Fixes #30368 - Make Candlepin CA file optional #8832

ekohl · 2020-07-10T18:59:56Z

This change makes the Candlepin CA file optional by falling back to the Foreman CA file. The result is a reduced configuration in most deployments.

For Pulp the certificate is now read in the same way as Candlepin. Previously it partly relied on the CA being in the global allowed CA. This may be an issue in some cases, but in the default deployment it isn't. Following the general SSL config makes the configuration more predictable for users. It can also be easier in a containerized setup or on a system where the admin is not allowed to modify the system CA certificates. The example config is now also consistent with reality.

The verify_ssl option is dropped from the ping model. This isn't respected elsewhere and it's misleading to have a valid ping only to have it fail at runtime.

theforeman-bot · 2020-07-10T19:00:01Z

Issues: #30368

ehelms · 2020-07-10T19:13:03Z

Related, and based on some discussion with @jlsherrill , today Pulp communication relies on the the CA being trusted by the system (the whole use of trusted_ca module in the installer) and we should switch to doing this explicitly --

katello/app/models/katello/concerns/smart_proxy_extensions.rb

Line 119 in 68ff922

def pulp3_configuration(config_class)

ekohl · 2020-11-19T15:48:46Z

I took a stab at this. In doing so, I found 2 settings that were removed but still had references to them. It then also unifies the certificate handling in the certs service. There are a few more changes, documented in the commit message. Please read it and let me hear your thoughts.

app/lib/katello/resources/registry.rb

app/services/cert/certs.rb

jturel · 2021-03-08T20:41:29Z

[test katello]

app/models/katello/ping.rb

jturel · 2021-03-09T18:01:33Z

One test failure seems relevant

test_verify_ueber_cert_no_change – Katello::CertsTest

ekohl · 2021-04-07T12:46:08Z

Rebased to resolve merge conflict and to get recent tests. I've also split of unrelated work to #9268 since it doesn't impact this PR.

jturel · 2021-04-14T14:48:36Z

Haven't tested yet but the test failure definitely seems related

ekohl · 2021-04-20T19:05:13Z

Given stabilization is coming soon and my lack of time, I'm afraid we'll have to push this to the next Katello release.

parthaa · 2022-06-24T19:37:24Z

@ekohl is this PR still valid ? Rebase if so

theforeman-bot · 2022-06-24T19:52:02Z

@ekohl, this pull request is currently not mergeable. Please rebase against the master branch and push again.

If you have a remote called 'upstream' that points to this repository, you can do this by running:

    $ git pull --rebase upstream master

This message was auto-generated by Foreman's prprocessor

ekohl · 2022-06-27T11:29:23Z

I've tried to rebase it, but I'm a bit unclear about the current Pulp 2 vs Pulp 3 status. I still see traces of Runcible, but isn't that Pulp 2-only?

I now think this unifies everything. It does mean the system store isn't really used anymore (unless you don't configure anything I think), but that's probably a good thing.

Perhaps @ehelms and @evgeni could also think about what kind of behavior we would prefer to have from a platform point of view.

Rather than using the default value, this uses the actual value that was passed in. Fixes: d6adef8 ("Fixes #34070 - fix container registry with azure plugin")

ekohl · 2024-10-25T12:57:01Z

Inspired by #11190 I rebased this, but I haven't verified it myself.

@evgeni does this resolve the issue you're seeing or does it burn down?

ekohl · 2024-10-25T16:18:17Z

app/lib/katello/http_resource.rb

@@ -19,7 +19,7 @@ def initialize(params)
    include Katello::Concerns::FilterSensitiveData

    class_attribute :consumer_secret, :consumer_key, :ca_cert_file, :prefix, :site, :default_headers,
-                    :ssl_client_cert, :ssl_client_key
+                    :ssl_client_cert, :ssl_client_key, :ssl_ca_file


I now see there already is ca_cert_file for this. I don't know what other classes can be passes into pulp3_ssl_configuration so I'm looking for guidance here.

