Merge pull request #617 from aaannz/use_tmp_tls_volume_migration

Migrate TLS certificates from the 4.3

Author: deneb-alpha

mgradm/shared/podman/podman.go

@@ -371,10 +371,6 @@ func Upgrade(
 	}
 
 	if newPgVersion > oldPgVersion {
-		log.Info().Msgf(
-			L("Previous PostgreSQL is %[1]s, instead new one is %[2]s. Performing a DB version upgrade…"),
-			oldPgVersion, newPgVersion,
-		)
 		if err := RunPgsqlVersionUpgrade(
 			authFile, registry, image, upgradeImage, strconv.Itoa(oldPgVersion),
 			strconv.Itoa(newPgVersion),
@@ -564,7 +560,7 @@ func Migrate(
 	log.Info().Msgf(L("Configuring split PostgreSQL container. Image version: %[1]d, not migrated version: %[2]d"),
 		newPgVersion, oldPgVersion)
 
-	if err := upgradeDB(newPgVersion, oldPgVersion, upgradeImage, authFile, registry, pgsqlFlags.Image); err != nil {
+	if err := upgradeDB(newPgVersion, oldPgVersion, upgradeImage, authFile, registry, image); err != nil {
 		return err
 	}
 
@@ -573,6 +569,11 @@ func Migrate(
 		return utils.Errorf(err, L("cannot configure db container"))
 	}
 
+	// At this point we should have all certificates in the secrets form, we can remove temporary volume
+	if err := podman.DeleteVolume(utils.EtcTLSTmpVolumeMount.Name, false); err != nil {
+		log.Warn().Err(err).Msg(L("cannot remove temporary etc-tls volume"))
+	}
+
 	if err := pgsql.Upgrade(preparedPgsqlImage, systemd); err != nil {
 		return err
 	}
@@ -678,7 +679,7 @@ func RunPgsqlContainerMigration(serverImage string, dbHost string, reportDBHost
 		"-v", scriptDir + ":" + scriptDir,
 		"--security-opt", "label=disable",
 	}
-	err = podman.RunContainer("uyuni-db-migrate", serverImage, utils.ServerMigrationVolumeMounts, podmanArgs,
+	err = podman.RunContainer("uyuni-db-migrate", serverImage, utils.DatabaseMigrationVolumeMounts, podmanArgs,
 		[]string{scriptPath})
 
 	return err
@@ -690,7 +691,7 @@ func RunConfigPgsl(pgsqlImage string) error {
 		"--security-opt", "label=disable",
 		"--entrypoint", "/docker-entrypoint-initdb.d/uyuni-postgres-config.sh",
 	}
-	if err := podman.RunContainer("uyuni-db-config", pgsqlImage, utils.ServerMigrationVolumeMounts,
+	if err := podman.RunContainer("uyuni-db-config", pgsqlImage, utils.PgsqlRequiredVolumeMounts,
 		podmanArgs, []string{}); err != nil {
 		return err
 	}
@@ -792,15 +793,11 @@ func upgradeDB(
 	upgradeImage types.ImageFlags,
 	authFile string,
 	registry string,
-	dbImage types.ImageFlags,
+	image types.ImageFlags,
 ) error {
 	if newPgVersion > oldPgVersion {
-		log.Info().Msgf(
-			L("Previous PostgreSQL is %[1]s, instead new one is %[2]s. Performing a DB version upgrade…"),
-			oldPgVersion, newPgVersion,
-		)
 		if err := RunPgsqlVersionUpgrade(
-			authFile, registry, dbImage, upgradeImage, strconv.Itoa(oldPgVersion),
+			authFile, registry, image, upgradeImage, strconv.Itoa(oldPgVersion),
 			strconv.Itoa(newPgVersion),
 		); err != nil {
 			return utils.Error(err, L("cannot run PostgreSQL version upgrade script"))

mgradm/shared/utils/exec.go

@@ -123,8 +123,15 @@ func GenerateMigrationScript(
 		return "", nil, err
 	}
 
+	// For podman we want to backup tls certificates to the temporary volume we
+	// later use when creating secrets.
+	volumes := append(utils.ServerVolumeMounts, utils.VarPgsqlDataVolumeMount)
+	if !kubernetes {
+		volumes = append(volumes, utils.EtcTLSTmpVolumeMount)
+	}
+
 	data := templates.MigrateScriptTemplateData{
-		Volumes:      append(utils.ServerVolumeMounts, utils.VarPgsqlDataVolumeMount),
+		Volumes:      volumes,
 		SourceFqdn:   sourceFqdn,
 		User:         user,
 		Kubernetes:   kubernetes,

shared/utils/volumes.go

@@ -23,6 +23,9 @@ var PgsqlRequiredVolumeMounts = []types.VolumeMount{
 // CaCertVolumeMount represents volume for CA certificates.
 var CaCertVolumeMount = types.VolumeMount{MountPath: "/etc/pki/trust/anchors/", Name: "ca-cert"}
 
+// EtcTLSTmpVolumeMount represents temporary volume for SSL certificates.
+var EtcTLSTmpVolumeMount = types.VolumeMount{MountPath: "/etc/pki/tls/", Name: "etc-tls", Size: "1Mi"}
+
 // ServerVolumeMounts should match the volumes mapping from the container definition in both
 // the helm chart and the systemctl services definitions.
 var ServerVolumeMounts = []types.VolumeMount{
@@ -55,7 +58,10 @@ var ServerVolumeMounts = []types.VolumeMount{
 }
 
 // ServerMigrationVolumeMounts match server + postgres volume mounts, used for migration.
-var ServerMigrationVolumeMounts = append(ServerVolumeMounts, VarPgsqlDataVolumeMount, EtcRhnVolumeMount)
+var ServerMigrationVolumeMounts = append(ServerVolumeMounts, VarPgsqlDataVolumeMount, EtcTLSTmpVolumeMount)
+
+// DatabaseMigrationVolumeMounts match database + etc/rhn volume mounts, used for database migration.
+var DatabaseMigrationVolumeMounts = []types.VolumeMount{EtcRhnVolumeMount, VarPgsqlDataVolumeMount}
 
 // SalineVolumeMounts represents volumes used by Saline container.
 var SalineVolumeMounts = []types.VolumeMount{

uyuni-tools.changes.oholecek.fix_migration_tls

@@ -0,0 +1,2 @@
+- migrate existing TLS certificates from 4.3 systems
+  (bsc#1244847)