EGI-Federation / EGI-Federation/documentation

Look at automating management of IGTF CAs and CRLs bundle

Open
#183 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
15
Forks
52
Avg merge
12h 34m
Merged PRs (30d)
2

Description

Currently CAs and CRLs bundles have to be managed manually for HAproxy (cf. https://github.com/EGI-Foundation/fedcloud-integration-documentation/issues/28 and https://egi-federated-cloud-integration.readthedocs.io/en/latest/openstack.html#pre-requisites).
Ideally it should be automated using fetch-crl and yum hooks.

## Automatic managing of CRLs bundle

Proposed solution by @dlgroep.

CRLs bundle should be updated after each [fetch-crl](https://wiki.nikhef.nl/grid/FetchCRL3) passes. The `postexec` hook could be use with a script using cat and reloading HAproxy:

```sh
#!/bin/sh
cat "$5"/*.r0 > "$5"/igtf-crls-bundle.pem
systemctl reload haproxy.service
```

## Automatic managing of CAs bundle

Possible solutions

* Using a cron job with cat and reload (like every 6 hours) (proposed by @dlgroep)
* Using a `yum-plugin-post-transaction-actions.noarch` triggering on any change on one of the `ca_*` packages. (proposed by @msalle)

Moved from https://github.com/EGI-Foundation/fedcloud-integration-documentation/issues/30

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.