Change in vdsm[master]: BZ#815825: backup certs during registration

danken at redhat.com danken at redhat.com
Wed May 9 09:30:13 UTC 2012


Dan Kenigsberg has submitted this change and it was merged.

Change subject: BZ#815825: backup certs during registration
......................................................................


BZ#815825: backup certs during registration

During the registration of oVirt Engine in a oVirt Node, instead of
remove cacert.pem and downloading the new cacert from Engine, is
important to backup the current certs before going further.

Besides, there is also a bug situation where the administrator of oVirt
Node executes the Engine registration procedure, and the host doesn't
get 'approved' (note: at this point cacert.pem from Engine already replaced
the /etc/pki/vdsm/certs/cacert.pem) causing a failure in the next reboot
on libvirt daemon startup. This happens because cacert.pem certificate
file cannot be validated with vdsmcert.pem, so if we have a backup, we
can easily revert it.

For record, steps to reproduce the bug:

- Install oVirt Node
- Setup Network
- Register the Node to oVirt Engine (do not approve)
- Reboot. (libvirt will fail to start)

Finally, there's also available a patch to libvirt.upstart
(http://gerrit.ovirt.org/#change,3885) that adds a validation feature
during the start of libvirt daemon, in order to check cacert.pem and
vdsmcert.pem. In case of
failure, upstart will look for the correct CA (backup file) in
/etc/pki/vdsm/certs and replace the
current cacert.pem. This approach can avoid the above bug description.

Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
---
M vdsm_reg/deployUtil.py.in
1 file changed, 19 insertions(+), 1 deletion(-)

Approvals:
  Douglas Schilling Landgraf: Verified
  Dan Kenigsberg: Looks good to me, approved


--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 7
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland at redhat.com>
Gerrit-Reviewer: Michael Burns <mburns at redhat.com>


More information about the vdsm-patches mailing list