Bug 1974399 - [4.7 clone][GSS][rook] external kms CA cert secret not functional with curl's -capath as implemented today
Summary: [4.7 clone][GSS][rook] external kms CA cert secret not functional with curl's...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenShift Container Storage
Classification: Red Hat Storage
Component: rook
Version: 4.7
Hardware: All
OS: All
urgent
high
Target Milestone: ---
: OCS 4.7.2
Assignee: Sébastien Han
QA Contact: Shay Rozen
URL:
Whiteboard:
Depends On: 1970641
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-06-21 15:00 UTC by Mudit Agarwal
Modified: 2021-08-25 09:25 UTC (History)
11 users (show)

Fixed In Version: v4.7.2-429.ci
Doc Type: Bug Fix
Doc Text:
Previously, certificate validation failed as the directory that stores the certificates was not c_rehash by openssl when curl was called with --capath. The full chain of certificates had only one self-signed certificate and no client certificate or private key was provided. With this update, curl is called with --cacert, and hence the certificates are validated correctly and the encryption key can be retrieved.
Clone Of: 1970641
Environment:
Last Closed: 2021-06-30 19:22:50 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift rook pull 258 0 None open Bug 1974399: ceph: use cacert if no client cert/key are present 2021-06-21 16:17:50 UTC
Github rook rook pull 8157 0 None open ceph: use cacert if no client cert/key are present 2021-06-21 15:02:06 UTC
Red Hat Product Errata RHBA-2021:2632 0 None None None 2021-06-30 19:23:01 UTC

Comment 3 Sébastien Han 2021-06-21 16:24:59 UTC 
To verify this BZ:

1. configure cluster-wide encryption cluster with signed certificate, providing the full chain of certificates in a fullchain.pem in the VAULT_CACERT section of the UI
2. do NOT use client key or cert
3. deploy the cluster
4. verify OSDs are coming up (normal encryption verification)
Comment 7 Mudit Agarwal 2021-06-23 11:17:28 UTC 
Please add doc text
Comment 10 Sébastien Han 2021-06-28 15:59:53 UTC 
LGTM.
Comment 12 Shay Rozen 2021-06-28 23:52:23 UTC 
OSD came up with no problem. Data is encrypted. Verified on v4.7.2-429.ci
Comment 16 errata-xmlrpc 2021-06-30 19:22:50 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenShift Container Storage 4.7.2 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:2632
Note You need to log in before you can comment on or make changes to this bug.