Skip to content

CA Cert Fix for Mariner Hosts in Air Gap #751

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gracewehner merged 4 commits into from
May 9, 2022
Merged

CA Cert Fix for Mariner Hosts in Air Gap #751

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5756e5b
script changes
gracewehner Apr 28, 2022
661d875
PR feedback
gracewehner Apr 29, 2022
59210a7
sla recheck
gracewehner May 9, 2022
a2b3246
Merge branch 'ci_dev' into grace/ca-certs-airgap
gracewehner May 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions kubernetes/linux/main.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -288,6 +288,30 @@ fi
export CLOUD_ENVIRONMENT=$CLOUD_ENVIRONMENT
echo "export CLOUD_ENVIRONMENT=$CLOUD_ENVIRONMENT" >> ~/.bashrc

# Copying over CA certs for airgapped clouds. This is needed for Mariner vs Ubuntu hosts.
# We are unable to tell if the host is Mariner or Ubuntu,
# so both /anchors/ubuntu and /anchors/mariner are mounted in the yaml.
# One will have the certs and the other will be empty.
# These need to be copied to a different location for Mariner vs Ubuntu containers.
# OS_ID here is the container distro.
# Adding Mariner now even though the elif will never currently evaluate.
if [ $CLOUD_ENVIRONMENT == "usnat" ] || [ $CLOUD_ENVIRONMENT == "ussec" ]; then
OS_ID=$(cat /etc/os-release | grep ^ID= | cut -d '=' -f2 | tr -d '"' | tr -d "'")
if [ $OS_ID == "mariner" ]; then
cp /anchors/ubuntu/* /etc/pki/ca-trust/source/anchors
cp /anchors/mariner/* /etc/pki/ca-trust/source/anchors
update-ca-trust
else
if [ $OS_ID != "ubuntu" ]; then
echo "Error: The ID in /etc/os-release is not ubuntu or mariner. Defaulting to ubuntu."
fi
cp /anchors/ubuntu/* /usr/local/share/ca-certificates/
cp /anchors/mariner/* /usr/local/share/ca-certificates/
update-ca-certificates
cp /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem
fi
fi

#consisten naming conventions with the windows
export DOMAIN=$domain
echo "export DOMAIN=$DOMAIN" >> ~/.bashrc
Expand Down