Refs #28924: Drop amqp key and truststore + generate Artemis client certs #275

ehelms · 2020-03-06T01:40:26Z

No description provided.

manifests/candlepin.pp

ekohl · 2020-03-09T14:50:12Z

manifests/candlepin.pp

@@ -121,31 +118,15 @@
      key_file  => $client_key,
      cert_file => $client_cert,
    } ~>
-    file { $amqp_store_dir:


I think we should ensure it's absent to clean up after ourselves, but I don't recall if we can ensure directories are absent in Puppet.

I wondered about that. Should the puppet module clean this up or installer post install task clean this up?

Normally I'd say Puppet but if Puppet can't clean up directories with the file type then I'm ok with a post install task rather than an exec here.

From my googling you can do a regular file set to absent with recursive set to true. This just doesn't feel as clean. That weird line where sometimes we cleanup in the puppet module and sometimes we use the puppet module to simply represent the state and the installer does cleanup. I thought we were universally doing the latter. Its hard to know which way to go.

spec/acceptance/candlepin_spec.rb

jturel · 2020-03-09T18:20:35Z

Seeing this:

[ WARN 2020-03-09T18:11:46 verbose]  Unknown variable: 'artemis_keystore'. (file: /usr/share/foreman-installer/modules/certs/manifests/candlepin.
pp, line: 128, column: 200)

So the subsequent keytool command fails since -destkeystore is missing

jturel · 2020-03-17T14:11:10Z

@ehelms just pinging to ensure you saw my last update 🏓

spec/acceptance/candlepin_spec.rb

manifests/candlepin.pp

spec/acceptance/candlepin_spec.rb

ekohl

ACK, leaving it open so it can be merged together with the candlepin change.

jturel · 2020-04-13T14:36:56Z

I did some testing and was able to connect with SSL client auth from Katello to Artemis.

I basically followed the steps here, extracted the client cert+key from the stores, and used them to connect. Seems like we should be able to approximate that here, and let me know if I can provide any more detail.

ehelms · 2020-04-13T19:41:14Z

@jturel Apologies, I'm not following what the action item is regarding server and client keystores.

jturel · 2020-04-13T19:55:40Z

@jturel Apologies, I'm not following what the action item is regarding server and client keystores.

I need my own clarification then :)

The artemis_client entry you've added to the keystore: what is the purpose of that? Is it for Katello to use? If so, I suppose we'll need puppet-katello to extract the cert and key in PEM format in order to connect to the broker.

Or is it for Candlepin to use? If so, Candlepin is connecting directly to the embedded artemis without SSL since it's running within the same JVM which means it's not necessary, unless you're thinking forward to candlepin connecting to an external Artemis

ehelms · 2020-04-13T23:34:48Z

Ahh yes. This client certificate is being added to the keystore/truststore so that it can be used by Katello. The client certificate is already deployed to the system in a place that Katello can consume it. This change is just ensuring its in the truststore. We abuse keystore/truststore by creating one and using it for both.

/etc/pki/katello/certs/java-client.crt
/etc/pki/katello/private/java-client.key

jturel · 2020-04-15T13:49:15Z

manifests/candlepin.pp

@@ -31,6 +28,8 @@
  }

  $java_client_cert_name = 'java-client'
+  $artemis_alias = 'artemis-client'
+  $artemis_client_dn = "C=${city}, ST=${state}, O=candlepin, OU=${org_unit}, CN=${cname}"


I think the CN should be $hostname rather than $cname

To be safe, I think this is correct. See https://github.com/theforeman/puppet-certs/pull/275/files#diff-0a129cc5a540f220caade2da4fc3229bR37

Hmm, well here's the contents of the file:

katelloUser=C=Raleigh, ST=North Carolina, O=candlepin, OU=SomeOrgUnit, CN=[]

Hard to discern what you wanted me to see at that URL..

Ohh, yea, I see now how this gets handled.

Updated to hostname, I forget cname is additional cnames to add.

In SSL you have Common Name (cn) and subject Alternative Name (subjectAltName). cname is DNS terminology.

jturel · 2020-04-16T13:37:52Z

manifests/candlepin.pp

@@ -31,6 +28,8 @@
  }

  $java_client_cert_name = 'java-client'
+  $artemis_alias = 'artemis-client'
+  $artemis_client_dn = "C=${city}, ST=${state}, O=candlepin, OU=${org_unit}, CN=${hostname}"


It actually seems like the order of these matters.... (most specific -> least specific?)

Should be like this: CN=localhost, OU=SomeOrgUnit, O=candlepin, ST=North Carolina, C=US

Note also that C is country, not city

Ahh yea, sorry you are right on the country.

