diff --git a/charmcraft.yaml b/charmcraft.yaml index fb79ecb..be460d6 100644 --- a/charmcraft.yaml +++ b/charmcraft.yaml @@ -142,8 +142,11 @@ config: revoking all previously issued certificates. certificate-limit: type: int + default: 99 description: > Maximum number of certificates that can be issued to a single requirer. + Defaults to 99. + Use -1 for allowing an unlimited number of certificates. actions: get-ca-certificate: diff --git a/src/charm.py b/src/charm.py index 289d8d3..7c507cd 100755 --- a/src/charm.py +++ b/src/charm.py @@ -126,7 +126,7 @@ def _config_certificate_validity(self) -> timedelta | None: return validity @property - def _config_certificate_number_limit(self) -> int | None: + def _config_certificate_limit(self) -> int | None: """Return certificate number limit from the charm config.""" value = self.model.config.get("certificate-limit") if not value or not isinstance(value, int): @@ -420,7 +420,7 @@ def _clean_up_juju_secret(self, label: str): def _process_outstanding_certificate_requests(self) -> None: """Process outstanding certificate requests.""" requests = self.tls_certificates.get_outstanding_certificate_requests() - if self._config_certificate_number_limit: + if self._config_certificate_limit and self._config_certificate_limit > -1: requests = self._limit_requests(requests) for request in requests: self._generate_self_signed_certificate( @@ -436,7 +436,7 @@ def _limit_requests( counts = {} for request in requests: counts[request.relation_id] = counts.get(request.relation_id, 0) + 1 - if counts[request.relation_id] <= self._config_certificate_number_limit: + if counts[request.relation_id] <= self._config_certificate_limit: yield request def _invalid_configs(self) -> list[str]: diff --git a/tests/unit/test_charm_configure.py b/tests/unit/test_charm_configure.py index 87da6bb..02a7433 100644 --- a/tests/unit/test_charm_configure.py +++ b/tests/unit/test_charm_configure.py @@ -292,6 +292,7 @@ def test_given_outstanding_certificate_requests_when_config_changed_then_certifi "ca-common-name": "example.com", "certificate-validity": "100", "root-ca-validity": "200", + "certificate-limit": -1, }, leader=True, relations={tls_relation},