CB-28061: Reenable HTTPS for saltboot and ensure cert files are present #1097
+18
−1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previously salt-bootstrap wouldn't work with HTTPS enabled, on non-gateway instances, since we do not generate the cert files which salt-bootstrap was relying on, on these instances. Added logic for always generating the necessary certs (given that saltboot HTTPS is enabled): - On gateway instances, we generate them using the same ca cert used to generate the certs for nginx and jumpgate - On all other instances, we generate a ca cert and use that to generate the necessary certs Note: The host values in the generated certs still don't matter, as there is still neither client- nor host-side verification. We only use TLS to have the channel be encrypted.
|
Please add information about tests performed. I can see a few test builds only, but without any validation (SKIP_VALIDATION parameter is set for these!):
Also, are you sure, that these changes will be compatible with
If any of these are not required - e.g. you don't plan to support this on CentOS 7 or older runtimes - please use the appropriate "if"s in the code to branch the logic based on the target OS, arch, runtime, image type, etc. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Previously salt-bootstrap wouldn't work with HTTPS enabled, on non-gateway instances, since we do not generate the cert files which salt-bootstrap was relying on, on these instances.
Added logic for always generating the necessary certs (given that saltboot HTTPS is enabled):
Note: The host values in the generated certs still don't matter, as there is still neither client- nor host-side verification. We only use TLS to have the channel be encrypted.