Make admin secrets optional

Admin user secret is needed only for first initialization. Make
them optional so upgrade works.

Author: aaannz

mgradm/shared/podman/podman.go

@@ -99,32 +99,41 @@ func GenerateServerSystemdService(mirrorPath string, debug bool) error {
 	}
 
 	data := templates.PodmanServiceTemplateData{
-		Volumes:            volumes,
-		NamePrefix:         "uyuni",
-		Args:               strings.Join(args, " "),
-		Ports:              ports,
-		Network:            podman.UyuniNetwork,
-		CaSecret:           podman.CASecret,
-		CaPath:             ssl.CAContainerPath,
-		CertSecret:         podman.SSLCertSecret,
-		CertPath:           ssl.ServerCertPath,
-		KeySecret:          podman.SSLKeySecret,
-		KeyPath:            ssl.ServerCertKeyPath,
-		DBCaSecret:         podman.DBCASecret,
-		DBCaPath:           ssl.DBCAContainerPath,
-		AdminUserSecret:    podman.AdminUserSecret,
-		AdminPassSecret:    podman.AdminPassSecret,
-		DBUserSecret:       podman.DBUserSecret,
-		DBPassSecret:       podman.DBPassSecret,
-		ReportDBUserSecret: podman.ReportDBUserSecret,
-		ReportDBPassSecret: podman.ReportDBPassSecret,
-		ServerEnvFile:      podman.GetServiceConfPath("uyuni-server", podman.ServerEnvironmentFile),
+		Volumes:       volumes,
+		NamePrefix:    "uyuni",
+		Args:          strings.Join(args, " "),
+		Ports:         ports,
+		Network:       podman.UyuniNetwork,
+		CaSecret:      podman.CASecret,
+		CaPath:        ssl.CAContainerPath,
+		CertSecret:    podman.SSLCertSecret,
+		CertPath:      ssl.ServerCertPath,
+		KeySecret:     podman.SSLKeySecret,
+		KeyPath:       ssl.ServerCertKeyPath,
+		DBCaSecret:    podman.DBCASecret,
+		DBCaPath:      ssl.DBCAContainerPath,
+		ServerEnvFile: podman.GetServiceConfPath("uyuni-server", podman.ServerEnvironmentFile),
 	}
 	if podman.HasSecret(podman.SCCUserSecret) {
 		data.SCCUserSecret = podman.SCCUserSecret
 		data.SCCPassSecret = podman.SCCPassSecret
 	}
 
+	if podman.HasSecret(podman.AdminUserSecret) {
+		data.AdminUserSecret = podman.AdminUserSecret
+		data.AdminPassSecret = podman.AdminPassSecret
+	}
+
+	if podman.HasSecret(podman.DBUserSecret) {
+		data.DBUserSecret = podman.DBUserSecret
+		data.DBPassSecret = podman.DBPassSecret
+	}
+
+	if podman.HasSecret(podman.ReportDBUserSecret) {
+		data.ReportDBUserSecret = podman.ReportDBUserSecret
+		data.ReportDBPassSecret = podman.ReportDBPassSecret
+	}
+
 	if err := utils.WriteTemplateToFile(data, podman.GetServicePath("uyuni-server"), 0444, true); err != nil {
 		return utils.Errorf(err, L("failed to generate systemd service unit file"))
 	}

mgradm/shared/templates/serviceTemplate.go

@@ -45,10 +45,14 @@ ExecStart=/bin/sh -c '/usr/bin/podman run \
 	{{- end }}
 	--env-file={{ .ServerEnvFile }} \
 	--network {{ .Network }} \
+	{{- if .DBUserSecret }}
 	--secret {{ .DBUserSecret }},type=env,target=MANAGER_USER \
 	--secret {{ .DBPassSecret }},type=env,target=MANAGER_PASS \
+	{{- end }}
+	{{- if .ReportDBUserSecret }}
 	--secret {{ .ReportDBUserSecret }},type=env,target=REPORT_DB_USER \
 	--secret {{ .ReportDBPassSecret }},type=env,target=REPORT_DB_PASS \
+	{{- end }}
 	--secret {{ .CaSecret }},type=mount,target={{ .CaPath }} \
 	--secret {{ .CaSecret }},type=mount,target=/usr/share/susemanager/salt/certs/RHN-ORG-TRUSTED-SSL-CERT \
 	--secret {{ .CaSecret }},type=mount,target=/srv/www/htdocs/pub/RHN-ORG-TRUSTED-SSL-CERT \

