Generate TLS certs during provisioning

[navidshaikh]

From @bexelbie on November 22, 2015 12:37

Plugin should run automatically when the ADB is started like https://github.com/projectatomic/adb-vagrant-registration/tree/master/lib/vagrant-registration

@strzibny can you provide any guidance?

Copied from original issue: projectatomic/vagrant-adbinfo#34

[navidshaikh]

From @bexelbie on November 22, 2015 21:12

@LalatenduMohanty how does the prompting for registration for the RHEL CDK work? could we adapt that?

[navidshaikh]

From @strzibny on November 23, 2015 10:27

@bexelbie What would be the use case? You want automatic way of exposing the env variables or? Something I suggested here projectatomic/vagrant-adbinfo#13 but as part of vagrant up process or?

Of course technically speaking I can help.

[navidshaikh]

From @LalatenduMohanty on November 23, 2015 10:37

@bexelbie RHEL CDK expect the user to install the plugin. I does not happen automatically. I think we need to sync with the team which is working on a installer for CDK.

[navidshaikh]

From @bexelbie on November 23, 2015 11:20

@strzibny @strizbny I'd like to see vagrant adbinfo run automatically after vagrant up. It seems that vagrant register is called automatically as part of vagrant up, somehow.

Re #13 can you provide some advice in the best way to export those variables automatically from Python? My foo there is not as strong as it should be or I need more coffee and sleep.

[navidshaikh]

From @bexelbie on November 23, 2015 11:20

@LalatenduMohanty @LalatenduMohanty I meant auto-run after vagrant up, not auto-install.

[navidshaikh]

From @LalatenduMohanty on November 23, 2015 11:27

@bexelbie ah, I missed that. Yes, if you have vagrant-registration installed and it is a RHEL guest , its asks for username and password for registration every time you do a "vagrant up" .

I think its good idea to put auto detection (guest capability) code in the plugin.
e.g https://github.com/projectatomic/adb-vagrant-registration/blob/master/plugins/guests/redhat/plugin.rb

[navidshaikh]

From @bexelbie on November 23, 2015 12:15

@LalatenduMohanty yes, I think having something we can use to detect an ADB would be a huge help. Can you walk me through the methodology?

[navidshaikh]

From @strzibny on November 23, 2015 12:45

@bexelbie so instead of the necessity of running the vargant adbinfo command the instructions will get printed after vagrant up (printed or sourced?)? Is that what you are after?

[navidshaikh]

@strzibny : There are two actions which are performed on the execution of plugin

1. Re-generation of the TLS certs for docker daemon
2. Printing the information

We wanted to 1 to happen when the box is up (provisioning step), while the printing of docker daemon information can happen while user execute the plugin.

[navidshaikh]

We are now re-generating the certs as part of the vagrant up. Closing the issue.

[hferentschik]

We are now re-generating the certs as part of the vagrant up. Closing the issue.

Can you clarify this? On each 'vagrant up' or just on the first (aka during provisioning). Also you are saying that you are generating the certs on 'vagrant up', do you also copy them to the host at this stage? Basically 'vagrant service-manager env docker' is in this case just dumping some known "settings". Nothing gets generated or copied at this stage, right?

[bexelbie]

@hferentschik during vagrant up, after the nics are configured, the docker certs are regenerated with the proper IP addresses. Nothing is copied to the host at that time. The copy occurs during the first vagrant service-manager env docker

[hferentschik]

@bexelbie Thanks for the info. As I mentioned on another issue, the user experience is already much better now when calling env docker. Much faster. Personally, I'd still would copy the certs directly when they are generated. I don't think it hurts in any ways.

Here are some more thoughts around this. ATM the following variables are set DOCKER_HOST DOCKER_CERT_PATH, DOCKER_TLS_VERIFY and DOCKER_MACHINE_NAME. The first three are necessary to make things work. I am not so sure about the last one. What's the purpose of DOCKER_MACHINE_NAME. I can unset it and it all still perfectly works. I understand that this is the Vagrant machine name of the instance, but it is afaiu not needed for the host to VM Docker communication. Taking this a step further, if one would remove DOCKER_MACHINE_NAME from the output the generated values for the Docker variables are pretty much static (unless one changes the IP). So a user could just define them for example in bashrc or similar and could always use Docker against the running CDK. Provided that is, that the certificates get copied when they are generated. Otherwise the user needs to call env docker after a destroy, just to copy the certificates which is confusing.

[hferentschik]

Created this issue as a follow up - #121

[hferentschik]

See also #120

[hferentschik]

See issue #122