Change in vdsm[master]: BZ#856167 - Store engine CA cert in enginecacert.pem

juan.hernandez at redhat.com juan.hernandez at redhat.com
Mon Sep 24 14:21:57 UTC 2012


Juan Hernandez has posted comments on this change.

Change subject: BZ#856167 - Store engine CA cert in enginecacert.pem
......................................................................


Patch Set 2: (1 inline comment)

....................................................
File vdsm_reg/deployUtil.py.in
Line 1468:             ovirtfunctions.ovirt_safe_delete_config(CACERT)
Line 1469:         if os.path.exists(ENGINECACERT):
Line 1470:             ovirtfunctions.ovirt_safe_delete_config(ENGINECACERT)
Line 1471: 
Line 1472: def getRhevmCert(IP, port):
Ok, now I understand.

There are two CA certificates involved:

1. The VDSM default CA certificate that is part of the node .iso. This CA is used to generate a VDSM certificate that is also part of the .iso. My understanding is that this VDSM certificate is needed in order to be able to start VDSM and libvirt while the final VDSM certificate is not yet generated.

2. The engine CA certificate, generated during the installation of the engine.

The problem is that both are stored in the same place: /etc/pki/vdsm/certs/cacert.pem. When the node installation begins it downloads the engine CA certificate to this location. Then, after the reboot, the VDSM start scripts overwrites it with its own (to be able to start libvirt). Then vdsm-reg tries to use it to download the SSH key from the engine and fails, because it is using VDSM default CA certificate instead of the engine CA certificate.

What this patch tries to do is to make sure that the engine CA certificate is downloaded to a different place, so that VDSM will not overwrite it during the reboot.
Line 1473: 
Line 1474:     dontcare, VDSMCERT, ENGINECACERT = certPaths('')
Line 1475:     RHEVM_CERT_FILE = "/ca.crt"
Line 1476:     rhevmCert = getRemoteFile(str(IP), str(port), RHEVM_CERT_FILE)


--
To view, visit http://gerrit.ovirt.org/8038
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: I127bf44cbcde90f7dae26a3bd3127f3eac2ca53c
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Juan Hernandez <juan.hernandez at redhat.com>
Gerrit-Reviewer: Alon Bar-Lev <alonbl at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Doron Fediuck <dfediuck at redhat.com>
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland at redhat.com>
Gerrit-Reviewer: Juan Hernandez <juan.hernandez at redhat.com>
Gerrit-Reviewer: Michael Burns <mburns at redhat.com>


More information about the vdsm-patches mailing list