Register OSG APs (SOFTWARE-4791)

[brianhlin]

Hosts/DNs/contacts mostly grabbed from https://github.com/opensciencegrid/osg-flock/blob/master/flock.opensciencegrid.org/flocking-hosts.yml#L7-L17

@rynge I threw the few that had dev or test in their names into ITB groups

[matyasselmeci]

This is a lot for one person to review. @edquist can we split this up? You take "topology/American Museum of Natural History through "topology/University of California San Diego" and I take "topology/University of Chicago" through "topology/University of Wisconsin Milwaukee" ?

[edquist]

I did look (gloss) this over, but @brianhlin, how would you like us to review this? Do you want us to verify everything added here against the flocking-hosts.yml you mentioned from the osg-flock repo?

[brianhlin]

Do you want us to verify everything added here against the flocking-hosts.yml you mentioned from the osg-flock repo?

Yeah, that seems like the most reasonable way to do it. I had to make a bunch of educated guesses on new sites/resource groups so if anything looks offensive there, that'd be worth bringing up, too.

[matyasselmeci]

The half I checked looks good.

[matyasselmeci]

I realize this ID is not part of the change, but 1134 is already used by a Lamar-Cluster resource.

[brianhlin]

It's concerning that our CI doesn't catch this :(

[matyasselmeci]

We test for name uniqueness and ID presence, but not ID uniqueness. I wonder why...

[edquist]

Oh huh. Yeah i suppose we should add a unique ID check for the different types of things, ey?

[edquist]

Relatedly, @brianhlin & @matyasselmeci, would it make sense to add a check to verify that if a resource has a DN, the /CN part should match the FQDN ?

[brianhlin]

I don't think we can assume that: the registered FQDN may correspond to one of the cert's SANs.

[edquist]

Ah ok.

Also:

It's concerning that our CI doesn't catch this :(

We test for name uniqueness and ID presence, but not ID uniqueness. I wonder why...

Apparently there is a ticket for this - SOFTWARE-3287 specifies a few new unique ID requirements

[matyasselmeci]

I realized that the split was unfair so I checked Purdue through UCSD as well. Aside from my comments, they looked good.

[edquist]

See comments.

Also, i am just reviewing you changes. I have not tried to do any deep analysis of flocking-hosts to try to see if you are missing any resources.

[edquist]

No further objections for my half

[brianhlin]

Rebased off master and force-pushed