Add ssl support for keystone token generation

Bug #1939354 reported by Joshua Genet
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Kubernetes Control Plane Charm
Triaged
Medium
Unassigned

Bug Description

When kubernetes-master:keystone-credentials is related to openstack-integrator:credentials, a kube-keystone.sh is generated. That is used to grab a keystone token. Right now the curl in that script does not support ssl (passing in a cert).

It seems like we want to check if OS_CACERT is set (in the novarc) and if so, pass it to the curl.

---

I can add support for it manually by:

* Changing the curl in the kube-keystone.sh file to something like this:
token=$(curl --cacert /home/ubuntu/root.pem -s -i -H "Content-Type: application/json" -d "${data}" "${OS_AUTH_URL}/auth/tokens" |grep 'X-Subject-Token')

* scp root.pem to kubernetes-master host

* export the openstack variables

* then run the script

---

(I'm not sure if this bug falls under kubernetes-master or openstack-integrator so feel free to move)

Revision history for this message
Kevin W Monroe (kwmonroe) wrote :

Afaict, this would only affect users that want to generate an out-of-band token for authenticating with things like the k8s dashboard.

Normal cluster operations (workers registering with the control plane, kubeconfig files including proper keystone creds, etc) should work correctly today.

Targeting this for CK 1.23.

Changed in charm-kubernetes-master:
importance: Undecided → Medium
milestone: none → 1.23
status: New → Triaged
Revision history for this message
Joshua Genet (genet022) wrote :

I reread this comment today. And yes, you are correct!

I run into this when we run `test_keystone` in the validation suite against our SSL enabled Openstack.

Changed in charm-kubernetes-master:
milestone: 1.23 → 1.24
Changed in charm-kubernetes-master:
milestone: 1.24 → none
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.