docker_common TLS and TLS_Verify not mutually exclusive.

[chouseknecht]

ISSUE TYPE

• Bug Report

ANSIBLE VERSION

ansible 2.1.0 (docker_common 8b50e93151) last updated 2016/04/25 15:04:12 (GMT -400)
  lib/ansible/modules/core: (devel 804a8e6378) last updated 2016/04/21 18:24:50 (GMT -400)
  lib/ansible/modules/extras: (devel 3031105e78) last updated 2016/04/21 18:24:27 (GMT -400)
  config file =
  configured module search path = Default w/o overrides

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

This is actually wrong in docker_common:

DOCKER_MUTUALLY_EXCLUSIVE = [
    ['tls', 'tls_verify']
]

TLS and TLS_VERIFY are not mutually exclusive. One could set TLS and TLS_VERIFY to True, which would mean connect using TLS and verify the server using the default/public CA pool.

Need to review _get_connect_params() method again and make sure we're covering all the connection use cases.

[ssbarnea]

I think that this bug is still valid and there is a very easy way to verify it: testing docker cli behavior.

# success:
DOCKER_TLS=1 DOCKER_TLS_VERIFY=0 docker ps
# failure with 'parameters are mutually exclusive: tls, tls_verify'
DOCKER_TLS=1 DOCKER_TLS_VERIFY=0 ansible -m docker ....

There is no such thing as mutually exclusive on docker and for good reasons: one may have to use TLS on port 2376 but the SSL vertificates may be temporary broken like expired or not matching hostnames.

This is someting that can happen in real life, even production and thus is why the DOCKER_TLS_VERIFY option was added in the first place, to allow bypassing verification. Making it mutually exclusive makes no sense and breaks it because without telling docker to use TLS via DOCKER_TLS=1, it will fail to run.

[felixfontein]

This bug is invalid and was closed rightly; I've explained why here.