0bea99af78
This code change prevents an issue with cert-manager
certificates where it will renew leaf certificates even
when the issuer CA certificate is expired. This behaviour
is wrong and can lead to SSL verification failures in
apis that verify the server certificates against the
issuer copy in the system bundle.
It also fixes 3 smaller issues:
- remove the mention from migrate-certificates playbook
from the platform certificates manual action error
- warning about unnecessary use of {{ }} in ansible
- Missing stdout error in the 'Running in other nodes' log.
Test Plan:
Below tested with DX and standard subcloud types:
PASS: Certificate recovery rehoming with platform certificates
manually installed with 'system certificate-install'
PASS: Certificate recovery rehoming with platform certificates
managed by cert-manager and issued by system-local-ca
PASS: Certificate recovery rehoming with platform certificates
managed by cert-manager and issued by an issuer other than
system-local-ca
Note: I'm summarizing the test case description here. I went thru all
the process of advancing time in bios to cause certificate expiration
and then re-homed each subcloud to recover certificates. I don't think
it's necessary to go into much detail about that. Let me know if you
disagree and I can add it.
Story: 2010815
Task: 49575
Change-Id: I59eaf1803c7282692d978bff99fa9e9b631a9628
Signed-off-by: Rei Oliveira <Reinildes.JoseMateusOliveira@windriver.com>
stx-ansible-playbooks
StarlingX Bootstrap and Deployment Ansible1 Playbooks
Execution environment
- Unix like OS (recent Linux based distributions, MacOS, Cygwin)
- Python 3.8 and later
Additional Required Packages
In addition to the pakages listed in requirements.txt and test-requirements.txt, the following packages are required to run the playbooks remotely:
- python3-pexpect
- python3-ptyprocess
- sshpass
Supported StarlingX Releases
The playbooks are compatible with StarlingX R8.0 and later.
Executing StarlingX Playbooks
Bootstrap Playbook
For instructions on how to set up and execute the bootstrap playbook
from another host, please refer to the StarlingX Documentation2, at
Installation Guides, section Configure
controller-0 of the respective system deployment type.
Developer Notes
This repository is not intended to be developed standalone, but rather as part of the StarlingX Source System, which is defined by the StarlingX manifest3.