50c17f8e57
Add explicit collect of certificates files for the platform.
Delete all crt, pem and key files in collect before including those
files explicitly listed in certs.include file. Use openssl command to
omit all but certificate information from the files.
Test Plan:
PASS AIO-SX, AIO-DX+, DC with AIO-SX subcloud
PASS options --skip-mask, --omit-certs, --subcloud
PASS bashate
PASS unit test for collect_certificates
PASS collect output contains no crt, pem and key files except those
listed in certs.include
PASS If a file listed in certs.include does not exist on the filesystem
then the absence is ignored - it is ok for a specified file not to
exist.
PASS file with key omits key - only certs are copied
PASS manual verify of file paths (including those on DC subcloud)
Closes-Bug: 2029302
Change-Id: I9fafe5fde39a1a7de9a887424f274986b13e053a
Signed-off-by: Michel Thebeau <Michel.Thebeau@windriver.com>
43 lines
1.3 KiB
Plaintext
43 lines
1.3 KiB
Plaintext
# certs.include format:
|
|
#
|
|
# Ignore anything that does not start with slash
|
|
# Replace "%%RELEASE%%" with the cluster's current release
|
|
# If the line ends with slash treat it like a directory
|
|
# Otherwise, treat it like a file
|
|
|
|
# 1. k8s certificates:
|
|
/etc/kubernetes/pki/
|
|
/etc/etcd/
|
|
/var/lib/kubelet/pki/kubelet-client-current.pem
|
|
/var/lib/kubelet/pki/kubelet.crt
|
|
|
|
# 2. DC admin endpoint certificates
|
|
/etc/ssl/private/admin-ep-cert.pem
|
|
/opt/platform/config/%%RELEASE%%/dc-adminep-root-ca.crt
|
|
|
|
# 3. docker registry certificates
|
|
/etc/ssl/private/registry-cert.crt
|
|
/etc/docker/certs.d/registry.local:9001/registry-cert.crt
|
|
/etc/docker/certs.d/registry.central:9001/registry-cert.crt
|
|
|
|
# 4. openldap certificates
|
|
/etc/ldap/certs/openldap-cert.crt
|
|
|
|
# 5. GUI/REST API certificates
|
|
/etc/ssl/private/server-cert.pem
|
|
|
|
# 6. Installed ssl CA certificates
|
|
/etc/pki/ca-trust/source/anchors/
|
|
# The following path is hardcoded with regex in collect_certificates:
|
|
# /opt/platform/config/%%RELEASE%%/ssl_ca/ssl_ca_[0-9]{20}
|
|
|
|
# 7. ceph
|
|
/run/ceph/mgr/restful.crt
|
|
|
|
# 8. platform config
|
|
/opt/platform/config/%%RELEASE%%/
|
|
/opt/platform/config/%%RELEASE%%/etcd/
|
|
/opt/platform/config/%%RELEASE%%/kubernetes/pki/
|
|
/opt/platform/config/%%RELEASE%%/registry.central/registry-cert.crt
|
|
/opt/platform/config/%%RELEASE%%/ca-cert.pem
|