feat: add nats_ca crypto_key_feature enum value (#26761)

coderd/cryptokeys/rotate.go

@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"database/sql"
 	"encoding/hex"
+	"slices"
 	"time"
 
 	"golang.org/x/xerrors"
@@ -27,6 +28,24 @@ const (
 	DefaultKeyDuration = time.Hour * 24 * 30
 )
 
+// defaultRotatedFeatures are the crypto key features the rotator manages. It
+// intentionally excludes features that are gated behind an experiment or
+// deployment flag so that a dormant feature's enum value does not cause the
+// rotator to mint keys it has no generator for. Gated features are opted in by
+// the caller that owns their generator.
+var defaultRotatedFeatures = []database.CryptoKeyFeature{
+	database.CryptoKeyFeatureWorkspaceAppsToken,
+	database.CryptoKeyFeatureWorkspaceAppsAPIKey,
+	database.CryptoKeyFeatureOIDCConvert,
+	database.CryptoKeyFeatureTailnetResume,
+}
+
+// DefaultRotatedFeatures returns the crypto key features the rotator manages by
+// default. It excludes experiment-gated features such as the NATS CA.
+func DefaultRotatedFeatures() []database.CryptoKeyFeature {
+	return slices.Clone(defaultRotatedFeatures)
+}
+
 // rotator is responsible for rotating keys in the database.
 type rotator struct {
 	db          database.Store
@@ -62,7 +81,7 @@ func StartRotator(ctx context.Context, logger slog.Logger, db database.Store, op
 		logger:      logger.Named("keyrotator"),
 		clock:       quartz.NewReal(),
 		keyDuration: DefaultKeyDuration,
-		features:    database.AllCryptoKeyFeatureValues(),
+		features:    defaultRotatedFeatures,
 	}
 
 	for _, opt := range opts {

coderd/cryptokeys/rotate_internal_test.go

@@ -358,7 +358,7 @@ func Test_rotateKeys(t *testing.T) {
 			keyDuration: keyDuration,
 			clock:       clock,
 			logger:      logger,
-			features:    database.AllCryptoKeyFeatureValues(),
+			features:    defaultRotatedFeatures,
 		}
 
 		now := dbnow(clock)
@@ -409,7 +409,7 @@ func Test_rotateKeys(t *testing.T) {
 		require.NoError(t, err)
 		require.Len(t, keys, 5)
 
-		kbf, err := keysByFeature(keys, database.AllCryptoKeyFeatureValues())
+		kbf, err := keysByFeature(keys, defaultRotatedFeatures)
 		require.NoError(t, err)
 
 		// No actions on OIDC convert.

coderd/cryptokeys/rotate_test.go

@@ -37,7 +37,7 @@ func TestRotator(t *testing.T) {
 		// are as expected.
 		dbkeys, err = db.GetCryptoKeys(ctx)
 		require.NoError(t, err)
-		require.Len(t, dbkeys, len(database.AllCryptoKeyFeatureValues()))
+		require.Len(t, dbkeys, len(cryptokeys.DefaultRotatedFeatures()))
 		requireContainsAllFeatures(t, dbkeys)
 	})
 
@@ -64,7 +64,7 @@ func TestRotator(t *testing.T) {
 
 		cryptokeys.StartRotator(ctx, logger, db, cryptokeys.WithClock(clock))
 
-		initialKeyLen := len(database.AllCryptoKeyFeatureValues())
+		initialKeyLen := len(cryptokeys.DefaultRotatedFeatures())
 		// Fetch the keys from the database and ensure they
 		// are as expected.
 		dbkeys, err := db.GetCryptoKeys(ctx)
@@ -113,7 +113,7 @@ func requireContainsAllFeatures(t *testing.T, keys []database.CryptoKey) {
 	for _, key := range keys {
 		features[key.Feature] = true
 	}
-	for _, feature := range database.AllCryptoKeyFeatureValues() {
+	for _, feature := range cryptokeys.DefaultRotatedFeatures() {
 		require.True(t, features[feature])
 	}
 }