juju-solutions / layer-tls-client

A Juju layer for tls-client code, to add client code to your charms.
1 stars 8 forks source link

Certificates fails to regenerate after client's IP address change #24

Open radraw opened 1 year ago

radraw commented 1 year ago

When IP address of the client changes due to DHCP error condition certificate is generated automatically with new (wrong) IP address. However when original IP address is restored certificate doesn't generate again anymore. I found there is some problem with just getting proper certificate file path in tls_client.py code. Applying the following workaround patch (it's for kubernetes-worker case) fixes the issue:

--- tls_client.py   2022-12-15 13:47:32.462117145 +0100
+++ tls_client-workaround.py    2022-12-15 13:38:46.315904443 +0100
@@ -49,12 +49,20 @@
     chain = tls.get_chain()
     if chain:
         server_cert = server_cert + '\n' + chain
+    #log("debug: server_cert: " + str(server_cert))
+    #log("debug: server_key: " + str(server_cert))
     if server_cert and server_key:
+        #log("debug:")
         layer_options = layer.options('tls-client')
         cert_path = layer_options.get('server_certificate_path')
         key_path = layer_options.get('server_key_path')
+        #workaround:
+        cert_path = '/srv/kubernetes/server.crt'
+        key_path = '/srv/kubernetes/server.key'
         cert_changed = data_changed('server_certificate', server_cert)
         key_changed = data_changed('server_key', server_key)
+        log("debug: layer_options: " + str(layer_options))
+        log("debug: cert_path: " + str(cert_path))
         if cert_path:
             if cert_changed or not os.path.exists(cert_path):
                 log('Writing server certificate to {0}'.format(cert_path))

After applying the patch certificate is generating again with currently configured (proper restored) IP address.