search

rancher / k3os

Purpose-built OS for Kubernetes, fully managed by Kubernetes.
https://k3os.io
Apache License 2.0
3.5k stars 396 forks source link

Retain additional files needed by update-ca-certificates as part of rootfs #818

Open philomory opened 2 years ago

philomory commented 2 years ago

As mentioned in #518, the update-ca-certificates command on k3os doesn't work the way people expect; when running update-ca-certificates, all of the default certificates are lost and only user certificates are included in the final ca-certificates bundle. There have been workarounds proposed such as copying the default ca-certificates bundle from /etc/ssl/certs into /usr/local/share/ca-certificates and then appending the additional CA certificates to that file before running update-ca-certificates.

The intended behavior for update-ca-certificates is that it pulls user certificates from /usr/local/share/ca-certificates, and system default certificates from /usr/share/ca-certificates; however, update-ca-certificates does not automatically bundle all certificates found in /usr/share/ca-certificates - instead, it only bundles those system-default certificates listed in the configuration file /etc/ca-certificates.conf.

The reason for the misbehavior of update-ca-certificates on k3os, then, is the lack of a /etc/ca-certificates.conf file. This file is part of the ca-certificates package in alpine (the same package that contains the update-ca-certificates command), however the k3os build process doesn't include this file by default when building the rootfs. This PR addresses that issue, ensuring that the rootfs includes all of the files needed for update-ca-certificates to operate as intended.

philomory commented 2 years ago

@dweomer Now that this PR has been approved, what is required before it can be merged?