043ad08237
Currently there is no way to provide SSL configuration for Trove, so it fails e.g. when uploading backups to a secured Swift endpoint. This patch sets an environment variable (REQUESTS_CA_BUNDLE [1]) understood by Requests library for Python, so all HTTPS calls done by trove-guest service will trust the provided CAs. For Ubuntu Xenial and Fedora a systemd drop-in sets this environment variable for trove-guest service, so it uses Ubuntu's/Fedora's system certificate store to validate server certificates. For Ubuntu Trusty the upstart script is modified to build and use a bundle file from certificates in /usr/local/share/ca-certificates, because Requests library doesn't support CA directories in such old Python versions. On Ubuntu systems the custom certificates are taken from /usr/local/share/ca-certificates; please use PEM format, .crt extension and call update-ca-certificates. On Fedora systems custom certificates can be put in /usr/share/pki/ca-trust-source/anchors; please use PEM format, .pem extension and call update-ca-trust. [1] http://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification Change-Id: I0025e7c72fa2d863ae9540941956b1ab63bcc636
43 lines
1.8 KiB
Plaintext
43 lines
1.8 KiB
Plaintext
description "Trove Guest"
|
|
author "Auto-Gen"
|
|
|
|
start on (filesystem and net-device-up IFACE!=lo)
|
|
stop on runlevel [016]
|
|
chdir /var/run
|
|
pre-start script
|
|
mkdir -p /var/run/trove
|
|
chown GUEST_USERNAME:root /var/run/trove/
|
|
|
|
mkdir -p /var/lock/trove
|
|
chown GUEST_USERNAME:root /var/lock/trove/
|
|
|
|
mkdir -p GUEST_LOGDIR
|
|
chown GUEST_USERNAME:root GUEST_LOGDIR
|
|
|
|
# Copy the trove source from the user's development environment
|
|
if [ ! -d /home/GUEST_USERNAME/trove ]; then
|
|
sudo -u GUEST_USERNAME rsync -e 'ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' -avz --exclude='.*' HOST_SCP_USERNAME@CONTROLLER_IP:PATH_TROVE/ /home/GUEST_USERNAME/trove
|
|
fi
|
|
|
|
# Ensure conf dir exists and is readable
|
|
mkdir -p /etc/trove/conf.d
|
|
chmod -R +r /etc/trove
|
|
end script
|
|
|
|
script
|
|
# For backwards compatibility until https://review.openstack.org/#/c/100381 merges
|
|
TROVE_CONFIG="--config-dir=/etc/trove/conf.d"
|
|
if [ ! -f /etc/trove/conf.d/guest_info ] && [ ! -f /etc/trove/conf.d/trove-guestagent.conf ]; then
|
|
|
|
chmod +r /etc/guest_info
|
|
sudo -u GUEST_USERNAME rsync -e 'ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' -avz --exclude='.*' HOST_SCP_USERNAME@CONTROLLER_IP:/etc/trove/trove-guestagent.conf ~GUEST_USERNAME/
|
|
mv ~GUEST_USERNAME/trove-guestagent.conf /etc/trove/trove-guestagent.conf
|
|
TROVE_CONFIG="--config-file=/etc/guest_info --config-file=/etc/trove/trove-guestagent.conf"
|
|
|
|
fi
|
|
|
|
# Requests: CA directories not supported in older Pythons, a custom bundle file is needed
|
|
cat /usr/local/share/ca-certificates/*.crt > /usr/local/share/ca-certificates/custom.bundle
|
|
exec su -c "REQUESTS_CA_BUNDLE=/usr/local/share/ca-certificates/custom.bundle /home/GUEST_USERNAME/trove/contrib/trove-guestagent $TROVE_CONFIG" GUEST_USERNAME
|
|
end script
|