I included a commit to rename it for consistency with other tools and naming for the other ssl_ attrs.

This is more consistent with other classes.

This change makes the Candlepin CA file optional by falling back to the Foreman CA file. The result is a reduced configuration in most deployments. For Pulp the certificate is now read in the same way as Candlepin. Previously it partly relied on the CA being in the global allowed CA. This may be an issue in some cases, but in the default deployment it isn't. Following the general SSL config makes the configuration more predictable for users. It can also be easier in a containerized setup or on a system where the admin is not allowed to modify the system CA certificates. The example config is now also consistent with reality. The verify_ssl option is dropped from the ping model. This isn't respected elsewhere and it's misleading to have a valid ping only to have it fail at runtime.

ehelms · 2024-10-28T15:45:35Z

config/katello.yaml.example

    :ca_cert_file:
    # :bulk_load_size: 1000
  # Setup your pulp environment here
  :pulp:
    :sync_threads: 4
    # refers to the apache certificate
-    # (typically /etc/pki/tls/certs/localhost.crt) location that is needed
-    # to connect to pulp over https.
+    # Optional CA file to user to verify HTTPS connections to Candlepin. If not


Suggested change

# Optional CA file to user to verify HTTPS connections to Candlepin. If not

# Optional CA file to user to verify HTTPS connections to Pulp. If not

ehelms

Clean re-factoring that helps set up future simplifications.

ekohl · 2024-10-28T16:30:12Z

I had hoped @evgeni could test if this resolves his issue in containers before merging.

ehelms · 2024-10-28T20:11:14Z

I had hoped @evgeni could test if this resolves his issue in containers before merging.

I liked the change from a re-factoring stand point. If this doesn't solve his issue, then we can iterate on solving that.

evgeni · 2024-10-29T06:56:12Z

theforeman/foreman-quadlet#43 is not failing on SSL errors anymore, so it certainly helped :)

ekohl · 2024-10-29T18:40:45Z

By looking at puppet-katello I realized I forgot something because of the very long duration of the PR.

While we can remove this line for candlepin, we can't remove this line for candlepin_events.

We can actually simplify that all the way to default to the same client cert credentials that Foreman already uses and make the whole block optional.

theforeman-bot added Needs testing Not yet reviewed labels Jul 10, 2020

ekohl force-pushed the candlepin-use-ca-file branch from 6d1bd33 to 8ef3711 Compare November 19, 2020 15:45

theforeman-bot added the Waiting on contributor label Nov 19, 2020

ekohl commented Nov 19, 2020

View reviewed changes

app/lib/katello/resources/registry.rb Outdated Show resolved Hide resolved

ehelms reviewed Nov 25, 2020

View reviewed changes

app/services/cert/certs.rb Show resolved Hide resolved

Base automatically changed from master to main January 28, 2021 17:16

Base automatically changed from main to master January 29, 2021 03:46

jturel self-assigned this Mar 8, 2021

jturel reviewed Mar 8, 2021

View reviewed changes

app/models/katello/ping.rb Outdated Show resolved Hide resolved

ekohl force-pushed the candlepin-use-ca-file branch from 8ef3711 to 85f4f40 Compare March 9, 2021 11:47

theforeman-bot added Waiting on contributor and removed Waiting on contributor labels Mar 9, 2021

ekohl mentioned this pull request Apr 7, 2021

Remove unused settings #9268

Merged

ekohl force-pushed the candlepin-use-ca-file branch from 85f4f40 to d483104 Compare April 7, 2021 12:45

theforeman-bot removed the Waiting on contributor label Apr 7, 2021

jturel removed their assignment Jun 24, 2022

theforeman-bot added Waiting on contributor and removed Needs testing Not yet reviewed labels Jun 24, 2022

ekohl force-pushed the candlepin-use-ca-file branch from d483104 to 48289b6 Compare June 27, 2022 11:26

