Skip to content

Restore "copy build certificates to /etc/docker/certs.d" #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bparees merged 1 commit into from
Dec 14, 2018
Merged

Restore "copy build certificates to /etc/docker/certs.d" #31

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 40 additions & 9 deletions cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package main
import (
"fmt"
"io"
"io/ioutil"
"math/rand"
"os"
"path/filepath"
Expand Down Expand Up @@ -35,10 +36,11 @@ func main() {
}

const tlsCertRoot = "/etc/pki/tls/certs"
const runtimeCertRoot = "/etc/docker/certs.d"

clusterCASrc := fmt.Sprintf("%s/ca.crt", builder.SecretCertsMountPath)
clusterCADst := fmt.Sprintf("%s/cluster.crt", tlsCertRoot)
err := CopyIfExists(clusterCASrc, clusterCADst)
err := CopyFileIfExists(clusterCASrc, clusterCADst)
Copy link
Contributor

@bparees bparees Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looking at a cluster today, this location exists:

ls -l /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
lrwxrwxrwx. 1 root root 13 Dec 12 20:58 /var/run/secrets/kubernetes.io/serviceaccount/ca.crt -> ..data/ca.crt

Copy link
Contributor

@bparees bparees Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

perhaps that is not the service-ca though? i'm not sure what it is....

Copy link
Contributor

@bparees bparees Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess we want this for cases where the registry is signed by the cluster ca, which was the case in 3.11.

if err != nil {
fmt.Printf("Error setting up cluster CA cert: %v", err)
os.Exit(1)
Expand All @@ -47,25 +49,26 @@ func main() {
// TODO: Remove this once the config-map based mount approach lands after rebase
oldServiceCASrc := fmt.Sprintf("%s/service-ca.crt", builder.SecretCertsMountPath)
oldServiceCADst := fmt.Sprintf("%s/service.crt", tlsCertRoot)
err = CopyIfExists(oldServiceCASrc, oldServiceCADst)
err = CopyFileIfExists(oldServiceCASrc, oldServiceCADst)
Copy link
Contributor

@bparees bparees Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this location does not exist:
ls -l /var/run/secrets/kubernetes.io/serviceaccount
total 0
lrwxrwxrwx. 1 root root 13 Dec 12 20:58 ca.crt -> ..data/ca.crt
lrwxrwxrwx. 1 root root 16 Dec 12 20:58 namespace -> ..data/namespace
lrwxrwxrwx. 1 root root 12 Dec 12 20:58 token -> ..data/token

Copy link
Contributor

@bparees bparees Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so this no longer serves any purpose except confusion i guess.

Copy link
Contributor

@bparees bparees Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(and i guess gets used on ansible installs?)

if err != nil {
fmt.Printf("Error setting up service CA cert: %v", err)
os.Exit(1)
}

// TODO: Remove this once the build controller mounts the internal registry's CA
// in certs.d/<internal-registry-hostname>/
newServiceCASrc := fmt.Sprintf("%s/service-ca.crt", builder.ConfigMapCertsMountPath)
newServiceCADst := fmt.Sprintf("%s/openshift-service.crt", tlsCertRoot)
err = CopyIfExists(newServiceCASrc, newServiceCADst)
err = CopyFileIfExists(newServiceCASrc, newServiceCADst)
Copy link
Contributor

@bparees bparees Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

and this, presumably, "might" exist depending on the raciness of the creation/population of the configmap that was created by the build controller.

Copy link
Contributor

@bparees bparees Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

and this is only working for us because the configmap is getting populated fast enough

if err != nil {
fmt.Printf("Error setting up service CA cert: %v", err)
os.Exit(1)
}

additionalCASrc := fmt.Sprintf("%s/additional-ca.crt", builder.ConfigMapCertsMountPath)
additionalCADst := fmt.Sprintf("%s/additional-ca.crt", tlsCertRoot)
err = CopyIfExists(additionalCASrc, additionalCADst)
runtimeCASrc := fmt.Sprintf("%s/certs.d", builder.ConfigMapCertsMountPath)
err = CopyDirIfExists(runtimeCASrc, runtimeCertRoot)
Copy link
Contributor

@bparees bparees Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

similarly "might" exist depending on raciness and the level of code in the origin build controller that dictates where this gets mounted i guess.

if err != nil {
fmt.Printf("Error setting up additional trusted CA bundle: %v", err)
fmt.Printf("Error setting up service CA cert: %v", err)
os.Exit(1)
}

Expand All @@ -76,9 +79,37 @@ func main() {
}
}

// CopyIfExists copies the source file to the given destination, if the source file exists.
// CopyDirIfExists recursively copies a directory to the destination path.
// If the source directory does not exist, no error is returned.
// If the destination directory exists, any contents with matching file names
// will be overwritten.
func CopyDirIfExists(src, dst string) error {
srcInfo, err := os.Stat(src)
if os.IsNotExist(err) {
return nil
}
if err = os.MkdirAll(dst, srcInfo.Mode()); err != nil {
return err
}
dirInfo, err := ioutil.ReadDir(src)
for _, info := range dirInfo {
srcPath := filepath.Join(src, info.Name())
dstPath := filepath.Join(dst, info.Name())
if info.IsDir() {
err = CopyDirIfExists(srcPath, dstPath)
} else {
err = CopyFileIfExists(srcPath, dstPath)
}
if err != nil {
return err
}
}
return nil
}

// CopyFileIfExists copies the source file to the given destination, if the source file exists.
// If the destination file exists, it will be overwritten and will not copy file attributes.
func CopyIfExists(src, dst string) error {
func CopyFileIfExists(src, dst string) error {
_, err := os.Stat(src)
if os.IsNotExist(err) {
return nil
Expand Down