Bug 1974399

Summary:	[4.7 clone][GSS][rook] external kms CA cert secret not functional with curl's -capath as implemented today
Product:	[Red Hat Storage] Red Hat OpenShift Container Storage	Reporter:	Mudit Agarwal <muagarwa>
Component:	rook	Assignee:	Sébastien Han <shan>
Status:	CLOSED ERRATA	QA Contact:	Shay Rozen <srozen>
Severity:	high	Docs Contact:
Priority:	urgent
Version:	4.7	CC:	agantony, akrai, bkunal, madam, mhackett, muagarwa, nberry, ocs-bugs, r.martinez, shan, tnielsen
Target Milestone:	---	Keywords:	AutomationBackLog, ZStream
Target Release:	OCS 4.7.2
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:	v4.7.2-429.ci	Doc Type:	Bug Fix
Doc Text:	Previously, certificate validation failed as the directory that stores the certificates was not c_rehash by openssl when curl was called with --capath. The full chain of certificates had only one self-signed certificate and no client certificate or private key was provided. With this update, curl is called with --cacert, and hence the certificates are validated correctly and the encryption key can be retrieved.	Story Points:	---
Clone Of:	1970641	Environment:
Last Closed:	2021-06-30 19:22:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1970641
Bug Blocks:

Comment 3 Sébastien Han 2021-06-21 16:24:59 UTC

To verify this BZ:

1. configure cluster-wide encryption cluster with signed certificate, providing the full chain of certificates in a fullchain.pem in the VAULT_CACERT section of the UI
2. do NOT use client key or cert
3. deploy the cluster
4. verify OSDs are coming up (normal encryption verification)

Comment 7 Mudit Agarwal 2021-06-23 11:17:28 UTC

Please add doc text

Comment 10 Sébastien Han 2021-06-28 15:59:53 UTC

LGTM.

Comment 12 Shay Rozen 2021-06-28 23:52:23 UTC

OSD came up with no problem. Data is encrypted. Verified on v4.7.2-429.ci

Comment 16 errata-xmlrpc 2021-06-30 19:22:50 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenShift Container Storage 4.7.2 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:2632