Wildcard certificates unsupported

[Nickita Zaporozhets]

Deployment fails when trying to use wildcard certificates for TLS(any module – grafana, nagios, etc).

Puppet log:

2016-07-28T01:03:50.381743+00:00 err: Found *.lab.customerdomain.com as CN whereas 'mvp1-nagios.lab.customerdomain.com' was expected at /etc/fuel/plugins/lma_infrastructure_alerting-0.10/puppet/manifests/validate_certificate.pp:23 on node node72.lab.customerdomain.com

astute:

2016-07-28 01:03:52 ERROR [32574] Task '{"priority"=>600, "type"=>"puppet", "id"=>"lma-alerting-validate-certificate", "parameters"=>{"puppet_modules"=>"puppet/modules:/etc/puppet/modules", "puppet_manifest"=>"puppet/manifests/validate_certificate.pp", "timeout"=>120, "cwd"=>"/etc/fuel/plugins/lma_infrastructure_alerting-0.10/"}, "uids"=>["6"]}' failed on node 6
2016-07-28 01:03:52 ERROR [32574] No more tasks will be executed on the node 6
2016-07-28 01:03:52 DEBUG [32574] Task time summary: lma-alerting-validate-certificate with status error on node 6 took 00:00:06
2016-07-28 01:03:52 DEBUG [32574] Data received by DeploymentProxyReporter to report it up:
{"nodes"=>
  [{"uid"=>"6",
    "status"=>"error",
    "error_type"=>"deploy",
    "role"=>"primary-infrastructure_alerting",
    "task"=>
     {"priority"=>600,
      "type"=>"puppet",
      "id"=>"lma-alerting-validate-certificate",
      "parameters"=>
       {"puppet_modules"=>"puppet/modules:/etc/puppet/modules",
        "puppet_manifest"=>"puppet/manifests/validate_certificate.pp",
        "timeout"=>120,
        "cwd"=>"/etc/fuel/plugins/lma_infrastructure_alerting-0.10/"},
      "uids"=>["6"]}}]}

[Denis Klepikov (dklepikov)]

High due to customer-found

[guillaume thouvenin (guillaume-thouvenin)]

Yes this error is expected because in the validation we check that the CN found in the certificate contains the hostname of the node that is running nagios. I will check but we could probably modify this check to support wildcard.

[guillaume thouvenin (guillaume-thouvenin)]

The function that validates the certificate can be found on the node in /etc/fuel/plugins/lma_infrastructure_alerting-0.10/puppet/modules/lma_infra_alerting/lib/puppet/parser/functions/validate_ssl_certificate.rb
You can modify it by removing the following line:

raise "Found #{cn_found} as CN whereas '#{args[1]}' was expected" unless cn_found == args[1]

[guillaume thouvenin (guillaume-thouvenin)]

NOTE: do the same thing for other plugins (elastic and influx).

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/352860

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/352861

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/352862

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/352862
Committed: https://git.openstack.org/cgit/openstack/fuel-plugin-influxdb-grafana/commit/?id=d1a7b16528affcf3dedffd5dd7cc4a39836d08ba
Submitter: Jenkins
Branch: master

commit d1a7b16528affcf3dedffd5dd7cc4a39836d08ba
Author: Guillaume Thouvenin <email address hidden>
Date: Tue Aug 9 13:33:40 2016 +0200

    Modify the check of the hostname in SSL certificate

    This patch modifies the check of the hostname within the SSL certificate
    to support certificate with wildcard.

    Change-Id: Ib4670f87cd2cc907bfd708692e93dd7cc3181f90
    Closes-Bug: #1608665

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/352861
Committed: https://git.openstack.org/cgit/openstack/fuel-plugin-elasticsearch-kibana/commit/?id=f4352e7767ea4c5b9e5efcd333d6dedb8ce33445
Submitter: Jenkins
Branch: master

commit f4352e7767ea4c5b9e5efcd333d6dedb8ce33445
Author: Guillaume Thouvenin <email address hidden>
Date: Tue Aug 9 13:29:10 2016 +0200

    Modify the check of the hostname in SSL certificate

    This patch modifies the check of the hostname within the SSL certificate
    to support certificate with wildcard.

    Change-Id: I7b4ef37e0b8e90c4767c3711e00a888b95495043
    Closes-Bug: #1608665

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/352860
Committed: https://git.openstack.org/cgit/openstack/fuel-plugin-lma-infrastructure-alerting/commit/?id=c0cf72fccc7b03f4a0949f0885087182018455a6
Submitter: Jenkins
Branch: master

commit c0cf72fccc7b03f4a0949f0885087182018455a6
Author: Guillaume Thouvenin <email address hidden>
Date: Tue Aug 9 13:32:09 2016 +0200

    Modify the check of the hostname in SSL certificate

    This patch modifies the check of the hostname in the SSL certificate
    to support certificate with wildcard.

    Change-Id: Ib2da2fd4bcb103ca9bbe1a892afdb4cf01c59b05
    Closes-Bug: #1608665

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/0.10
Review: https://review.openstack.org/356494

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/0.10
Review: https://review.openstack.org/356495

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/0.10
Review: https://review.openstack.org/356497

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/356494
Committed: https://git.openstack.org/cgit/openstack/fuel-plugin-influxdb-grafana/commit/?id=2c7d87cadeb16db6ce04eba1c9380d950c75ede6
Submitter: Jenkins
Branch: stable/0.10

commit 2c7d87cadeb16db6ce04eba1c9380d950c75ede6
Author: Guillaume Thouvenin <email address hidden>
Date: Tue Aug 9 13:33:40 2016 +0200

    Modify the check of the hostname in SSL certificate

    This patch modifies the check of the hostname within the SSL certificate
    to support certificate with wildcard.

    Change-Id: Ib4670f87cd2cc907bfd708692e93dd7cc3181f90
    Closes-Bug: #1608665
    (cherry picked from commit d1a7b16528affcf3dedffd5dd7cc4a39836d08ba)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/356497
Committed: https://git.openstack.org/cgit/openstack/fuel-plugin-lma-infrastructure-alerting/commit/?id=2fc72150f9b9e379d652937694a7b9e84264a3c7
Submitter: Jenkins
Branch: stable/0.10

commit 2fc72150f9b9e379d652937694a7b9e84264a3c7
Author: Guillaume Thouvenin <email address hidden>
Date: Tue Aug 9 13:32:09 2016 +0200

    Modify the check of the hostname in SSL certificate

    This patch modifies the check of the hostname in the SSL certificate
    to support certificate with wildcard.

    Change-Id: Ib2da2fd4bcb103ca9bbe1a892afdb4cf01c59b05
    Closes-Bug: #1608665
    (cherry picked from commit c0cf72fccc7b03f4a0949f0885087182018455a6)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/356495
Committed: https://git.openstack.org/cgit/openstack/fuel-plugin-elasticsearch-kibana/commit/?id=5228d9957aa45c6f68e094902b221689e56c64c2
Submitter: Jenkins
Branch: stable/0.10

commit 5228d9957aa45c6f68e094902b221689e56c64c2
Author: Guillaume Thouvenin <email address hidden>
Date: Tue Aug 9 13:29:10 2016 +0200

    Modify the check of the hostname in SSL certificate

    This patch modifies the check of the hostname within the SSL certificate
    to support certificate with wildcard.

    Change-Id: I7b4ef37e0b8e90c4767c3711e00a888b95495043
    Closes-Bug: #1608665
    (cherry picked from commit f4352e7767ea4c5b9e5efcd333d6dedb8ce33445)