Fix wrong DNS name in certificates issued to HA controllers. #7748
Conversation
Signed-off-by: José Pekkarinen <jose.pekkarinen@canonical.com>
There was a problem hiding this comment.
Do you have a specific test case (be it a feature test, or some other check) that fails without this change but succeeds with this change?
I'm not sure where the string 'local' comes from, but I believe the other strings are never "real" DNS names, but just names that get put into the certificates/advertised. (we allow juju controllers to advertise their name as simply 'juju-apiserver', since all the user-bootstrapped apiserver's won't have a valid DNS entry anyway.
I did try grepping around to see if there was some other place where we were naming something 'local', but I don't see it.
That particular line seems to go all the way back to:
https://bugs.launchpad.net/juju-core/+bug/1434680
and
https://github.com/juju/juju/pull/1906/files
Looking at that diff, it does appear that other places use the full 'localhost'
https://github.com/juju/juju/pull/1906/files#diff-45200f2105c0995c08150ba75443b6fbR108
It appears that maybe this code only triggers during 'upgrade' and not during initial bootstrap, etc?
It does look correct to me, but ideally there would be some sort of test associated with it, so we don't regress it in the future.
|
Also, I should note that we're unlikely to release another 2.1 at this stage. I think we would be likely to release a 2.2 series, so we could target the fix there. If there is a strong reason why you need the fix to be in 2.1 we can certainly discuss it, but ATM there are no plans to release a 2.1.4. |
|
The fix certainly looks like it solves a legitimate problem. Give that it's on a branch which has been superseded by a later release, I think it would be acceptable for an assurance that manual testing has been done to confirm the breakage before the fix, and correct behaviour after the fix. |
|
Related bug: https://bugs.launchpad.net/juju-core/+bug/1710886 |
|
Sorry, not doing another 2.1 release. following #7755. |
This PR fixes the DNS name issued in server certificate that prevents
a juju agent to connect properly to mongodb database when on an HA
environment.
lp:1710886
Signed-off-by: José Pekkarinen jose.pekkarinen@canonical.com