feat(rpm): replace init-pki.sh with openshell-gateway generate-certs#1258
feat(rpm): replace init-pki.sh with openshell-gateway generate-certs#1258TaylorMutch wants to merge 1 commit intomainfrom
Conversation
TaylorMutch
force-pushed
the
tmutch/rpm-certgen-cutover
branch
from
bea306f to
6c7d354
Compare
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
@TaylorMutch I very much like where this is going, thank you for working on this. Let me know when you're ready to take it out of draft and have a review done. |
Cuts the RPM gateway over to the unified Rust certgen path. The systemd
user unit's first ExecStartPre now invokes:
/usr/bin/openshell-gateway generate-certs --output-dir %S/openshell/tls
producing the same six-PEM layout init-pki.sh built (ca.{crt,key},
server/tls.{crt,key}, client/tls.{crt,key}) and the same CLI mTLS copy
under $XDG_CONFIG_HOME/openshell/gateways/openshell/mtls/. None of the
OPENSHELL_TLS_* / OPENSHELL_PODMAN_TLS_* paths in the unit change.
Adds host.containers.internal to the gateway's built-in SAN list so
podman containers reaching their host validate cleanly with no
per-deployment --server-san flag. Docker (host.docker.internal) and
Kubernetes (cluster.local DNS) were already covered.
Drops 197 lines of openssl shell, the install/file lines for the script
itself, and updates the docs (man page, RPM CONFIGURATION.md, env-file
generator comment) to point at the new entrypoint. The %S state dir,
unit security hardening, and consumer paths are untouched.
TaylorMutch
force-pushed
the
tmutch/rpm-certgen-cutover
branch
from
6c7d354 to
267fe24
Compare
TaylorMutch
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
|
Label |
1 similar comment
|
Label |
maxamillion
left a comment
maxamillion
left a comment
There was a problem hiding this comment.
+1 to this, I like this approach much better than the shell script and I think the error behavior makes more sense because it's explicit instead of the shell script quietly cleaning up when the certs are half setup
|
FYI @maxamillion, @drew and I hit some issues on this front. Will double back on this next week once we get this more well tested. Let us know if you are able to test it! |
2 participants
Summary
RPM cutover: the gateway systemd user unit's
ExecStartPrenow invokesopenshell-gateway generate-certs --output-dir %S/openshell/tlsinstead of the 197-linedeploy/rpm/init-pki.shopenssl wrapper. One PKI implementation, one file layout, real test coverage.Builds on #1257, which landed the
generate-certssubcommand and its--output-dirlocal mode.Changes
openshell.spec):ExecStartPre=/usr/bin/openshell-gateway generate-certs --output-dir %S/openshell/tls(wasinit-pki.sh %S/openshell/tls).install -pm 0755 deploy/rpm/init-pki.sh ...line and the matching%files gatewayentry.deploy/rpm/init-pki.shdeleted (-197 lines).pki.rs::DEFAULT_SERVER_SANSgainshost.containers.internalso podman parity is built-in. Docker (host.docker.internal) and Kubernetes (cluster.local DNS) were already covered. The RPM systemd unit needs no extra--server-sanflag; k8s Helm chart also picks it up automatically.deploy/man/openshell-gateway.8.md), RPMCONFIGURATION.md, and the comment ininit-gateway-env.shall point at the new entrypoint.The output paths, file modes, and CLI auto-discovery copy are byte-for-byte identical to what
init-pki.shproduced — everyOPENSHELL_TLS_*/OPENSHELL_PODMAN_TLS_*path in the unit stays valid without edits.Testing
Local binary smoke
$ openshell-gateway generate-certs --output-dir /tmp/test/state/openshell/tls INFO openshell_server::certgen: PKI files created. dir=/tmp/test/state/openshell/tls $ ls -la /tmp/test/state/openshell/tls/{ca.crt,ca.key,server,client}/... -rw-r--r-- ca.crt -rw------- ca.key -rw-r--r-- server/tls.crt -rw------- server/tls.key -rw-r--r-- client/tls.crt -rw------- client/tls.key $ openssl x509 -in tls/server/tls.crt -noout -ext subjectAltName DNS:openshell, DNS:openshell.openshell.svc, DNS:openshell.openshell.svc.cluster.local, DNS:localhost, DNS:host.docker.internal, DNS:host.containers.internal, IP Address:127.0.0.1 $ openshell-gateway generate-certs --output-dir /tmp/test/state/openshell/tls INFO openshell_server::certgen: PKI files already exist, skipping.Helm cluster regression check
Deleted both Secrets, redeployed via Skaffold, confirmed:
kubernetes.io/tlsSecrets created with 3 keys each, chain verifies viaopenssl verify.host.containers.internalalongside the existing 6 — no duplicates.Pre-commit
mise run pre-commitpasses (clippy-D warnings, fmt, markdownlint, tests).pki.rs::tests::build_server_sans_includes_defaults_and_extrascontinues to pass — usesDEFAULT_SERVER_SANS.len(), auto-adapts.What this PR does not test locally
ExecStartPreexecution on a real Fedora host. Plan: install the COPR-built RPM in a Fedora VM (orpodman run --systemd=always fedora) and runsystemctl --user enable --now openshell-gateway.service, then verify the 6 PEMs land under~/.local/state/openshell/tls/.Checklist
architecture/gateway.mdalready describes both modes from feat(server): add generate-certs subcommand; replace alpine PKI hook #1257)CONFIGURATION.mdupdated