From e65fc34af694041e7f5e5a06fd50c026b2c9509b Mon Sep 17 00:00:00 2001 From: Paul Belanger Date: Tue, 17 Oct 2017 10:59:20 -0400 Subject: [PATCH] Add /etc/ssl/certs to trusted_ro_paths for zuul-executors If we download things over HTTPs inside bwrap, we'll need access to /etc/ssl/certs to validate certs. Change-Id: Ib662afbc0e3375a2d461ef7fc6e7e4f8741a700c Signed-off-by: Paul Belanger --- manifests/site.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifests/site.pp b/manifests/site.pp index 7abc361219..e9b3703f1c 100644 --- a/manifests/site.pp +++ b/manifests/site.pp @@ -1196,7 +1196,7 @@ node /^ze\d+\.openstack\.org$/ { gearman_ssl_ca => hiera('gearman_ssl_ca'), #TODO(pabelanger): Add openafs role for zuul-jobs to setup /etc/openafs # properly. We need to revisting this post Queens PTG. - trusted_ro_paths => ['/etc/openafs', '/var/lib/zuul/ssh'], + trusted_ro_paths => ['/etc/openafs', '/etc/ssl/certs', '/var/lib/zuul/ssh'], trusted_rw_paths => ['/afs'], disk_limit_per_job => 5000, # Megabytes site_variables_yaml_file => $::project_config::zuul_site_variables_yaml,