[patch] Improvements to handling of files with multiple certificates #1097
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
andrercm
requested review from
durera,
sanjayprab,
terenceq and
whitfiea
as code owners
|
@andrercm , I guess there is no change required in https://ibm-mas.github.io/ansible-devops/roles/gencfg_jdbc/ right? |
|
@maulik-modi22 no, no change required, we're just proposing a change on how we manage multiple certs in the chain, no doc changes required. |
durera
changed the title
durera
approved these changes
Nov 27, 2023
This was
linked to
issues
Nov 27, 2023
karol-czarnecki
added a commit
that referenced
this pull request
Jan 15, 2024
commit 5206e1b Author: Conrad Kao <ckao@us.ibm.com> Date: Fri Jan 12 12:35:57 2024 -0600 [patch] add licensing sync cronjob sync frequency in slscfg (#1167) commit b1c6579 Author: David Parker <parkerda@uk.ibm.com> Date: Sun Jan 7 21:05:26 2024 +0000 [patch] Disable logging of docker credentials from mirror_ocp role (#1160) commit 81cb38f Author: David Parker <parkerda@uk.ibm.com> Date: Sun Jan 7 11:33:09 2024 +0000 Revert "[minor] Added failure handling for Maxinst setup script in suite_db2_setup_for_manage role (#1121)" This reverts commit b88d557. Refer to MASISMIG-49684 commit b88d557 Author: Sachin Balagopalan <sachin.balagopalan@us.ibm.com> Date: Fri Jan 5 04:01:44 2024 -0500 [minor] Added failure handling for Maxinst setup script in suite_db2_setup_for_manage role (#1121) Co-authored-by: Alexandre Quinteiro <alefq0@gmail.com> commit 04a32fc Author: André Marcelino <31037381+andrercm@users.noreply.github.com> Date: Wed Jan 3 12:28:57 2024 -0300 [patch] Fix condition that sets cert_manager_cluster_resource_namespace (#1156) commit d890dd6 Author: André Marcelino <31037381+andrercm@users.noreply.github.com> Date: Tue Jan 2 07:57:47 2024 -0300 [minor] Add support for Red Hat Certificate Manager (#1153) Co-authored-by: David Parker <parkerda@uk.ibm.com> commit 0d04acd Author: Sanjay Prabhakar <sanju7216@gmail.com> Date: Thu Dec 28 17:50:57 2023 +0000 [minor] Support December Catalog Update (#1148) Co-authored-by: Sanjay Prabhakar <sanjay.prabhakar@uk.ibm.com> commit 0d13647 Author: Sanjay Prabhakar <sanju7216@gmail.com> Date: Wed Dec 20 14:30:03 2023 +0000 [minor] Add support mongo 5.0.23 and 6.0.12 (#1144) Co-authored-by: Sanjay Prabhakar <sanjay.prabhakar@uk.ibm.com> commit 017a0ad Author: David Parker <parkerda@uk.ibm.com> Date: Wed Dec 20 12:59:43 2023 +0000 [patch] Include default channels in ImageSetConfiguration (#1150) commit d5c96fc Author: David Parker <parkerda@uk.ibm.com> Date: Wed Dec 20 10:34:32 2023 +0000 Default to patch version bump when no commit prefix provided (#1149) commit b4e06f0 Author: HariPalleti <hari.palleti@ibm.com> Date: Mon Dec 18 17:44:59 2023 -0600 [patch] add install in the DRO_ACTION list (#1146) commit 21c7b33 Author: Lokesh <110647904+lokesh-sreedhara@users.noreply.github.com> Date: Mon Dec 18 21:10:40 2023 +0530 [patch] fix dro_action assert error (#1145) Co-authored-by: Yuvraj Vansure <yuvraj.vansure1.ibm.com> Co-authored-by: yuvraj-vansure <81155309+yuvraj-vansure@users.noreply.github.com> commit 49b2546 Author: André Marcelino <31037381+andrercm@users.noreply.github.com> Date: Mon Dec 18 07:33:21 2023 -0300 [minor] Support MVI integration with Object Storage in oneclick_add_visualinspection (#1125) Co-authored-by: David Parker <parkerda@uk.ibm.com> commit 2e37184 Author: yuvraj-vansure <81155309+yuvraj-vansure@users.noreply.github.com> Date: Mon Dec 18 15:59:30 2023 +0530 [patch] Install DRO using DRO_STORAGE_CLASS and PVC (#1129) Co-authored-by: Yuvraj Vansure <yuvraj.vansure1.ibm.com> Co-authored-by: lokesh-sreedhara <lokesh.sreedhara@us.ibm.com> Co-authored-by: Lokesh <110647904+lokesh-sreedhara@users.noreply.github.com> commit fb7e3e0 Author: André Marcelino <31037381+andrercm@users.noreply.github.com> Date: Thu Dec 14 06:40:24 2023 -0300 [patch] Fix ocp_ingress_tls_secret_name support for Azure (#1141) Co-authored-by: David Parker <parkerda@uk.ibm.com> commit 7ffce37 Author: Sanjay Prabhakar <sanju7216@gmail.com> Date: Thu Dec 14 09:39:15 2023 +0000 [patch] Support for apply-db2cfg-settings.sh script in newer db2 operators (#1142) Co-authored-by: Sanjay Prabhakar <sanjay.prabhakar@uk.ibm.com> commit ca3da8e Author: yuvraj-vansure <81155309+yuvraj-vansure@users.noreply.github.com> Date: Wed Dec 13 16:02:15 2023 +0530 [patch] Include DRO in ImageSetConfig & ImageContentSourcePolicy (#1127) Co-authored-by: David Parker <parkerda@uk.ibm.com> commit f928af8 Author: chriscochran <140204950+chriscochran@users.noreply.github.com> Date: Wed Dec 13 04:22:11 2023 -0600 [patch] Exclude Maximo IT from mirror manifest by default (#1128) Co-authored-by: David Parker <parkerda@uk.ibm.com> Co-authored-by: André Marcelino <31037381+andrercm@users.noreply.github.com> Co-authored-by: Sanjay Prabhakar <sanju7216@gmail.com> Co-authored-by: Sanjay Prabhakar <sanjay.prabhakar@uk.ibm.com> commit 229e299 Author: André Marcelino <31037381+andrercm@users.noreply.github.com> Date: Tue Dec 12 10:41:46 2023 -0300 [patch] Fix cert content from string (#1137) Co-authored-by: David Parker <parkerda@uk.ibm.com> commit efd77d2 Author: David Parker <parkerda@uk.ibm.com> Date: Tue Dec 12 13:00:08 2023 +0000 [patch] Allow FYRE provision without storage configuration (#1138) commit e1473bf Author: Sanjay Prabhakar <sanju7216@gmail.com> Date: Sat Dec 9 02:38:32 2023 +0000 [patch] get db2u version from db2u-release configmap instead of secret (#1135) Co-authored-by: Sanjay Prabhakar <sanjay.prabhakar@uk.ibm.com> commit 41c0e98 Author: David Parker <parkerda@uk.ibm.com> Date: Thu Dec 7 12:45:11 2023 +0000 [patch] Ensure cluster_ingress_tls_crt_remove_it is defined (#1133) commit 9c9342e Author: André Marcelino <31037381+andrercm@users.noreply.github.com> Date: Wed Dec 6 17:38:36 2023 -0300 [patch] Filter DST X3 Root certificate part from the cluster's ingress chain (#1130) commit a080005 Author: André Marcelino <31037381+andrercm@users.noreply.github.com> Date: Wed Dec 6 07:24:36 2023 -0300 [patch] Fix "jdbc_tls_crt is undefined" (#1126) commit 0d5e016 Author: André Marcelino <31037381+andrercm@users.noreply.github.com> Date: Fri Dec 1 16:55:46 2023 -0300 [patch] fix bad indentation for BasCfg when podTemplates is set (#1124) commit b45e7fd Author: David Parker <parkerda@uk.ibm.com> Date: Fri Dec 1 18:16:17 2023 +0000 [patch] Clean up remnants of manual upgrade support (#1123) commit 803bcc3 Author: André Marcelino <31037381+andrercm@users.noreply.github.com> Date: Wed Nov 29 21:46:15 2023 -0300 [patch] Adding cluster's ingress in DNS record list for Route53 hosted zone (#1118) commit 7592542 Author: Sanjay Prabhakar <sanju7216@gmail.com> Date: Wed Nov 29 17:16:31 2023 +0000 [patch] update nov catalog digest and amlen 1.0.2 extras (#1120) Co-authored-by: Sanjay Prabhakar <sanjay.prabhakar@uk.ibm.com> commit c75455a Author: Sanjay Prabhakar <sanju7216@gmail.com> Date: Wed Nov 29 12:16:00 2023 +0000 [minor] Update v8-231128-amd64 catalog casebundle (#1117) Co-authored-by: Sanjay Prabhakar <sanjay.prabhakar@uk.ibm.com> commit c8fe880 Author: André Marcelino <31037381+andrercm@users.noreply.github.com> Date: Mon Nov 27 14:08:02 2023 -0300 [patch] Improvements to handling of files with multiple certificates (#1097) Co-authored-by: David Parker <parkerda@uk.ibm.com> commit 3f5a8c4 Author: André Marcelino <31037381+andrercm@users.noreply.github.com> Date: Mon Nov 27 13:57:47 2023 -0300 [patch] Fix playbook defaults and suite_dns default handling (#1114) Co-authored-by: David Parker <parkerda@uk.ibm.com> commit 9d798d2 Author: Sanjay Prabhakar <sanju7216@gmail.com> Date: Mon Nov 27 16:50:51 2023 +0000 [minor] Support November Catalog Update (#1103) Co-authored-by: Andre Ricardo De Campos Marcelino <andrercm@br.ibm.com> Co-authored-by: Terence Quinn <quinnt@us.ibm.com> Co-authored-by: Sanjay Prabhakar <sanjay.prabhakar@uk.ibm.com> commit acacf77 Author: David Parker <parkerda@uk.ibm.com> Date: Fri Nov 24 19:13:14 2023 +0000 [patch] Fixes and tweaks for better Red Hat content mirroring (#1115) commit 017d579 Author: Sanjay Prabhakar <sanju7216@gmail.com> Date: Fri Nov 24 19:04:32 2023 +0000 [minor] Re-issue October 04 and 31 catalog (#1113) Co-authored-by: Sanjay Prabhakar <sanjay.prabhakar@uk.ibm.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes for:
Users can now export
MAS_JDBC_CERT_LOCAL_FILEorMONGODB_CA_PEM_LOCAL_FILEpointing to pem files containing multiple cert entries while running thegencfgroles and we'll extract the certificate content and loop through a list to include all cert chain properly in the corresponding MAS config.As example:
Having
original-ca-central-1-bundle.pemcontaining the following list of certificates:Then you can run
gencfg_jdbcrole as below:The output will be:
In
udsrole, I have added a fix for #1058that retrieves the UDS cert chain from the ingress secret, and includes all parts of the chain in the BasCfg.
Optionally you can now choose to not include ISRG x1 root cert, if not really needed, by just
export UDS_INCLUDE_ISRG_ROOT_CERT=falseHere's a sample output: