Refs #5815 - generate certs for node qpid #14

iNecas · 2014-05-20T12:52:06Z

No description provided.

ehelms · 2014-05-20T13:06:22Z

manifests/pulp_child.pp

@@ -25,5 +42,16 @@
      # Defined in certs::apache module
      key_pair => Cert["${hostname}-apache"],
    }
+
+    Cert["${::certs::pulp_child::hostname}-qpid-client-cert"] ~>


The server qpid certs we have to deploy striped, not the case when deploying for the child? I wonder if that means the new version of qpid doesn't require us to strip the cert.

Seems so: had no issues with this on update system

jlsherrill · 2014-05-21T01:59:01Z

One issue i hit:

/File[/etc/pki/katello/nssdb]/ensure: change from absent to directory failed: Could not set 'directory on ensure: Could not find group qpidd at /root/katello-installer/modules/certs/manifests/qpid.pp:59

After it finished the 'qpidd' group existed, so I'm guessing an ordering issue as qpid was not installed prior to running the capsule command.

jlsherrill · 2014-05-21T02:08:17Z

Also saw:

Could not find a suitable provider for foreman_smartproxy

Although when running the installer a 2nd time, i did not see this error.

jlsherrill · 2014-05-21T02:17:55Z

Looks like the installer is still trying to connect to a nodes api (but Katello/katello#4118 looks like it changed everything to capsule):

/Stage[main]/Capsule/Katello_node[https://centos.dev/katello]/ensure: change from absent to present failed: Could not set 'present on ensure: Failed to register the node:

server log:
ActionController::RoutingError (No route matches [GET] "/katello/api/nodes/by_uuid/d7468fd4-4293-42a9-8eb9-def46d06e3a2"):

Rendered /home/vagrant/.rvm/gems/ruby-1.9.3-p448/gems/actionpack-3.2.18/lib/action_dispatch/middleware/templates/rescues/routing_error.erb within rescues/layout (0.8ms)

ActionController::RoutingError (No route matches [POST] "/katello/api/nodes"):

jlsherrill · 2014-05-21T02:21:32Z

Another thing i noticed:

/Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[katello.devel]/ensure: change from absent to present failed: Could not set 'present on ensure: 422 Unprocessable Entity at /root/katello-installer/modules/foreman_proxy/manifests/register.pp:12

from the server:

Unprocessable entity SmartProxy (id: new):
  Unable to communicate with the proxy: Permission denied - /var/lib/puppet/ssl/certs/centos.dev.pem
  Please check the proxy is configured and running on the host.

  Rendered api/v2/errors/unprocessable_entity.json.rabl within api/v2/layouts/error_layout (2.8ms)
Body: {
  "error": {"id":null,"errors":{"base":["Unable to communicate with the proxy: Permission denied - /var/lib/puppet/ssl/certs/centos.dev.pem","Please check the proxy is configured and running on the host."]},"full_messages":["Unable to communicate with the proxy: Permission denied - /var/lib/puppet/ssl/certs/centos.dev.pem","Please check the proxy is configured and running on the host."]}
}


ActionController::RoutingError (No route matches [GET] "/katello/api/nodes/by_uuid/d7468fd4-4293-42a9-8eb9-def46d06e3a2"):



  Rendered /home/vagrant/.rvm/gems/ruby-1.9.3-p448/gems/actionpack-3.2.18/lib/action_dispatch/middleware/templates/rescues/routing_error.erb within rescues/layout (0.7ms)

ActionController::RoutingError (No route matches [POST] "/katello/api/nodes"):

It seems weird that foreman would need to access /var/lib/puppet/ssl/certs/centos.dev.pem on the Server in order to enable a smart proxy???

I did a chmod 755 /var/lib/puppet/ on the katello server (to give access apache to /var/lib/puppet/ssl/certs/centos.dev.pem) and it gets a bit further:

Unprocessable entity SmartProxy (id: new):
  Unable to communicate with the proxy: ERF12-2530 [ProxyAPI::ProxyException]: Unable to detect features ([OpenSSL::SSL::SSLError]: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verif...) for proxy https://katello.devel:9090/features
  Please check the proxy is configured and running on the host.

  Rendered api/v2/errors/unprocessable_entity.json.rabl within api/v2/layouts/error_layout (0.8ms)
Body: {
  "error": {"id":null,"errors":{"base":["Unable to communicate with the proxy: ERF12-2530 [ProxyAPI::ProxyException]: Unable to detect features ([OpenSSL::SSL::SSLError]: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verif...) for proxy https://katello.devel:9090/features","Please check the proxy is configured and running on the host."]},"full_messages":["Unable to communicate with the proxy: ERF12-2530 [ProxyAPI::ProxyException]: Unable to detect features ([OpenSSL::SSL::SSLError]: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verif...) for proxy https://katello.devel:9090/features","Please check the proxy is configured and running on the host."]}
}

iNecas · 2014-05-21T07:38:46Z

ad the missing nodes api: I've forgot to remove that, but we don't need to register the node separately, as we use the smart-proxy for that: so once there is smart proxy registered, we are able to use that as capsule (the checking on pulp feature being present on the proxy is not there yet, as waiting for theforeman/smart-proxy#153

iNecas · 2014-05-21T07:42:23Z

I was testing this on a server, where all the packages were already preinstalled. Thanks for checking that on fresh one: I will address the ordering issue.

