canonical / canonical/openstack-exporter-operator

Missing the certificates integration when deployments are using Vault as Root CA

Open
#150 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
3
Forks
13
Avg merge
8d 2h
Merged PRs (30d)
3

Description

**Problem :**
On openstack deployments, SSL is deployed through 2 manners :
1) with provided certificates from customers
2) directly with Vault generating a root CA.

For the case where a deployment is using Vault as a root CA, the expected experience is to have a certificates relation between Vault and the application to retrieve the root CA and apply locally on the unit.
Currently such integration doesn't exist on the charm itself.

**Environment :**
- Ubuntu 22.04
- Charmed Openstack Caracal with charms from 2024.1/stable
- Openstack-exporter charm with latest/stable

**Logs :**
As a result, we are greeted with SSL errors when the application is deployed and related to an existing Openstack.

> Apr 21 07:22:39 juju-334cd8-2-lxd-24 charmed-openstack-exporter.service[49627]: ts=2025-04-21T07:22:39.389Z caller=utils.go:75 level=error err="enabling exporter for service failed" cloud=openstack service=identity error="Post \"https://keystone-internal.production.solutionsqa:5000/v3/auth/token>
> Apr 21 07:22:39 juju-334cd8-2-lxd-24 charmed-openstack-exporter.service[49627]: ts=2025-04-21T07:22:39.389Z caller=utils.go:71 level=info msg="Start collect cache data" cloud=openstack service=container-infra
> Apr 21 07:22:39 juju-334cd8-2-lxd-24 charmed-openstack-exporter.service[49627]: ts=2025-04-21T07:22:39.389Z caller=exporter.go:218 level=error msg="Failed to include additional certificates to ca-trust" err="error parsing CA Cert from: /var/snap/charmed-openstack-exporter/common/cacert.pe>
> Apr 21 07:22:39 juju-334cd8-2-lxd-24 charmed-openstack-exporter.service[49627]: ts=2025-04-21T07:22:39.392Z caller=utils.go:75 level=error err="enabling exporter for service failed" cloud=openstack service=container-infra error="Post \"https://keystone-internal.production.solutionsqa:5000/v3/aut>
> Apr 21 07:22:39 juju-334cd8-2-lxd-24 charmed-openstack-exporter.service[49627]: ts=2025-04-21T07:22:39.392Z caller=utils.go:71 level=info msg="Start collect cache data" cloud=openstack service=dns
> Apr 21 07:22:39 juju-334cd8-2-lxd-24 charmed-openstack-exporter.service[49627]: ts=2025-04-21T07:22:39.392Z caller=exporter.go:218 level=error msg="Failed to include additional certificates to ca-trust" err="error parsing CA Cert from: /var/snap/charmed-openstack-exporter/common/cacert.pe>
> Apr 21 07:22:39 juju-334cd8-2-lxd-24 charmed-openstack-exporter.service[49627]: ts=2025-04-21T07:22:39.395Z caller=utils.go:75 level=error err="enabling exporter for service failed" cloud=openstack service=dns error="Post \"https://keystone-internal.production.solutionsqa:5000/v3/auth/tokens\": >
> Apr 21 07:22:39 juju-334cd8-2-lxd-24 charmed-openstack-exporter.service[49627]: ts=2025-04-21T07:22:39.395Z caller=utils.go:71 level=info msg="Start collect cache data" cloud=openstack service=orchestration

**Workaround :**
Retrieve the CA certificate manually from Vault and apply to Openstack-exporter
`
juju run -m openstack vault/leader get-root-ca --format json | \
jq -r .[].results.output | tee ./ca.crt
juju config -m openstack openstack-exporter ssl_ca="$(cat ./tls/ca.crt)"
`

Wish :
Being able to have a certificates endpoint on the charm so that it can related to Vault directly and avoid a manual (and forgetable) action from the user for each (re)deployment
`juju relate vault:certificates openstack-exporter:certificates`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.