EGI-Federation / EGI-Federation/documentation
Look at automating management of IGTF CAs and CRLs bundle
- Dominant language
- HTML
- Stars
- 15
- Forks
- 52
- Avg merge
- 12h 34m
- Merged PRs (30d)
- 2
Description
Currently CAs and CRLs bundles have to be managed manually for HAproxy (cf. https://github.com/EGI-Foundation/fedcloud-integration-documentation/issues/28 and https://egi-federated-cloud-integration.readthedocs.io/en/latest/openstack.html#pre-requisites).
Ideally it should be automated using fetch-crl and yum hooks.
## Automatic managing of CRLs bundle
Proposed solution by @dlgroep.
CRLs bundle should be updated after each [fetch-crl](https://wiki.nikhef.nl/grid/FetchCRL3) passes. The `postexec` hook could be use with a script using cat and reloading HAproxy:
```sh
#!/bin/sh
cat "$5"/*.r0 > "$5"/igtf-crls-bundle.pem
systemctl reload haproxy.service
```
## Automatic managing of CAs bundle
Possible solutions
* Using a cron job with cat and reload (like every 6 hours) (proposed by @dlgroep)
* Using a `yum-plugin-post-transaction-actions.noarch` triggering on any change on one of the `ca_*` packages. (proposed by @msalle)
Moved from https://github.com/EGI-Foundation/fedcloud-integration-documentation/issues/30
Contributor guide
Assessment
This issue has not been assessed yet.