When sw-manager is used through a secure connection (https
enabled) either with the remote CLI or within the cluster
via the public interface, the operation fails if the
Certificate Authority's cert is not included among the
system's trusted CAs.
The sw-manager client lacks implemented methods for
referencing a local Certificate Authority Cert during calls.
Therefore, if the CA is not among the system's trusted CAs,
all calls made by sw-manager's CLI will fail since
authentication in Keystone will also fail.
Other CLIs like fm or platform allow referencing a CA Cert
via the "REQUESTS_CA_BUNDLE" environment variable. The fix
involves loading, if defined, the CA Cert referenced by
such an environment variable, and adjusting SSL calls to
verify connections using the provided CA Cert.
Test Plan:
PASS Fresh Install SX Env
PASS Source openrc.sh file (internal interface).
PASS sw-manager patch-strategy show
PASS Enable secure mode (https)
PASS Download OpenStack RC File from Horizon.
PASS Source RC file inside cluster (public interface).
PASS Set REQUESTS_CA_BUNDLE with CA-Cert path.
PASS sw-manager patch-strategy show
PASS Enable secure mode (https)
PASS Download OpenStack RC File from Horizon.
PASS Install remote CLI (custom container with changes)
PASS Source downloaded RC file
PASS Set REQUESTS_CA_BUNDLE with CA-Cert path.
PASS sw-manager patch-strategy show
Reviewed: https:/ /review. opendev. org/c/starlingx /nfv/+/ 892822 /opendev. org/starlingx/ nfv/commit/ 9feef4232d37815 1f52cc56f9d0fe2 711b745559
Committed: https:/
Submitter: "Zuul (22348)"
Branch: master
commit 9feef4232d37815 1f52cc56f9d0fe2 711b745559
Author: Jorge Saffe <email address hidden>
Date: Fri Aug 25 17:21:02 2023 -0400
sw-manager fails with SSL and CA Cert provided.
When sw-manager is used through a secure connection (https
enabled) either with the remote CLI or within the cluster
via the public interface, the operation fails if the
Certificate Authority's cert is not included among the
system's trusted CAs.
The sw-manager client lacks implemented methods for
referencing a local Certificate Authority Cert during calls.
Therefore, if the CA is not among the system's trusted CAs,
all calls made by sw-manager's CLI will fail since
authentication in Keystone will also fail.
Other CLIs like fm or platform allow referencing a CA Cert CA_BUNDLE" environment variable. The fix
via the "REQUESTS_
involves loading, if defined, the CA Cert referenced by
such an environment variable, and adjusting SSL calls to
verify connections using the provided CA Cert.
Test Plan:
PASS Fresh Install SX Env
PASS Source openrc.sh file (internal interface).
PASS sw-manager patch-strategy show
PASS Enable secure mode (https)
PASS Download OpenStack RC File from Horizon.
PASS Source RC file inside cluster (public interface).
PASS Set REQUESTS_CA_BUNDLE with CA-Cert path.
PASS sw-manager patch-strategy show
PASS Enable secure mode (https)
PASS Download OpenStack RC File from Horizon.
PASS Install remote CLI (custom container with changes)
PASS Source downloaded RC file
PASS Set REQUESTS_CA_BUNDLE with CA-Cert path.
PASS sw-manager patch-strategy show
Closes-bug: 2033561
Change-Id: If5b70714cde09b d8c329b976a8148 daee9001415
Signed-off-by: Jorge Saffe <email address hidden>