charm-openstack-service-checks:offline-snap-install

Branch merges

Propose for merging

Merged into charm-openstack-service-checks:master at revision 8f5b59bb22834f64aea957be7411afb4679a3c7c

🤖 prod-jenkaas-bootstack (community): Approve (continuous-integration) on 2021-07-19

Xav Paice (community): Approve on 2021-07-19

Diff: 83 lines (+42/-0)

4 files modified

src/README.md (+24/-0)
src/layer.yaml (+4/-0)
src/metadata.yaml (+13/-0)
src/tox.ini (+1/-0)

api

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related charm recipes

8f5b59b... by Celia Wang on 2021-07-19

Fix README syntax and add N818 ignore for lint

6d81e45... by Celia Wang on 2021-07-19

Merge remote-tracking branch 'fandanbango/offline-snap-install'

0be89e2... by Joe Guo on 2021-05-05

ensure requests to use system ca bundle for ssl verify

`keystoneclient` will use `requests` to access api endpoints.
When https/ssl is enabled, `requests` will rely on package `certifi` to find ca certs for ssl verify.

However, `certifi` has different behavior:

- in python package, it will return builtin `cacert.pem` which is Mozilla Root Certificates.
- in deb package, it's modified to return `/etc/ssl/certs/ca-certificates.crt` as expected.

When we use vault, keystone endpoints will be https and ssl verify is needed.
The ca cert configured via `trusted_ssl_ca` will be merged into `/etc/ssl/certs/ca-certificates.crt`.

This is ok if charm is running globally without venv (certifi deb package is used).
But when charm is running in venv(certifi python package is used),
above cert will be ignored by requests and cause [SSL: CERTIFICATE_VERIFY_FAILED] error.

This patch set envvar REQUESTS_CA_BUNDLE to system ca bundle, so
requests will use it as ca cert, instead of `.venv/.../certifi/cacert.pem`.

Related bugs:
LP: #1924816
LP: #1926670

Signed-off-by: Joe Guo <email address hidden>

e50f728... by Joe Guo on 2021-04-27

add email_from_addr config option and pass to port security check when set

Signed-off-by: Joe Guo <email address hidden>

ccdc2e1... by Joe Guo on 2021-04-09

add test_check_port_security.py

Signed-off-by: Joe Guo <email address hidden>

82ec814... by Joe Guo on 2021-04-09

add config option email-recipients and pass to cron job

Add it as a generic email list, so far only used for check_port_security.py

Signed-off-by: Joe Guo <email address hidden>

cccc982... by Joe Guo on 2021-04-01

add cron file to run port security auto remediation every minute

Signed-off-by: Joe Guo <email address hidden>

ba4cfc0... by Joe Guo on 2021-04-01

add port security nrpe check and config option

Signed-off-by: Joe Guo <email address hidden>

6c08b10... by Joe Guo on 2021-03-31

add script check_port_security.py

Signed-off-by: Joe Guo <email address hidden>

ffb5c77... by Giuseppe Petralia on 2021-03-31

Refactor LB operating status unit tests.