Added upgrade script to fix missing cert/request data #539
Conversation
An upgrade script has been added to fix the missing sslserver and subsystem cert/request data by copying it from another subsystem. https://bugzilla.redhat.com/show_bug.cgi?id=1869893
| def find_source_subsystem(self, subsystems): | ||
|
|
||
| # check each subsystem | ||
| for subsystem in subsystems: |
There was a problem hiding this comment.
Instead of trying to loop through all subsystems, can we just replace it with CA? I believe CA for sure contains the value of these
Example:
ca_subsystem = instance.get_subsystem(ca)
ca_subsystem.config.get('ca.sslserver.cert')
...
There was a problem hiding this comment.
There's actually no guarantee that all PKI servers will have a CA subsystem, and even if it does, there's no guarantee if the CA will have all the cert info. This loop is trying to find the first other subsystem that has all the info, so most likely it will stop after the first or second iteration. It's based on the existing code:
https://github.com/dogtagpki/pki/blob/master/base/server/python/pki/server/deployment/pkihelper.py#L2934-L2942
A better solution would be to remove these params from CS.cfg so we don't need to maintain them anymore, but that can be done separately later.
There was a problem hiding this comment.
AH! ok. Now i understand; CA and KRA can be installed on 2 different machines but be in the same Security Domain.
Hmmm. Now, that raises me another question: Let's say machine A has CA and machine B has KRA. Now, if the upgrade script is running in machine B, where will it read these values from?
There was a problem hiding this comment.
This particular regression presumably only happened to the subsystems added to the same instance after the first one, so that situation should not happen, or is outside the scope of this upgrade script. As mentioned above, a better solution is to remove it completely from CS.cfg.
|
Thanks! Merging. |
An upgrade script has been added to fix the missing sslserver
and subsystem cert/request data by copying it from another
subsystem.
https://bugzilla.redhat.com/show_bug.cgi?id=1869893