Ceph Dashboard fails if vault is using a self-signed root CA

Bug #1948809 reported by Liam Young
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ceph Dashboard Charm
Fix Released
High
Liam Young

Bug Description

If vault is configured with auto-generate-root-ca-cert=True then a chain is not passed to the dashboard which results in:

Traceback (most recent call last):
  File "./src/charm.py", line 597, in <module>
    main(CephDashboardCharm)
  File "/var/lib/juju/agents/unit-ceph-dashboard-0/charm/venv/ops/main.py", line 406, in main
    _emit_charm_event(charm, dispatcher.event_name)
  File "/var/lib/juju/agents/unit-ceph-dashboard-0/charm/venv/ops/main.py", line 140, in _emit_charm_event
    event_to_emit.emit(*args, **kwargs)
  File "/var/lib/juju/agents/unit-ceph-dashboard-0/charm/venv/ops/framework.py", line 278, in emit
    framework._emit(event)
  File "/var/lib/juju/agents/unit-ceph-dashboard-0/charm/venv/ops/framework.py", line 722, in _emit
    self._reemit(event_path)
  File "/var/lib/juju/agents/unit-ceph-dashboard-0/charm/venv/ops/framework.py", line 767, in _reemit
    custom_handler(event)
  File "/var/lib/juju/agents/unit-ceph-dashboard-0/charm/venv/interface_tls_certificates/ca_client.py", line 687, in _on_relation_changed
    self.ready_events[request_type].emit()
  File "/var/lib/juju/agents/unit-ceph-dashboard-0/charm/venv/ops/framework.py", line 278, in emit
    framework._emit(event)
  File "/var/lib/juju/agents/unit-ceph-dashboard-0/charm/venv/ops/framework.py", line 722, in _emit
    self._reemit(event_path)
  File "/var/lib/juju/agents/unit-ceph-dashboard-0/charm/venv/ops/framework.py", line 767, in _reemit
    custom_handler(event)
  File "./src/charm.py", line 427, in _configure_dashboard
    self._configure_tls()
  File "./src/charm.py", line 521, in _configure_tls
    key, cert, ca_cert = self._get_tls_from_relation()
  File "./src/charm.py", line 492, in _get_tls_from_relation
    self.ca_client.root_ca_chain.public_bytes(
  File "/var/lib/juju/agents/unit-ceph-dashboard-0/charm/venv/interface_tls_certificates/ca_client.py", line 340, in root_ca_chain
    return self._get_certificate(self._stored.root_ca_chain)
  File "/var/lib/juju/agents/unit-ceph-dashboard-0/charm/venv/interface_tls_certificates/ca_client.py", line 315, in _get_certificate
    raise CAClientError(WaitingStatus,
interface_tls_certificates.ca_client.CAClientError

Liam Young (gnuoy)
Changed in charm-ceph-dashboard:
status: New → In Progress
importance: Undecided → High
assignee: nobody → Liam Young (gnuoy)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-ceph-dashboard (master)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-ceph-dashboard (master)

Reviewed: https://review.opendev.org/c/openstack/charm-ceph-dashboard/+/815496
Committed: https://opendev.org/openstack/charm-ceph-dashboard/commit/0824bfdb5b9f315398547adfc866176d12697d4d
Submitter: "Zuul (22348)"
Branch: master

commit 0824bfdb5b9f315398547adfc866176d12697d4d
Author: Liam Young <email address hidden>
Date: Tue Oct 26 13:02:38 2021 +0000

    Fix exception when chain is missing

    Handle the situation where a chain file has not been passed along
    the certificates relation.

    Co-Authored-By: Billy Olsen <email address hidden>
    Closes-Bug: #1948809
    Change-Id: I2665ec0f7a7b2b7059899a5a937728c892593daf

Changed in charm-ceph-dashboard:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-ceph-dashboard (stable/21.10)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-ceph-dashboard (stable/21.10)

Reviewed: https://review.opendev.org/c/openstack/charm-ceph-dashboard/+/816216
Committed: https://opendev.org/openstack/charm-ceph-dashboard/commit/f258e3658b826887e4d4bfd131d029b56f95c8a3
Submitter: "Zuul (22348)"
Branch: stable/21.10

commit f258e3658b826887e4d4bfd131d029b56f95c8a3
Author: Liam Young <email address hidden>
Date: Tue Oct 26 13:02:38 2021 +0000

    Fix exception when chain is missing

    Handle the situation where a chain file has not been passed along
    the certificates relation.

    Co-Authored-By: Billy Olsen <email address hidden>
    Closes-Bug: #1948809
    Change-Id: I2665ec0f7a7b2b7059899a5a937728c892593daf
    (cherry picked from commit 0824bfdb5b9f315398547adfc866176d12697d4d)

Changed in charm-ceph-dashboard:
milestone: none → 22.04
Changed in charm-ceph-dashboard:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.