I modeled this off of "C=US, ST=North Carolina, O=candlepin, OU=SomeOrgUnit, CN=dhcp-8-29-228.lab.eng.rdu2.redhat.com"

openssl x509 -noout -text -in /etc/pki/katello/certs/java-client.crt

All good. When I re-order them in login.config it prevents Katello from connecting with an auth failure 🤷

jturel

ACK. works in prod and dev.

theforeman-bot added Needs testing Not yet reviewed labels Mar 6, 2020

ekohl reviewed Mar 6, 2020

View reviewed changes

manifests/candlepin.pp Outdated Show resolved Hide resolved

ekohl reviewed Mar 9, 2020

View reviewed changes

ehelms force-pushed the refs-28924 branch 2 times, most recently from fdf0018 to 64867f1 Compare March 26, 2020 14:31

ekohl reviewed Mar 26, 2020

View reviewed changes

spec/acceptance/candlepin_spec.rb Outdated Show resolved Hide resolved

ekohl reviewed Mar 26, 2020

View reviewed changes

manifests/candlepin.pp Outdated Show resolved Hide resolved

ehelms force-pushed the refs-28924 branch from 64867f1 to 0881322 Compare March 26, 2020 18:08

ekohl reviewed Mar 26, 2020

View reviewed changes

spec/acceptance/candlepin_spec.rb Show resolved Hide resolved

ehelms force-pushed the refs-28924 branch from 0881322 to 5fc9fd7 Compare March 26, 2020 18:32

ekohl reviewed Mar 26, 2020

View reviewed changes

spec/acceptance/candlepin_spec.rb Outdated Show resolved Hide resolved

ehelms force-pushed the refs-28924 branch 2 times, most recently from 12f26a8 to b598214 Compare March 31, 2020 21:39

ekohl approved these changes Apr 1, 2020

View reviewed changes

theforeman-bot removed the Not yet reviewed label Apr 1, 2020

zjhuntin added the Waiting on contributor label Apr 9, 2020

ehelms force-pushed the refs-28924 branch from b598214 to 654a530 Compare April 15, 2020 12:17

theforeman-bot added Needs re-review and removed Waiting on contributor labels Apr 15, 2020

jturel reviewed Apr 15, 2020

View reviewed changes

ehelms force-pushed the refs-28924 branch 2 times, most recently from 7d3e549 to 2ef13b0 Compare April 15, 2020 19:04

jturel reviewed Apr 16, 2020

View reviewed changes

Refs #28924: Drop amqp key and truststore

c0c4780

ehelms force-pushed the refs-28924 branch from 2ef13b0 to c0c4780 Compare April 16, 2020 14:07

jturel approved these changes Apr 17, 2020

View reviewed changes

theforeman-bot removed the Needs re-review label Apr 17, 2020

ehelms merged commit cbc1fac into theforeman:master Apr 20, 2020

ekohl changed the title ~~Refs #28924: Drop amqp key and truststore~~ Refs #28924: Drop amqp key and truststore + generate Artemis client certs Apr 27, 2020

ekohl added the Backwards incompatible label Apr 27, 2020

wbclark removed the Needs testing label May 12, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refs #28924: Drop amqp key and truststore + generate Artemis client certs #275

Refs #28924: Drop amqp key and truststore + generate Artemis client certs #275

ehelms commented Mar 6, 2020

ekohl Mar 9, 2020

ehelms Mar 26, 2020

ekohl Mar 26, 2020

ehelms Mar 26, 2020

jturel commented Mar 9, 2020

jturel commented Mar 17, 2020

ekohl left a comment

jturel commented Apr 13, 2020

ehelms commented Apr 13, 2020

jturel commented Apr 13, 2020

ehelms commented Apr 13, 2020

jturel Apr 15, 2020

ehelms Apr 15, 2020

jturel Apr 15, 2020

ehelms Apr 15, 2020

ehelms Apr 15, 2020

ekohl Apr 15, 2020

jturel Apr 16, 2020

ehelms Apr 16, 2020

jturel Apr 16, 2020

jturel left a comment

Refs #28924: Drop amqp key and truststore + generate Artemis client certs #275

Refs #28924: Drop amqp key and truststore + generate Artemis client certs #275

Conversation

ehelms commented Mar 6, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jturel commented Mar 9, 2020

jturel commented Mar 17, 2020

ekohl left a comment

Choose a reason for hiding this comment

jturel commented Apr 13, 2020

ehelms commented Apr 13, 2020

jturel commented Apr 13, 2020

ehelms commented Apr 13, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jturel left a comment

Choose a reason for hiding this comment