Check for correct TLS certs pair

[navidshaikh]

User story:
I am an ADB user, I vagrant up my box and using vagrant-service-manager plugin I copied the client side certs in my host directory. I vagrant destroy after completing my work (the copied over certs stays un-touched). The next day I vagrant up again (which will re-generate the certs inside the box), I try to copy the certs using vagrant-service-manager, however the certs will not be copied over since yesterday's certs are already there, and plugin will not copy, but just show the configuration info.

Problem:
Now there are incorrect client side certs on host.

Solution:
plugin should ensure that the client side certs are correct and are part of the pair from the server side certs.

How does this work today:
rm -rf .vagrant/machines/default/virtualbox/docker manually before copying the certs using plugin to ensure I have correct client side certs.

[brgnepal]

Can we do like this?
If there is folder .vagrant/machines/default/virtualbox/docker exists then remove it and then perform normal operation.

[LalatenduMohanty]

It should be done again through Vagrant destroy using hook. Vagrant destroy should delete the certs IMO.

[brgnepal]

+1 for vagrant destroy approach.

[navidshaikh]

The certs pair in guest and host be invalid if we docker daemon is restarted, IMO the check should compare the client side certs in the guest with certs on host to decide if copy is needed.

[mmalina]

Hi, from the issue description it seems that this is reproducible only if you use vagrant destroy and then vagrant up. But for me this happens even if I just use vagrant halt and then vagrant up.
Maybe that's what @navidshaikh says in his last comment - that merely restarting docker daemon will do this.
This is what reproduces the problem for me:
vagrant destroy #to make sure you start from scratch
vagrant up
eval "$(vagrant service-manager env docker)"
docker ps #works fine
vagrant halt
vagrant up
eval "$(vagrant service-manager env docker)"
docker ps #FAIL
An error occurred trying to connect: Get https://10.1.2.2:2376/v1.20/containers/json: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "example.com")

I'm using rhel-cdk-kubernetes-7.2-21.x86_64.vagrant-virtualbox.box and the latest cdk build (I believe it's Beta5) with service manager 0.0.4

[brgnepal]

@mmalina This fix is not released yet. Could you download this gem which contains this fix and check again?
Please note that I have changed the version to 0.0.4.1 for show the changes.

[mmalina]

@budhrg thanks. I tried again with the 0.0.4.1 gem and now it works correctly for my use case!
This is what I did:
11701 vagrant halt
11702 vagrant up
11703 eval "$(vagrant service-manager env docker)"
11704 docker ps #this still failed for me
11705 vagrant halt
11706 vagrant plugin install ~/Downloads/vagrant-service-manager-0.0.4.1.gem
11707 vagrant up
11708 eval "$(vagrant service-manager env docker)"
11709 docker ps #now it worked fine

[brgnepal]

@mmalina Thanks for verifying it. 👍