From 2a6fc155d232763a44ebe886f70fdde2a0030a62 Mon Sep 17 00:00:00 2001 From: Brian Haley Date: Fri, 31 May 2019 14:50:09 -0400 Subject: [PATCH] Start using the f29 nodeset The dogtag pki python module has been moved to Python 3 in Fedora 29. This patch also fixes a few Python 3 compatibility issues in the DogTag backend plugin. Unfortunately, there is a bug in the dogtag pki module that must be fixed before the gate will pass. [1] This patch temporarily makes the DogTag gate non-voting to unblock the gate while we wait for a fix from the DogTag maintainers. [1] https://pagure.io/dogtagpki/issue/3108 Depends-on: https://review.opendev.org/#/c/662529/ Change-Id: Iaa7a535c410c726fa8e7346c2ef775fbaf58eb61 --- .zuul.yaml | 8 ++++++-- barbican/plugin/dogtag.py | 6 +++++- devstack/lib/barbican | 2 +- playbooks/legacy/barbican-devstack-base/run.yaml | 2 +- .../legacy/barbican-devstack-functional-base/run.yaml | 2 +- playbooks/legacy/barbican-devstack-tempest-base/run.yaml | 2 +- 6 files changed, 15 insertions(+), 7 deletions(-) diff --git a/.zuul.yaml b/.zuul.yaml index 13178dd6a..dcb197d23 100644 --- a/.zuul.yaml +++ b/.zuul.yaml @@ -5,7 +5,7 @@ parent: legacy-dsvm-base vars: database: sql - python_version: py27 + python_version: py36 services: tempest,rabbit,mysql,key required-projects: - openstack/devstack-gate @@ -57,7 +57,10 @@ name: barbican-dogtag-devstack-functional-fedora-latest nodeset: devstack-single-node-fedora-latest parent: barbican-devstack-functional-base + # non-voting until https://pagure.io/dogtagpki/issue/3108 is fixed + voting: false vars: + python_version: py35 services: barbican-dogtag,tempest,rabbit,mysql,key plugin: dogtag post-run: playbooks/legacy/barbican-devstack-functional-base/dogtag-post.yaml @@ -179,7 +182,8 @@ jobs: - barbican-simple-crypto-devstack-tempest - barbican-simple-crypto-devstack-functional - - barbican-dogtag-devstack-functional-fedora-latest + # TODO(redrobot): add this back once job is voting again + #- barbican-dogtag-devstack-functional-fedora-latest - barbican-vault-devstack-functional - barbican-grenade-devstack experimental: diff --git a/barbican/plugin/dogtag.py b/barbican/plugin/dogtag.py index 961af2373..45c48e659 100644 --- a/barbican/plugin/dogtag.py +++ b/barbican/plugin/dogtag.py @@ -38,6 +38,7 @@ import pki.key as key import pki.kra import pki.profile from requests import exceptions as request_exceptions +import six from barbican.common import exception from barbican.common import utils @@ -93,6 +94,9 @@ def _setup_nss_db_services(conf): return None if nss_password is None: raise ValueError(u._("nss_password is required")) + if type(nss_password) is not six.binary_type: + # Password needs to be a bytes object in Python 3 + nss_password = nss_password.encode('UTF-8') nss_db_created = _create_nss_db_if_needed(nss_db_path, nss_password) crypto = cryptoutil.NSSCryptoProvider(nss_db_path, nss_password) @@ -109,7 +113,7 @@ def _import_kra_transport_cert_to_nss_db(conf, crypto): systemcert_client = kraclient.system_certs transport_cert = systemcert_client.get_transport_cert() - crypto.import_cert(KRA_TRANSPORT_NICK, transport_cert, "u,u,u") + crypto.import_cert(KRA_TRANSPORT_NICK, transport_cert, ",,") except Exception as e: LOG.error("Error in importing transport cert." " KRA may not be enabled: %s", e) diff --git a/devstack/lib/barbican b/devstack/lib/barbican index 13879a833..2adc2bbb4 100644 --- a/devstack/lib/barbican +++ b/devstack/lib/barbican @@ -543,7 +543,7 @@ EOF } function install_dogtag_plugin_dependencies { - install_package nss-devel 389-ds-base pki-ca pki-kra python2-pki python3-pki + install_package nss-devel 389-ds-base dogtag-pki } function install_dogtag_components { diff --git a/playbooks/legacy/barbican-devstack-base/run.yaml b/playbooks/legacy/barbican-devstack-base/run.yaml index ff668e0e7..c20bf53fb 100644 --- a/playbooks/legacy/barbican-devstack-base/run.yaml +++ b/playbooks/legacy/barbican-devstack-base/run.yaml @@ -33,7 +33,7 @@ export PROJECTS="openstack/python-barbicanclient $PROJECTS" export PROJECTS="openstack/barbican-tempest-plugin $PROJECTS" export DEVSTACK_LOCAL_CONFIG="enable_plugin barbican https://opendev.org/openstack/barbican" - if [ "{{ python_version }}" == "py35" ] ; then + if [[ "{{ python_version }}" == py3* ]] ; then export DEVSTACK_GATE_USE_PYTHON3=True export DEVSTACK_LOCAL_CONFIG+=$'\n'"disable_service s-account" export DEVSTACK_LOCAL_CONFIG+=$'\n'"disable_service s-container" diff --git a/playbooks/legacy/barbican-devstack-functional-base/run.yaml b/playbooks/legacy/barbican-devstack-functional-base/run.yaml index eb07364ab..b9fc4fed6 100644 --- a/playbooks/legacy/barbican-devstack-functional-base/run.yaml +++ b/playbooks/legacy/barbican-devstack-functional-base/run.yaml @@ -46,7 +46,7 @@ export PROJECTS="openstack/python-barbicanclient $PROJECTS" export PROJECTS="openstack/barbican-tempest-plugin $PROJECTS" - if [ "{{ python_version }}" == "py35" ] ; then + if [[ "{{ python_version }}" == py3* ]] ; then export DEVSTACK_GATE_USE_PYTHON3=True else export DEVSTACK_GATE_USE_PYTHON3=False diff --git a/playbooks/legacy/barbican-devstack-tempest-base/run.yaml b/playbooks/legacy/barbican-devstack-tempest-base/run.yaml index 24b3caef5..8d760ee9d 100644 --- a/playbooks/legacy/barbican-devstack-tempest-base/run.yaml +++ b/playbooks/legacy/barbican-devstack-tempest-base/run.yaml @@ -56,7 +56,7 @@ export DEVSTACK_PROJECT_FROM_GIT="castellan" elif [ "{{ cursive }}" == "1" ] ; then export DEVSTACK_PROJECT_FROM_GIT="cursive" - elif [ "{{ python_version }}" == "py35" ] ; then + elif [[ "{{ python_version }}" == py3* ]] ; then export DEVSTACK_GATE_USE_PYTHON3=True export DEVSTACK_LOCAL_CONFIG+=$'\n'"disable_service s-account" export DEVSTACK_LOCAL_CONFIG+=$'\n'"disable_service s-container"