feat(nvlink-manager): don't read desired cert from the filesystem when deciding whether NVswitch cert rotation is required.

[tmcroberts97]

Description

Currently, the switch monitor reads a cert from a configured file location, and compares its fingerprint with the fingerprint of the cert presented by the switch. If there's a mismatch, the monitor triggers a cert rotation.

Instead, just check the expiry of the cert presented by the switch; if it expires within a configured timeframe, trigger cert rotation via the rack state machine. This means NICo does not need the secret to be mounted in its filesystem.

Related issues

#2327

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Additional Notes

[tmcroberts97]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 236f6eda-475a-460f-b6dc-1d2d5d3e19f2

📥 Commits

Reviewing files that changed from the base of the PR and between 2de970b and 01d1377.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• crates/api-core/src/cfg/README.md
• crates/api-core/src/tests/nvl_instance.rs
• crates/nvlink-manager/Cargo.toml
• crates/nvlink-manager/src/config.rs
• crates/nvlink-manager/src/switch_cert_monitor.rs

💤 Files with no reviewable changes (1)

• crates/nvlink-manager/Cargo.toml

---

Summary by CodeRabbit

• New Features
  • Added expiry-driven NMX-C certificate rotation controls, including rotation window, enablement, interval, and probe timeout settings.
  • Added support for rotating certificates before they expire and reporting certificates that require rotation.
• Bug Fixes
  • Maintenance requests are now triggered only when certificates fall within the configured rotation window.
  • Preserved compatibility with the legacy certificate rotation setting name.
• Documentation
  • Updated configuration documentation to describe the new certificate rotation behavior and settings.

Walkthrough

NMX-C certificate rotation now uses certificate expiry windows instead of desired-certificate mismatches. Configuration, monitoring metrics, maintenance decisions, compatibility aliases, and integration tests were updated accordingly.

Changes

NMX-C certificate rotation

Layer / File(s)	Summary
Rotation configuration and compatibility crates/nvlink-manager/src/config.rs, crates/api-core/src/cfg/README.md	Adds rotate_before_expiry, preserves the expiry_warning_window serde alias, updates defaults, tests, and documents the rotation settings.
Expiry-window monitoring and reporting crates/nvlink-manager/src/switch_cert_monitor.rs	Bases rotation decisions on observed certificate expiry, removes desired-certificate comparison and PEM lookup paths, and updates iteration and OpenTelemetry metrics.
Rotation-window integration coverage crates/api-core/src/tests/nvl_instance.rs, crates/nvlink-manager/Cargo.toml	Tests certificates inside and outside the rotation window and removes the unused tempfile development dependency.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant NvLinkConfig
  participant SwitchCertificateMonitor
  participant NMXCEndpoint
  participant RackMaintenance
  participant OpenTelemetry
  NvLinkConfig->>SwitchCertificateMonitor: provide rotate_before_expiry
  SwitchCertificateMonitor->>NMXCEndpoint: probe certificate
  NMXCEndpoint-->>SwitchCertificateMonitor: return observed certificate
  SwitchCertificateMonitor->>SwitchCertificateMonitor: evaluate cert_expires_within
  SwitchCertificateMonitor->>RackMaintenance: request maintenance when rotation_required
  SwitchCertificateMonitor->>OpenTelemetry: report rotation-window status

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: moving rotation decisions away from filesystem-based desired cert checks.
Description check	✅ Passed	The description matches the changeset by describing the shift from fingerprint/file-based checks to expiry-based certificate rotation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}