openstack/puppet-tripleo
Code Issues Proposed changes

Always update the local certmonger ca cert

Browse Source 
The local certmonger cert will renew after half its lifetime, which will
be after 6 months by default.  The current code would extract the CA cert
to a PEM file (and trust it), only if the cert in the existing PEM file
was expired.

But this means that the certmonger local cert could be renewed after six
months and not be replaced in the PEM file until the existing cert
expired at the end of the year.  If certs are issued in this time, they
will not be trusted and the update will fail.

This patch removes this condition, so that the extracted and trusted cert
always matches what is in the PEM file, and what is trusted.

Note, this only place this occurs is on the undercloud - because this is
where we could use the certmonger local cert.  We assume that the haproxy
cert will be re-issued in an update.

Change-Id: If804dc369c5883eeb51f7e6dcd01ee0e5967c7cf
This commit is contained in:
Ade Lee 2021-04-05 15:50:04 -04:00
parent 69b8e65f1c
commit 017ced4d97
2 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
manifests/certmonger/ca/local.pp
View File

@ -37,7 +37,6 @@ class tripleo::certmonger::ca::local(
exec { 'extract-and-trust-ca':
command => "${extract_cmd} && ${trust_ca_cmd}",
path => '/usr/bin',
unless => "test -e ${ca_pem} && openssl x509 -checkend 0 -noout -in ${ca_pem}",
tries => 5,
try_sleep => 1,
notify => File[$ca_pem]

4
spec/classes/tripleo_certmonger_ca_local_spec.rb
View File

@ -33,9 +33,7 @@ describe 'tripleo::certmonger::ca::local' do
end
it 'should extract CA cert' do
is_expected.to contain_exec('extract-and-trust-ca').with(
:unless => "test -e #{params[:ca_pem]} && openssl x509 -checkend 0 -noout -in #{params[:ca_pem]}",
)
is_expected.to contain_exec('extract-and-trust-ca')
end
it 'set the correct permissions for the CA certificate file' do