theforeman-bot added Needs re-review Needs testing and removed Waiting on contributor labels Jun 27, 2022

ekohl mentioned this pull request Oct 25, 2024

pass our CA cert when configuring Pulp3 Client #11190

Closed

Refs #30368 - Use correct connection_adapter variable

d184fee

Rather than using the default value, this uses the actual value that was passed in. Fixes: d6adef8 ("Fixes #34070 - fix container registry with azure plugin")

ekohl force-pushed the candlepin-use-ca-file branch from 48289b6 to b97646c Compare October 25, 2024 12:55

ekohl force-pushed the candlepin-use-ca-file branch from b97646c to daa57eb Compare October 25, 2024 16:14

ekohl commented Oct 25, 2024

View reviewed changes

pr-processor bot removed the Needs re-review label Oct 25, 2024

Refs #30368 - Rename ca_cert_file to ssl_ca_file

71042ad

This is more consistent with other classes.

ekohl force-pushed the candlepin-use-ca-file branch from daa57eb to 9213056 Compare October 27, 2024 18:50

ekohl force-pushed the candlepin-use-ca-file branch from 9213056 to 92b2ded Compare October 28, 2024 11:14

ehelms reviewed Oct 28, 2024

View reviewed changes

ehelms approved these changes Oct 28, 2024

View reviewed changes

ehelms merged commit ade73b4 into Katello:master Oct 28, 2024
26 of 27 checks passed

ekohl deleted the candlepin-use-ca-file branch October 28, 2024 16:29

evgeni mentioned this pull request Oct 29, 2024

use the api to create a set of reusable fixtures theforeman/foreman-quadlet#43

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes #30368 - Make Candlepin CA file optional #8832

Fixes #30368 - Make Candlepin CA file optional #8832

ekohl commented Jul 10, 2020 •

edited

Loading

theforeman-bot commented Jul 10, 2020

ehelms commented Jul 10, 2020

ekohl commented Nov 19, 2020

jturel commented Mar 8, 2021

jturel commented Mar 9, 2021

ekohl commented Apr 7, 2021

jturel commented Apr 14, 2021

ekohl commented Apr 20, 2021

parthaa commented Jun 24, 2022

theforeman-bot commented Jun 24, 2022

ekohl commented Jun 27, 2022

ekohl commented Oct 25, 2024

ekohl Oct 25, 2024

ekohl Oct 27, 2024

ehelms Oct 28, 2024

ehelms left a comment

ekohl commented Oct 28, 2024

ehelms commented Oct 28, 2024

evgeni commented Oct 29, 2024

ekohl commented Oct 29, 2024

	# Optional CA file to user to verify HTTPS connections to Candlepin. If not
	# Optional CA file to user to verify HTTPS connections to Pulp. If not

Fixes #30368 - Make Candlepin CA file optional #8832

Fixes #30368 - Make Candlepin CA file optional #8832

Conversation

ekohl commented Jul 10, 2020 • edited Loading

theforeman-bot commented Jul 10, 2020

ehelms commented Jul 10, 2020

ekohl commented Nov 19, 2020

jturel commented Mar 8, 2021

jturel commented Mar 9, 2021

ekohl commented Apr 7, 2021

jturel commented Apr 14, 2021

ekohl commented Apr 20, 2021

parthaa commented Jun 24, 2022

theforeman-bot commented Jun 24, 2022

ekohl commented Jun 27, 2022

ekohl commented Oct 25, 2024

ekohl Oct 25, 2024

Choose a reason for hiding this comment

ekohl Oct 27, 2024

Choose a reason for hiding this comment

ehelms Oct 28, 2024

Choose a reason for hiding this comment

ehelms left a comment

Choose a reason for hiding this comment

ekohl commented Oct 28, 2024

ehelms commented Oct 28, 2024

evgeni commented Oct 29, 2024

ekohl commented Oct 29, 2024

ekohl commented Jul 10, 2020 •

edited

Loading