Merge ~nicolasbock/stsstack-bundles:novarc_ssl into stsstack-bundles:master

[Nicolas Bock]

[Felipe Reyes (freyes)]

If we'll be setting the environment variable what would be the point of installing the certificate in the system's store?, without setting the env variable things should just work(tm), do you have a use case where things weren't working without it?

review: Needs Fixing

[Nicolas Bock (nicolasbock)]

> If we'll be setting the environment variable what would be the point of
> installing the certificate in the system's store?, without setting the env
> variable things should just work(tm), do you have a use case where things
> weren't working without it?

Those are good points. My reproducer is

./generate-bundle ... --ssl

source novaarc

openstack token issue

I am getting

Failed to discover available identity versions when contacting https://10.5.100.0:5000/v3. Attempting to parse version from URL.
SSL exception connecting to https://10.5.100.0:5000/v3/auth/tokens: HTTPSConnectionPool(host='10.5.100.0', port=5000): Max retries exceeded with url: /v3/auth/tokens (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123)')))

[Nicolas Bock (nicolasbock)]

The local cert is properly linked from /etc/ssl/certs so I don't actually understand why the openstack client is not using this cert.

[Nicolas Bock (nicolasbock)]

I removed the export and left the other part. Please re-review.

[Edward Hope-Morley (hopem)]

Resolved in commit db5491ef1b123741c6d25a8b5d6c3ab6d52f03d2

Unmerged commits

482bf02... by Nicolas Bock on 2021-04-12

Do not swallow stdout when calling CA cert script

In case there is more than one CA cert folder, the
`install_local_ca.sh` script prints the folders it found. This is not
visible to the user if the `novarc` script redirects stdout to
`/dev/null`.

Signed-off-by: Nicolas Bock <email address hidden>

diff --git a/openstack/novarc b/openstack/novarc
index 5e931de..4ef2feb 100644
--- a/openstack/novarc
+++ b/openstack/novarc
@@ -33,7 +33,7 @@ fi
 
 if [ "${OS_AUTH_PROTOCOL:-}" = "https" ]; then
     echo -n "INFO: installing certificate authority for this deployment..."
-    ${scriptdir}/tools/install_local_ca.sh 1>/dev/null
+    ${scriptdir}/tools/install_local_ca.sh
     echo done.
 fi
 
diff --git a/openstack/tools/install_local_ca.sh b/openstack/tools/install_local_ca.sh
index f7a780d..94205cf 100755
--- a/openstack/tools/install_local_ca.sh
+++ b/openstack/tools/install_local_ca.sh
@@ -30,7 +30,7 @@ fi
 
 if [ -n "$model_ca_cert_path" ]; then
     if [ ! -f /usr/local/share/ca-certificates/cacert.crt ] || [ $(md5sum $model_ca_cert_path | awk '{print $1}') != $(md5sum /usr/local/share/ca-certificates/cacert.crt | awk '{print $1}') ]; then
-        echo "INFO: installing stsstack-bundles openstack CA from /usr/local/share/ca-certificates/cacert.crt"
+        echo "INFO: installing stsstack-bundles openstack CA to /usr/local/share/ca-certificates/cacert.crt"
         sudo cp ${model_ca_cert_path} /usr/local/share/ca-certificates/cacert.crt
         sudo chmod 644 /usr/local/share/ca-certificates/cacert.crt
         sudo update-ca-certificates --fresh 1>/dev/null