Transport{
+			TLSClientConfig: tlsConfig,
+		},
+	}, nil
+}
+
+// logic borrowed from VerifyPeerCertFunc in tlscheck package and serviceCertFallbackVerifier in stackrox/stackrox codebase.
+func verifyFunc(conf *tls.Config) func([][]byte, [][]*x509.Certificate) error {
+	return func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
+
+		if len(rawCerts) == 0 {
+			return errors.New("remote peer presented no certificates")
+		}
+
+		certs := make([]*x509.Certificate, 0, len(rawCerts))
+		for _, rawCert := range rawCerts {
+			cert, err := x509.ParseCertificate(rawCert)
+			if err != nil {
+				return fmt.Errorf("failed to parse peer certificate: %w", err)
+			}
+			certs = append(certs, cert)
+		}
+
+		leaf := certs[0]
+		intermediates := x509.NewCertPool()
+		for _, cert := range certs[1:] {
+			intermediates.AddCert(cert)
+		}
+
+		systemVerifyOpts := x509.VerifyOptions{
+			DNSName:       conf.ServerName,
+			Intermediates: intermediates,
+			Roots:         conf.RootCAs,
+		}
+
+		_, systemVerifyErr := leaf.Verify(systemVerifyOpts)
+		if systemVerifyErr == nil || !isACentralCert(leaf) {
+			return systemVerifyErr
+		}
+
+		verifyErrs := errorhelpers.NewErrorList("verifying central certificate")
+		verifyErrs.AddError(systemVerifyErr)
+
+		serviceVerifyOpts := x509.VerifyOptions{
+			DNSName:       "central.stackrox",
+			Intermediates: intermediates,
+			Roots:         conf.RootCAs,
+		}
+
+		_, serviceVerifyErr := leaf.Verify(serviceVerifyOpts)
+		if serviceVerifyErr == nil {
+			return nil
+		}
+		verifyErrs.AddError(serviceVerifyErr)
+		return verifyErrs.ToError()
+	}
+}
+
+// isACentralCert returns true if the cert's issuer and subject CNs claim look like central's.
+func isACentralCert(cert *x509.Certificate) bool {
+	if cert.Issuer.CommonName != ServiceCACommonName {
+		return false
+	}
+	if cert.Subject.CommonName == CentralCommonName {
+		return true
+	}
+	return false
 }
 
 // applyCRS applies the CRS content to the sensor namespace

internal/deployer/deployer.go

@@ -546,7 +546,7 @@ func (d *Deployer) waitForNamespaceDeletion(namespace string) error {
 
 // checkRequiredTools verifies that required CLI tools are available
 func checkRequiredTools() error {
-	requiredTools := []string{"kubectl", "roxctl"}
+	requiredTools := []string{"kubectl"}
 
 	var missing []string
 	for _, tool := range requiredTools {