Change in vdsm[master]: BZ#815825: backup certs during registration
danken at redhat.com
danken at redhat.com
Wed May 9 09:30:13 UTC 2012
Dan Kenigsberg has submitted this change and it was merged.
Change subject: BZ#815825: backup certs during registration
......................................................................
BZ#815825: backup certs during registration
During the registration of oVirt Engine in a oVirt Node, instead of
remove cacert.pem and downloading the new cacert from Engine, is
important to backup the current certs before going further.
Besides, there is also a bug situation where the administrator of oVirt
Node executes the Engine registration procedure, and the host doesn't
get 'approved' (note: at this point cacert.pem from Engine already replaced
the /etc/pki/vdsm/certs/cacert.pem) causing a failure in the next reboot
on libvirt daemon startup. This happens because cacert.pem certificate
file cannot be validated with vdsmcert.pem, so if we have a backup, we
can easily revert it.
For record, steps to reproduce the bug:
- Install oVirt Node
- Setup Network
- Register the Node to oVirt Engine (do not approve)
- Reboot. (libvirt will fail to start)
Finally, there's also available a patch to libvirt.upstart
(http://gerrit.ovirt.org/#change,3885) that adds a validation feature
during the start of libvirt daemon, in order to check cacert.pem and
vdsmcert.pem. In case of
failure, upstart will look for the correct CA (backup file) in
/etc/pki/vdsm/certs and replace the
current cacert.pem. This approach can avoid the above bug description.
Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
---
M vdsm_reg/deployUtil.py.in
1 file changed, 19 insertions(+), 1 deletion(-)
Approvals:
Douglas Schilling Landgraf: Verified
Dan Kenigsberg: Looks good to me, approved
--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 7
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland at redhat.com>
Gerrit-Reviewer: Michael Burns <mburns at redhat.com>
More information about the vdsm-patches
mailing list