-
Notifications
You must be signed in to change notification settings - Fork 261
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Check expiration of ovirt-provider-ovn certificate #576
Conversation
Adds expiration check of ovirt-provider-ovn certificate among regularly checked certificates such as engine CA, engine or hosts certificates. Bug-Url: https://bugzilla.redhat.com/2097560 Signed-off-by: Martin Perina <mperina@redhat.com>
...anager/modules/bll/src/main/java/org/ovirt/engine/core/bll/CertificationValidityChecker.java
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just one question other than that i t looks good.
If engine CA is going to expired, then it doesn't make sense to check other certificates, because engine CA needs to be renewed first and then all other certificates should also be renewed. Signed-off-by: Martin Perina <mperina@redhat.com>
AuditLogType.ENGINE_CERTIFICATION_HAS_EXPIRED, | ||
AuditLogType.ENGINE_CERTIFICATION_IS_ABOUT_TO_EXPIRE_ALERT, | ||
AuditLogType.ENGINE_CERTIFICATION_IS_ABOUT_TO_EXPIRE, | ||
null); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In case the Engine certificate is already expired, maybe checking the host certificates below will fail. But exceptions look handled here, so the fact that we don't return after this check anymore shouldn't cause a real problem (and it's probably more correct because now we can warn about host certificates when the Engine certificate is going to expire).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
AFAIR VDSM is not performing client certificate checks, so even if the engine certificate is expired, engine would still be able to connect to hosts. So host certificates check should fail only when host certificate expires or going to expire.
/ost |
There was added an ovirt-provider-ovn certificate validity check as a part of oVirt#576 but unfortunately the path to certificate file was wrong and as this certificate is optional (it doesn't exists on setup with OVN integration disable), the certificate validity checker didn't raise any error even for setups with OVN integration enabled and ovirt-provider-ovn certificate going to expire soon. Bug-Url: https://bugzilla.redhat.com/2097560 Signed-off-by: Martin Perina <mperina@redhat.com>
There was added an ovirt-provider-ovn certificate validity check as a part of #576 but unfortunately the path to certificate file was wrong and as this certificate is optional (it doesn't exists on setup with OVN integration disable), the certificate validity checker didn't raise any error even for setups with OVN integration enabled and ovirt-provider-ovn certificate going to expire soon. Bug-Url: https://bugzilla.redhat.com/2097560 Signed-off-by: Martin Perina <mperina@redhat.com>
There was added an ovirt-provider-ovn certificate validity check as a part of oVirt#576 but unfortunately the path to certificate file was wrong and as this certificate is optional (it doesn't exists on setup with OVN integration disable), the certificate validity checker didn't raise any error even for setups with OVN integration enabled and ovirt-provider-ovn certificate going to expire soon. Bug-Url: https://bugzilla.redhat.com/2097560 Signed-off-by: Martin Perina <mperina@redhat.com>
There was added an ovirt-provider-ovn certificate validity check as a part of #576 but unfortunately the path to certificate file was wrong and as this certificate is optional (it doesn't exists on setup with OVN integration disable), the certificate validity checker didn't raise any error even for setups with OVN integration enabled and ovirt-provider-ovn certificate going to expire soon. Bug-Url: https://bugzilla.redhat.com/2097560 Signed-off-by: Martin Perina <mperina@redhat.com>
Adds expiration check of ovirt-provider-ovn certificate among regularly
checked certificates such as engine CA, engine or hosts certificates.
Bug-Url: https://bugzilla.redhat.com/2097560
Signed-off-by: Martin Perina mperina@redhat.com