Change in vdsm[ovirt-3.1]: setup: move the certificate generation
fsimonce at redhat.com
fsimonce at redhat.com
Thu Jan 3 13:43:32 UTC 2013
Hello Michael Burns, Dan Kenigsberg,
I'd like you to do a code review. Please visit
http://gerrit.ovirt.org/10615
to review the following change.
Change subject: setup: move the certificate generation
......................................................................
setup: move the certificate generation
Generating the certificate at the service startup (instead of during the
rpm installation) has a better chance to succeed (and a better recovery
process). Moreover this allows appliances (like ovirt-node) to postpone
the certificate generation when the service is actually used for the
first time.
In this patch:
* Move the certificate generation from the spec file to the init file
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=860067
Signed-off-by: Federico Simoncelli <fsimonce at redhat.com>
Change-Id: I40fa3d9a6a54e312e399af3f87ac67e843078360
Reviewed-on: http://gerrit.ovirt.org/8368
Reviewed-by: Dan Kenigsberg <danken at redhat.com>
Reviewed-by: Michael Burns <mburns at redhat.com>
Tested-by: Michael Burns <mburns at redhat.com>
---
M vdsm.spec.in
M vdsm/vdsm-gencerts.sh.in
M vdsm/vdsmd.init.in
3 files changed, 9 insertions(+), 3 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/15/10615/1
diff --git a/vdsm.spec.in b/vdsm.spec.in
index 5f5f989..572b338 100644
--- a/vdsm.spec.in
+++ b/vdsm.spec.in
@@ -404,9 +404,6 @@
/etc/pki/vdsm/keys/libvirt_password
fi
-# generate the vdsm certificates (if missing)
-%{_libexecdir}/%{vdsm_name}/vdsm-gencerts.sh
-
%if 0%{?rhel}
if [ "$1" -eq 1 ] ; then
/sbin/chkconfig --add vdsmd
diff --git a/vdsm/vdsm-gencerts.sh.in b/vdsm/vdsm-gencerts.sh.in
index 1e11b69..3ee38c3 100755
--- a/vdsm/vdsm-gencerts.sh.in
+++ b/vdsm/vdsm-gencerts.sh.in
@@ -33,6 +33,10 @@
umask 077
+if [ "$1" = "--check" ]; then
+ [ -s "$VDSM_KEY" -a -s "$VDSM_CA" -a -s "$VDSM_CRT" ] && exit 0 || exit 1
+fi
+
if [ ! -f "$VDSM_KEY" ]; then
/usr/bin/certtool --generate-privkey --outfile "$VDSM_KEY" 2> /dev/null
/bin/chown "$VDSM_PERMS" "$VDSM_KEY"
diff --git a/vdsm/vdsmd.init.in b/vdsm/vdsmd.init.in
index dd6f3c6..a288c16 100755
--- a/vdsm/vdsmd.init.in
+++ b/vdsm/vdsmd.init.in
@@ -498,6 +498,11 @@
shutdown_conflicting_srv && stop_libvirtd_sysv
+ if ! @LIBEXECDIR@/vdsm-gencerts.sh --check; then
+ echo -n $"Configuring a self-signed VDSM host certificate: "
+ @LIBEXECDIR@/vdsm-gencerts.sh && success || failure ; echo
+ fi
+
reconfigure noforce
ret_val=$?
if [ $ret_val -ne 0 ]
--
To view, visit http://gerrit.ovirt.org/10615
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I40fa3d9a6a54e312e399af3f87ac67e843078360
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: ovirt-3.1
Gerrit-Owner: Federico Simoncelli <fsimonce at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Michael Burns <mburns at redhat.com>
More information about the vdsm-patches
mailing list