53007c0b30
The local certmonger cert will renew after half its lifetime, which will be after 6 months by default. The current code would extract the CA cert to a PEM file (and trust it), only if the cert in the existing PEM file was expired. But this means that the certmonger local cert could be renewed after six months and not be replaced in the PEM file until the existing cert expired at the end of the year. If certs are issued in this time, they will not be trusted and the update will fail. This patch removes this condition, so that the extracted and trusted cert always matches what is in the PEM file, and what is trusted. Note, this only place this occurs is on the undercloud - because this is where we could use the certmonger local cert. We assume that the haproxy cert will be re-issued in an update. Change-Id: If804dc369c5883eeb51f7e6dcd01ee0e5967c7cf
58 lines
1.4 KiB
Ruby
58 lines
1.4 KiB
Ruby
#
|
|
# Copyright (C) 2017 Red Hat Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
#
|
|
# Unit tests for tripleo
|
|
#
|
|
|
|
require 'spec_helper'
|
|
|
|
describe 'tripleo::certmonger::ca::local' do
|
|
|
|
shared_examples_for 'tripleo::certmonger::ca::local' do
|
|
|
|
let :pre_condition do
|
|
"include ::certmonger"
|
|
end
|
|
|
|
let :params do
|
|
{
|
|
:ca_pem => '/etc/pki/ca-trust/source/anchors/cm-local-ca.pem',
|
|
}
|
|
end
|
|
|
|
it 'should extract CA cert' do
|
|
is_expected.to contain_exec('extract-and-trust-ca')
|
|
end
|
|
|
|
it 'set the correct permissions for the CA certificate file' do
|
|
is_expected.to contain_file(params[:ca_pem]).with(
|
|
:ensure => 'present',
|
|
:mode => '0644',
|
|
:owner => 'root'
|
|
)
|
|
end
|
|
end
|
|
|
|
on_supported_os.each do |os, facts|
|
|
context "on #{os}" do
|
|
let(:facts) do
|
|
facts.merge({})
|
|
end
|
|
|
|
it_behaves_like 'tripleo::certmonger::ca::local'
|
|
end
|
|
end
|
|
end
|