commit 6cfcb8b79877499f177e2bbf076f7f50cdc228af
Author: Liam Young <email address hidden>
Date: Tue Jan 23 10:47:44 2018 +0000
Render SSL config when resolve_address changes
When supplying certs and keys directly to the charm then
get_certs_and_keys is hardcoded to return a cn of None. However,
when the certs are written to disk configure_cert checks if the cn
is None and if it is sets the cn to
os_ip.resolve_address(endpoint_type=os_ip.INTERNAL). This causes an
issue because generating the certs and keys is gated on a change to
the return of get_certs_and_keys which always sets cn to None,
however when the charm is clustered os_ip.resolve_address will
return the vip which should change the cn. This means that if the
charm transitions from un-clustered to clustered ssl certs will not
be reconfigured if they have been configured already despite the cn
having changed.
This patch changes the default of cn in get_certs_and_keys to be
os_ip.resolve_address(endpoint_type=os_ip.INTERNAL). Although this
is a change in behaviour I believe that no charms are calling
get_certs_and_keys directly and the risk is very low.
Reviewed: https:/ /review. openstack. org/536776 /git.openstack. org/cgit/ openstack/ charms. openstack/ commit/ ?id=6cfcb8b7987 7499f177e2bbf07 6f7f50cdc228af
Committed: https:/
Submitter: Zuul
Branch: master
commit 6cfcb8b79877499 f177e2bbf076f7f 50cdc228af
Author: Liam Young <email address hidden>
Date: Tue Jan 23 10:47:44 2018 +0000
Render SSL config when resolve_address changes
When supplying certs and keys directly to the charm then certs_and_ keys is hardcoded to return a cn of None. However, ip.resolve_ address( endpoint_ type=os_ ip.INTERNAL) . This causes an address will
get_
when the certs are written to disk configure_cert checks if the cn
is None and if it is sets the cn to
os_
issue because generating the certs and keys is gated on a change to
the return of get_certs_and_keys which always sets cn to None,
however when the charm is clustered os_ip.resolve_
return the vip which should change the cn. This means that if the
charm transitions from un-clustered to clustered ssl certs will not
be reconfigured if they have been configured already despite the cn
having changed.
This patch changes the default of cn in get_certs_and_keys to be ip.resolve_ address( endpoint_ type=os_ ip.INTERNAL) . Although this certs_and_ keys directly and the risk is very low.
os_
is a change in behaviour I believe that no charms are calling
get_
Change-Id: I598bc822afa535 fc865a333033069 cfe05d7259d
Closes-Bug: #1744886