Front proxy and etcd certificates not removed after cluster deletion

Bug #2061314 reported by Mariusz Adamski
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Magnum
In Progress
Undecided
Unassigned

Bug Description

It seems that since separate CA certs were added for etcd and front proxy in https://review.opendev.org/c/openstack/magnum/+/746864, the cleanup code to remove these certificates was never put in place, as can be seen here: https://opendev.org/openstack/magnum/src/branch/master/magnum/conductor/handlers/common/cert_manager.py#L240

Steps to reproduce:
Create a Magnum cluster and then delete it. Inspect the Barbican database to see that two certificates, along with their private keys and passphrases are still left:

$ mysql barbican -t <<<"select name, status, created_at, deleted_at from secrets order by created_at desc limit 12;"
+------------------------+--------+---------------------+---------------------+
| name | status | created_at | deleted_at |
+------------------------+--------+---------------------+---------------------+
| Private Key Passphrase | ACTIVE | 2024-04-14 18:32:48 | 2024-04-14 19:06:39 |
| Certificate | ACTIVE | 2024-04-14 18:32:48 | 2024-04-14 19:06:39 |
| Private Key | ACTIVE | 2024-04-14 18:32:48 | 2024-04-14 19:06:39 |
| Private Key | ACTIVE | 2024-04-14 18:32:47 | NULL |
| Private Key Passphrase | ACTIVE | 2024-04-14 18:32:47 | NULL |
| Certificate | ACTIVE | 2024-04-14 18:32:47 | NULL |
| Private Key Passphrase | ACTIVE | 2024-04-14 18:32:46 | NULL |
| Private Key | ACTIVE | 2024-04-14 18:32:46 | NULL |
| Certificate | ACTIVE | 2024-04-14 18:32:45 | NULL |
| Private Key Passphrase | ACTIVE | 2024-04-14 18:32:44 | 2024-04-14 19:06:38 |
| Private Key | ACTIVE | 2024-04-14 18:32:44 | 2024-04-14 19:06:38 |
| Certificate | ACTIVE | 2024-04-14 18:32:43 | 2024-04-14 19:06:38 |
+------------------------+--------+---------------------+---------------------+

Expected result:
All created certificates should be removed when the cluster is deleted.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to magnum (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/magnum/+/915775

Changed in magnum:
status: New → In Progress
Mariusz Adamski (marad)
description: updated
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.