Ad. loading the certs on foreman: by default, foreman upstream leverages the puppet ca for the smart proxy verification. We configure it to use our manifests here https://github.com/Katello/puppet-certs/blob/master/manifests/foreman.pp#L52: Is it possible this would be caused by you running devepment setup or reset database?

By making sure the packages that deploy users are there

iNecas · 2014-05-21T11:32:35Z

@jlsherrill addressed in the latest commits here and in theforeman/puppet-foreman_proxy_content#5

jlsherrill · 2014-05-21T13:53:00Z

@iNecas yes, that is possible, as my katello server was running a --development deploy. Let me spin up a new one with a non-devel deploy.

jlsherrill · 2014-05-21T22:39:15Z

The first time i still saw:
Could not find a suitable provider for foreman_smartproxy
after the first time running it i never saw that error.

This time i did it with a production deployment with your scratch build of master. I got these two errors when doing the capsule install with your changes:

 /Stage[main]/Certs::Pulp_child/Cert[katello.devel-qpid-client-cert]/ensure: change from absent to present failed: Execution of '/usr/bin/yum install -y katello.devel-qpid-client-cert' returned 1: Loaded plugins: product-id, rhnplugin, subscription-manager

 /Stage[main]/Certs::Qpid/Cert[katello.devel-qpid-broker]/ensure: change from absent to present failed: Execution of '/usr/bin/yum install -y katello.devel-qpid-broker' returned 1: Loaded plugins: product-id, rhnplugin, subscription-manager
 Nothing to do

These rpms were installed afterwards:

katello.devel-foreman-proxy-1.0-1.noarch
katello.devel-puppet-client-1.0-1.noarch
katello.devel-apache-1.0-1.noarch

jlsherrill · 2014-05-22T02:39:08Z

@iNecas AHHHH

I was all like:

but then i thought about it and had a great idea!

and realized i wasn't running capsule-certs-generate from the git checkout of katello-installer with all your changes. So i re-reran it all and then i was like:

iNecas · 2014-05-22T10:31:24Z

LOL

Ad: Could not find suitable provider: this should fix it Katello/katello-installer#64

jlsherrill · 2014-05-23T01:47:41Z

ACK

Refs #5815 - generate certs for node qpid

Refs #5815 - generate certs for node qpid

79bb702

iNecas mentioned this pull request May 20, 2014

Fixes #5815 - set up the qpid ssl connection properly theforeman/puppet-foreman_proxy_content#5

Merged

ehelms reviewed May 20, 2014
View reviewed changes

jlsherrill mentioned this pull request May 21, 2014

add capsule support to API/CLI Katello/katello#4118

Merged

5 tasks

Refs #5815 - make sure the required users are present

09ca7a7

By making sure the packages that deploy users are there

jlsherrill added a commit that referenced this pull request May 23, 2014

Merge pull request #14 from iNecas/pulp-child-qpid

bc1f86c

Refs #5815 - generate certs for node qpid

jlsherrill merged commit bc1f86c into theforeman:master May 23, 2014

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refs #5815 - generate certs for node qpid #14

Refs #5815 - generate certs for node qpid #14

iNecas commented May 20, 2014

ehelms May 20, 2014

iNecas May 20, 2014

jlsherrill commented May 21, 2014

jlsherrill commented May 21, 2014

jlsherrill commented May 21, 2014

jlsherrill commented May 21, 2014

iNecas commented May 21, 2014

iNecas commented May 21, 2014

iNecas commented May 21, 2014

jlsherrill commented May 21, 2014

jlsherrill commented May 21, 2014

jlsherrill commented May 22, 2014

iNecas commented May 22, 2014

jlsherrill commented May 23, 2014

Refs #5815 - generate certs for node qpid #14

Refs #5815 - generate certs for node qpid #14

Conversation

iNecas commented May 20, 2014

ehelms May 20, 2014

Choose a reason for hiding this comment

iNecas May 20, 2014

Choose a reason for hiding this comment

jlsherrill commented May 21, 2014

jlsherrill commented May 21, 2014

jlsherrill commented May 21, 2014

jlsherrill commented May 21, 2014

iNecas commented May 21, 2014

iNecas commented May 21, 2014

iNecas commented May 21, 2014

jlsherrill commented May 21, 2014

jlsherrill commented May 21, 2014

jlsherrill commented May 22, 2014

iNecas commented May 22, 2014

jlsherrill commented May 23, 2014