Services need restarting if certificates change

[Liam Young]

If the certificates provides via the certificates relation change then apache2 needs restarting after they are written to disk, otherwise apache continues to use the old certificates.

This can be seen in a debug hooks session:

root@juju-a131c2-zaza-d637e467b7f0-8:/var/lib/juju/agents/unit-keystone-0/charm# md5sum /etc/apache2/ssl/keystone/*
27c112c6457cf759c204cd80150f758f /etc/apache2/ssl/keystone/cert_10.5.0.198
27c112c6457cf759c204cd80150f758f /etc/apache2/ssl/keystone/cert_juju-a131c2-zaza-d637e467b7f0-8.project.serverstack
09150397f4c8134441b51b19397a42d8 /etc/apache2/ssl/keystone/key_10.5.0.198
09150397f4c8134441b51b19397a42d8 /etc/apache2/ssl/keystone/key_juju-a131c2-zaza-d637e467b7f0-8.project.serverstack

# ./hooks/certificates-relation-changed

# md5sum /etc/apache2/ssl/keystone/*
57f3bf1204e42efae1862287c4b9624d /etc/apache2/ssl/keystone/cert_10.5.0.198
57f3bf1204e42efae1862287c4b9624d /etc/apache2/ssl/keystone/cert_juju-a131c2-zaza-d637e467b7f0-8.project.serverstack
30eea1d82ac5161256d333e7ad701ce9 /etc/apache2/ssl/keystone/key_10.5.0.198
30eea1d82ac5161256d333e7ad701ce9 /etc/apache2/ssl/keystone/key_juju-a131c2-zaza-d637e467b7f0-8.project.serverstack

# curl https://10.5.0.198:5000
curl: (35) error:0407008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding

# systemctl restart apache2

# curl https://10.5.0.198:5000
{"versions": {"values": [{"id": "v3.11", "status": "stable", "updated": "2018-10-15T00:00:00Z", "links": [{"rel": "self", "href": "https://10.5.0.198:5000/v3/"}], "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}]}]}}root@juju-

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/658315

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/658315
Committed: https://git.openstack.org/cgit/openstack/charm-keystone/commit/?id=1f5a09b55ebfed7f3a0597316cffb04f512dc443
Submitter: Zuul
Branch: master

commit 1f5a09b55ebfed7f3a0597316cffb04f512dc443
Author: Liam Young <email address hidden>
Date: Fri May 10 09:12:36 2019 +0000

    Check Apache ssl dir when determining restart map

    If the certificates that Apache is using change then Apache needs to
    be restarted. This change adds the SSL directory to the restart map
    to ensure any certificate changes trigger a restart.

    Change-Id: I1fd46865350e6a9cb35f4209fcf8dd201e6f1441
    Closes-Bug: 1828530

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/658350

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/658356

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/658387

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/658350
Committed: https://git.openstack.org/cgit/openstack/charm-glance/commit/?id=c9f44a7ceccea85693bb0afed6e721ca953fb04a
Submitter: Zuul
Branch: master

commit c9f44a7ceccea85693bb0afed6e721ca953fb04a
Author: Liam Young <email address hidden>
Date: Fri May 10 12:48:01 2019 +0000

    Check Apache ssl dir when determining restart map

    If the certificates that Apache is using change then services needs
    to be restarted. This change adds the SSL directory to the restart
    map to ensure any certificate changes trigger a restart.

    Change-Id: Idbdceb5acd80c06a2bde02f9df88a9d9fd2404fb
    Closes-Bug: 1828530

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/658356
Committed: https://git.openstack.org/cgit/openstack/charm-neutron-api/commit/?id=1cdfc381ad55e7ad1e8b9579091bb16589f2c5d8
Submitter: Zuul
Branch: master

commit 1cdfc381ad55e7ad1e8b9579091bb16589f2c5d8
Author: Liam Young <email address hidden>
Date: Fri May 10 13:09:22 2019 +0000

    Check Apache ssl dir when determining restart map

    If the certificates change then services needs to
    be restarted. This change adds the SSL directory to the restart map
    to ensure any certificate changes trigger a restart.

    Change-Id: I891b3104c08c6b9cde06ce30d4279a239ae329b1
    Closes-Bug: 1828530

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/658387
Committed: https://git.openstack.org/cgit/openstack/charm-nova-cloud-controller/commit/?id=822daf2794f44f61f5336a180752ba9e5482be81
Submitter: Zuul
Branch: master

commit 822daf2794f44f61f5336a180752ba9e5482be81
Author: Liam Young <email address hidden>
Date: Fri May 10 15:01:04 2019 +0000

    Check Apache ssl dir when determining restart map

    If the certificates change then services needs to be restarted. This
    change adds the SSL directory to the restart map to ensure any
    certificate changes trigger a restart.

    Also, if the certificates change we need to pass those on to
    nova-compute.

    Change-Id: I4cb2f760c26f0804d3cb7466c8aa741d5e0ec314
    Closes-Bug: 1828530