[3.0] [CPI] Add self-signed certificate to CPI configuration, bsc#1101973

SUSE / caasp-salt

A collection of salt states used to provision a kubernetes cluster

Apache License 2.0

64 stars 29 forks source link

[3.0] [CPI] Add self-signed certificate to CPI configuration, bsc#1101973 #700

Closed mjura closed 5 years ago

mjura commented 5 years ago

(cherry picked from commit 67e276cd10066918d7590d29d485215770795208)

r0ckarong commented 5 years ago

Does this add new fields/buttons in the UI?

flavio commented 5 years ago

@mjura can you please take a look at the broken tests? We need everything to be green in order to merge it (cc @jordimassaguerpla)

mjura commented 5 years ago

I've re-run CI

mjura commented 5 years ago

CI failing because of missing ruby2.1-* packages on jenkins test image. It is unrelated to to this PR, I will try to solve it anyway.

hwoarang commented 5 years ago

@abonillasuse this is merely a backport. If something else needs fixing/improving please file a separate bug report. Thank you :)

abonillabeeche commented 5 years ago

another warning from my comment above - the fix points to the ca-bundle file, but the imported certificate is not shown in the ca-bundle.pem. The fix is to point to the imported certificate, which in our case is "/etc/pki/trust/anchors/geekoland.crt" @flavio @ajaeger @hwoarang

Should the ca-bundle include all certs imported from velum?
is that large bundle file the proper/efficient way of handling this need?

dannysauer commented 5 years ago

@abonillasuse, the update-ca-certs tool does not recognize self-signed certs when it builds the bundled PEM, so that's why it doesn't get included. Maintaining the bundle is a standard thing done on most systems, so is "correct" - but we'll have to change how the file is managed if self-signed certs (which are their own CA, but can't sign other certs) need to be included.