Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deadline): fix issue in client TLS configuration for Deadline 10.1.18.5 #537

Closed
wants to merge 3 commits into from
Closed

fix(deadline): fix issue in client TLS configuration for Deadline 10.1.18.5 #537

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4cdc9e8
fix(deadline): fix issue in client TLS configuration for Deadline 10.…
jusiskin Aug 17, 2021
22dd4d6
chore: use lightweight deadlinecommand for connection test
jusiskin Aug 17, 2021
70be1f2
test: fix asset constants for render queue connection script
jusiskin Aug 17, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions integ/components/deadline/common/scripts/bastion/utils/configure-deadline.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,7 @@ if [ -d "$CERT" ]; then
sudo $DEADLINE/deadlinecommand SetIniFileSetting ProxyUseSSL True
sudo $DEADLINE/deadlinecommand SetIniFileSetting ProxySSLCA "$CERT/ca-cert.crt"
sudo $DEADLINE/deadlinecommand SetIniFileSetting ClientSSLAuthentication NotRequired
# Set Deadline to use repository connection validated by TLS; ChangeRepositorySkipValidation is a workaround that saves the values without testing them
sudo $DEADLINE/deadlinecommand ChangeRepositorySkipValidation Proxy $ENDPOINT "$CERT/ca-cert.crt" >/dev/null
sudo $DEADLINE/deadlinecommand SetIniFileSetting ProxyRoot $ENDPOINT

else
# Non-TLS connections can connect to the repository directly
Expand Down
31 changes: 21 additions & 10 deletions packages/aws-rfdk/lib/deadline/scripts/python/client-rq-connection.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
import os
import re
import subprocess
from sys import platform
from sys import platform, stdout

import boto3

Expand Down Expand Up @@ -133,8 +133,8 @@ def configure_deadline( config ):

# Ensure that the client is configured to connect to a Remote RCS.
call_deadline_command(['SetIniFileSetting', 'ConnectionType', 'Remote'])
call_deadline_command(['SetIniFileSetting', 'ProxyRoot', config.render_queue.address])

repo_args = ['ChangeRepository','Proxy',config.render_queue.address]
if config.render_queue.scheme == 'http':
print( "Configuring Deadline to connect to the Render Queue (%s) using HTTP Traffic" % config.render_queue.address )
#Ensure SSL is disabled
Expand All @@ -144,7 +144,7 @@ def configure_deadline( config ):

else:
print("Configuring Deadline to connect to the Render Queue using HTTPS Traffic")
call_deadline_command(['SetIniFileSetting','ProxyUseSSL','True'])
call_deadline_command(['SetIniFileSetting', 'ProxyUseSSL', 'True'])

try:
os.makedirs(CERT_DIR)
Expand All @@ -168,7 +168,15 @@ def configure_deadline( config ):

call_deadline_command(['SetIniFileSetting', 'ProxySSLCA', cert_path])
call_deadline_command(['SetIniFileSetting', 'ClientSSLAuthentication', 'NotRequired'])
repo_args.append(cert_path)

# Validate Deadline connection
print("Testing Deadline connection...")
stdout.flush()
try:
call_deadline_command(['GetJobs'])
jusiskin marked this conversation as resolved.
Show resolved Hide resolved
except Exception as e:
print('Deadline connection error: %s' % e)
print("Deadline connection configured correctly")
else:
"""
If we are configuring Deadline to connect using a client cert we need to:
Expand All @@ -182,17 +190,18 @@ def configure_deadline( config ):
with open(cert_path, 'wb') as f:
f.write(cert_contents)

call_deadline_command(['SetIniFileSetting', 'ProxySSLCA', cert_path])
call_deadline_command(['SetIniFileSetting', 'ClientSSLAuthentication', 'Required'])

repo_args = ['ChangeRepository', 'Proxy', config.render_queue.address]
repo_args.append(cert_path)
if config.client_tls_cert_passphrase:
passphrase = fetch_secret(config.client_tls_cert_passphrase)
repo_args.append(passphrase)

change_repo_results = call_deadline_command(repo_args)
if change_repo_results.startswith('Deadline configuration error:'):
print(change_repo_results)
raise Exception(change_repo_results)
change_repo_results = call_deadline_command(repo_args)
if change_repo_results.startswith('Deadline configuration error:'):
print(change_repo_results)
raise Exception(change_repo_results)


def call_deadline_command(arguments):
"""
Expand All @@ -208,6 +217,8 @@ def call_deadline_command(arguments):
raise Exception('Failed to call Deadline.')

output, errors = proc.communicate()
if proc.returncode != 0:
raise ValueError('DeadlineCommandError: \n%s\n%s' % (output, errors))
return output

def get_deadline_command():
Expand Down