Change in vdsm[ovirt-3.1]: setup: move the certificate generation

fsimonce at redhat.com fsimonce at redhat.com
Thu Jan 3 13:43:32 UTC 2013


Hello Michael Burns, Dan Kenigsberg,

I'd like you to do a code review.  Please visit

    http://gerrit.ovirt.org/10615

to review the following change.

Change subject: setup: move the certificate generation
......................................................................

setup: move the certificate generation

Generating the certificate at the service startup (instead of during the
rpm installation) has a better chance to succeed (and a better recovery
process). Moreover this allows appliances (like ovirt-node) to postpone
the certificate generation when the service is actually used for the
first time.

In this patch:
* Move the certificate generation from the spec file to the init file

Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=860067
Signed-off-by: Federico Simoncelli <fsimonce at redhat.com>
Change-Id: I40fa3d9a6a54e312e399af3f87ac67e843078360
Reviewed-on: http://gerrit.ovirt.org/8368
Reviewed-by: Dan Kenigsberg <danken at redhat.com>
Reviewed-by: Michael Burns <mburns at redhat.com>
Tested-by: Michael Burns <mburns at redhat.com>
---
M vdsm.spec.in
M vdsm/vdsm-gencerts.sh.in
M vdsm/vdsmd.init.in
3 files changed, 9 insertions(+), 3 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/15/10615/1

diff --git a/vdsm.spec.in b/vdsm.spec.in
index 5f5f989..572b338 100644
--- a/vdsm.spec.in
+++ b/vdsm.spec.in
@@ -404,9 +404,6 @@
         /etc/pki/vdsm/keys/libvirt_password
 fi
 
-# generate the vdsm certificates (if missing)
-%{_libexecdir}/%{vdsm_name}/vdsm-gencerts.sh
-
 %if 0%{?rhel}
 if [ "$1" -eq 1 ] ; then
     /sbin/chkconfig --add vdsmd
diff --git a/vdsm/vdsm-gencerts.sh.in b/vdsm/vdsm-gencerts.sh.in
index 1e11b69..3ee38c3 100755
--- a/vdsm/vdsm-gencerts.sh.in
+++ b/vdsm/vdsm-gencerts.sh.in
@@ -33,6 +33,10 @@
 
 umask 077
 
+if [ "$1" = "--check" ]; then
+    [ -s "$VDSM_KEY" -a -s "$VDSM_CA" -a -s "$VDSM_CRT" ] && exit 0 || exit 1
+fi
+
 if [ ! -f "$VDSM_KEY" ]; then
     /usr/bin/certtool --generate-privkey --outfile "$VDSM_KEY" 2> /dev/null
     /bin/chown "$VDSM_PERMS" "$VDSM_KEY"
diff --git a/vdsm/vdsmd.init.in b/vdsm/vdsmd.init.in
index dd6f3c6..a288c16 100755
--- a/vdsm/vdsmd.init.in
+++ b/vdsm/vdsmd.init.in
@@ -498,6 +498,11 @@
 
     shutdown_conflicting_srv && stop_libvirtd_sysv
 
+    if ! @LIBEXECDIR@/vdsm-gencerts.sh --check; then
+        echo -n $"Configuring a self-signed VDSM host certificate: "
+        @LIBEXECDIR@/vdsm-gencerts.sh && success || failure ; echo
+    fi
+
     reconfigure noforce
     ret_val=$?
     if [ $ret_val -ne 0 ]


--
To view, visit http://gerrit.ovirt.org/10615
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I40fa3d9a6a54e312e399af3f87ac67e843078360
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: ovirt-3.1
Gerrit-Owner: Federico Simoncelli <fsimonce at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Michael Burns <mburns at redhat.com>


More information about the vdsm-patches mailing list