add db and reportdb as cnames

Author: mbussolotto

mgradm/shared/podman/ssl.go

@@ -86,7 +86,8 @@ func prepareThirdPartyCertificates(
 	if sslFlags.UseProvided() {
 		log.Info().Msg(L("Using provided 3rd party server certificates"))
 		if err := prepareThirdPartyCertificate(&sslFlags.Ca, &sslFlags.Server,
-			shared_podman.CASecret, shared_podman.SSLCertSecret, shared_podman.SSLKeySecret, fqdn,
+			shared_podman.CASecret, shared_podman.SSLCertSecret, shared_podman.SSLKeySecret,
+			fqdn, "db", "reportdb",
 		); err != nil {
 			errs = append(errs, err)
 		}
@@ -97,7 +98,8 @@ func prepareThirdPartyCertificates(
 		log.Info().Msg(L("Using provided 3rd party database certificates"))
 		if err := prepareThirdPartyCertificate(
 			&sslFlags.DB.CA, &sslFlags.DB.SSLPair, shared_podman.DBCASecret,
-			shared_podman.DBSSLCertSecret, shared_podman.DBSSLKeySecret, fqdn,
+			shared_podman.DBSSLCertSecret, shared_podman.DBSSLKeySecret,
+			fqdn, "db", "reportdb",
 		); err != nil {
 			errs = append(errs, err)
 		}
@@ -191,11 +193,12 @@ func reuseExistingCertificates(image string, fqdn string, isDatabaseCheck bool)
 		return
 	}
 
+	fqdns := []string{fqdn, "db", "reportdb"}
+
 	// Upgrading from 5.1+ with all certificates as secrets
 	if reuseExistingCertificatesFromSecrets(isDatabaseCheck) {
 		secretName := shared_podman.SSLCertSecret
 		caSecretName := shared_podman.CASecret
-		fqdns := []string{fqdn}
 		msg := L("Reusing the existing server certificate secrets")
 		if isDatabaseCheck {
 			secretName = shared_podman.DBSSLCertSecret
@@ -210,7 +213,7 @@ func reuseExistingCertificates(image string, fqdn string, isDatabaseCheck bool)
 	}
 
 	// Upgrading from 5.0- with all certs in files
-	return reuseExistingCertificatesFromMounts(image, tempDir, fqdn, isDatabaseCheck)
+	return reuseExistingCertificatesFromMounts(image, tempDir, fqdns, isDatabaseCheck)
 }
 
 func isFQDNMatchingCertificateSecret(secretName string, caSecretName string, fqdns ...string) bool {
@@ -279,7 +282,7 @@ func reuseExistingCertificatesFromSecrets(isDatabaseCheck bool) bool {
 func reuseExistingCertificatesFromMounts(
 	image string,
 	tempDir string,
-	fqdn string,
+	fqdns []string,
 	isDatabaseCheck bool,
 ) (bool, error) {
 	caPath := path.Join(tempDir, "existing-ca.crt")
@@ -327,9 +330,11 @@ func reuseExistingCertificatesFromMounts(
 	}
 
 	// We cannot reuse certificates not matching the requested FQDN
-	if !isFQDNMatchingCertificate(fqdn, serverCert, caPath) {
-		log.Warn().Msgf(L("Certificate file %[1]s doesn't match %[2]s FQDN."), crtCheckPath, fqdn)
-		return false, nil
+	for _, fqdn := range fqdns {
+		if !isFQDNMatchingCertificate(fqdn, serverCert, caPath) {
+			log.Warn().Msgf(L("Certificate file %[1]s doesn't match %[2]s."), crtCheckPath, fqdn)
+			return false, nil
+		}
 	}
 
 	// Check for server certificate key
@@ -401,14 +406,15 @@ func generateServerCertificate(image string, sslFlags *adm_utils.InstallSSLFlags
 		return err
 	}
 
+	cnames := append([]string{fqdn, "db", "reportdb"}, sslFlags.Cnames...)
 	env := map[string]string{
 		"CERT_O":       sslFlags.Org,
 		"CERT_OU":      sslFlags.OU,
 		"CERT_CITY":    sslFlags.City,
 		"CERT_STATE":   sslFlags.State,
 		"CERT_COUNTRY": sslFlags.Country,
 		"CERT_EMAIL":   sslFlags.Email,
-		"CERT_CNAMES":  strings.Join(append([]string{fqdn}, sslFlags.Cnames...), " "),
+		"CERT_CNAMES":  strings.Join(cnames, " "),
 		"CERT_PASS":    sslFlags.Password,
 		"HOSTNAME":     fqdn,
 	}