mgradm/shared/templates/templates_test.go

@@ -158,6 +158,83 @@ TimeoutStopSec=180
 TimeoutStartSec=900
 Type=forking
 
+[Install]
+WantedBy=multi-user.target default.target
+`,
+		},
+		{
+			name: "PodmanServiceUpdateTemplateData",
+			template: PodmanServiceTemplateData{
+				Volumes:       []types.VolumeMount{{Name: "var-spacewalk", MountPath: "/var/spacewalk"}},
+				NamePrefix:    "uyuni",
+				Args:          "--arg value",
+				Ports:         []types.PortMap{utils.NewPortMap(80)},
+				Network:       "uyuni-network",
+				CaSecret:      "ca-secret",
+				CaPath:        "/etc/pki/ca.crt",
+				DBCaSecret:    "db-ca-secret",
+				DBCaPath:      "/etc/pki/db-ca.crt",
+				CertSecret:    "cert-secret",
+				CertPath:      "/etc/pki/tls.crt",
+				KeySecret:     "key-secret",
+				KeyPath:       "/etc/pki/tls.key",
+				ServerEnvFile: "/etc/systemd/system/uyuni-server.conf.d/server.env",
+			},
+			expected: `# uyuni-server.service, generated by mgradm
+# Use an uyuni-server.service.d/local.conf file to override
+
+[Unit]
+Description=Uyuni server image container service
+Wants=network.target
+After=network-online.target
+RequiresMountsFor=%t/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=on-success
+ExecStartPre=/bin/rm -f %t/uyuni-server.pid %t/%n.ctr-id
+ExecStartPre=/usr/bin/podman rm --ignore --force -t 10 uyuni-server
+ExecStart=/bin/sh -c '/usr/bin/podman run \
+	--conmon-pidfile %t/uyuni-server.pid \
+	--cidfile=%t/%n.ctr-id \
+	--cgroups=no-conmon \
+	--shm-size=0 \
+	--shm-size-systemd=0 \
+	--sdnotify=conmon \
+	--systemd=always \
+	-d \
+	--name uyuni-server \
+	--hostname uyuni-server.mgr.internal \
+	--arg value \
+	-p 80:80 \
+	-v var-spacewalk:/var/spacewalk \
+	--env-file=/etc/systemd/system/uyuni-server.conf.d/server.env \
+	--network uyuni-network \
+	--secret ca-secret,type=mount,target=/etc/pki/ca.crt \
+	--secret ca-secret,type=mount,target=/usr/share/susemanager/salt/certs/RHN-ORG-TRUSTED-SSL-CERT \
+	--secret ca-secret,type=mount,target=/srv/www/htdocs/pub/RHN-ORG-TRUSTED-SSL-CERT \
+	--secret cert-secret,type=mount,target=/etc/pki/tls.crt \
+	--secret key-secret,type=mount,target=/etc/pki/tls.key \
+	--secret db-ca-secret,type=mount,target=/etc/pki/db-ca.crt \
+	--health-on-failure=stop \
+	${PODMAN_EXTRA_ARGS} ${UYUNI_IMAGE}'
+
+ExecStop=-/usr/bin/podman exec \
+    uyuni-server \
+    /bin/bash -c 'spacewalk-service stop'
+ExecStop=/usr/bin/podman stop \
+	--ignore -t 10 \
+	--cidfile=%t/%n.ctr-id
+ExecStopPost=/usr/bin/podman rm \
+	-f \
+	--ignore -t 10 \
+	--cidfile=%t/%n.ctr-id
+
+PIDFile=%t/uyuni-server.pid
+TimeoutStopSec=180
+TimeoutStartSec=900
+Type=forking
+
 [Install]
 WantedBy=multi-user.target default.target
 `,

uyuni-tools.changes.oholecek.optional_admin_secret

@@ -0,0 +1,2 @@
+- Do not require admin secrets on upgrades
+  (bsc#1262409)