SSL endpoints fail to be reached by controller manager
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Magnum |
Fix Released
|
Undecided
|
Spyros Trigazis |
Bug Description
Under Fedora Atomic, the `/etc/ssl/certs` folder contains the ca-bundle for all verified CAs, however, that file is a symbolic link to another path on the system
[root@k8-
lrwxrwxrwx. 1 root root 49 Jul 23 22:43 /etc/ssl/
Therefore, when k8s-controller-
The hyperkube image ships with a built in list of vetted CAs which should be enough for most users, so it's probably better to rely on it.
Changed in magnum: | |
assignee: | nobody → Mohammed Naser (mnaser) |
status: | New → In Progress |
Changed in magnum: | |
assignee: | Mohammed Naser (mnaser) → Spyros Trigazis (strigazi) |
Reviewed: https:/ /review. openstack. org/488511 /git.openstack. org/cgit/ openstack/ magnum/ commit/ ?id=ae15aa6c28e 4209e60a52ca641 2b9c211f6866f5
Committed: https:/
Submitter: Jenkins
Branch: master
commit ae15aa6c28e4209 e60a52ca6412b9c 211f6866f5
Author: Mohammed Naser <email address hidden>
Date: Fri Jul 28 12:08:31 2017 -0400
Remove /etc/ssl/certs in the controller manager pod
For system such as Fedora Atomic, the CA bundle files which are
contained in /etc/ssl/certs are symbolic links to /etc/pki. When
configuring the controller manager to use an SSL endpoint, it will
raise an error as it is unable to authenticate the SSL endpoint.
This patch removes the host mount at /etc/ssl/certs. The Hyperkube
images already ship a collection of CAs which are likely good for
all needs.
Closes-Bug: #1708452
Change-Id: Ife2b60d1968482 a8c3ab9b44abbe4 01c6230881c