Merge pull request #761 from nadvornik/proxy_secrets

nadvornik · web-flow · commit e82b89afbd20 · 2026-04-13T15:53:53.000+02:00
Use podman secrets for SSL on proxy
diff --git a/mgrpxy/cmd/install/utils.go b/mgrpxy/cmd/install/utils.go
@@ -35,6 +35,10 @@ func installForPodman(
 		return shared_utils.Errorf(err, L("failed to retrieve proxy config files"))
 	}
 
+	if err := podman.ExtractSecrets(); err != nil {
+		return err
+	}
+
 	hostData, err := shared_podman.InspectHost()
 	if err != nil {
 		return err
diff --git a/mgrpxy/cmd/uninstall/podman.go b/mgrpxy/cmd/uninstall/podman.go
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2025 SUSE LLC
+// SPDX-FileCopyrightText: 2026 SUSE LLC
 //
 // SPDX-License-Identifier: Apache-2.0
 
@@ -90,9 +90,10 @@ func uninstallForPodman(
 
 	podman.DeleteNetwork(dryRun)
 
-	if podman.HasSecret(pxy_podman.SystemIDSecret) {
-		podman.DeleteSecret(pxy_podman.SystemIDSecret, false)
-	}
+	podman.DeleteSecret(pxy_podman.SystemIDSecret, dryRun)
+	podman.DeleteSecret(podman.CASecret, dryRun)
+	podman.DeleteSecret(podman.ProxySSLCertSecret, dryRun)
+	podman.DeleteSecret(podman.ProxySSLKeySecret, dryRun)
 
 	err := systemd.ReloadDaemon(dryRun)
 
diff --git a/mgrpxy/shared/podman/podman.go b/mgrpxy/shared/podman/podman.go
@@ -25,6 +25,7 @@ import (
 	"github.com/uyuni-project/uyuni-tools/shared/podman"
 	"github.com/uyuni-project/uyuni-tools/shared/types"
 	shared_utils "github.com/uyuni-project/uyuni-tools/shared/utils"
+	"gopkg.in/yaml.v2"
 )
 
 const (
@@ -44,6 +45,7 @@ const (
 var contextRunner = shared_utils.NewRunnerWithContext
 var newRunner = shared_utils.NewRunner
 var systemdGenerator func(shared_utils.Template, string, string, string) error = generateSystemdFile
+var createSecret = podman.CreateSecret
 
 // PodmanProxyFlags are the flags used by podman proxy install and upgrade command.
 type PodmanProxyFlags struct {
@@ -86,6 +88,15 @@ func GenerateSystemdService(
 		if podman.HasSecret(SystemIDSecret) {
 			dataHttpd.SystemIDSecret = SystemIDSecret
 		}
+		if podman.HasSecret(podman.CASecret) {
+			dataHttpd.CaSecret = podman.CASecret
+		}
+		if podman.HasSecret(podman.ProxySSLCertSecret) {
+			dataHttpd.CertSecret = podman.ProxySSLCertSecret
+		}
+		if podman.HasSecret(podman.ProxySSLKeySecret) {
+			dataHttpd.KeySecret = podman.ProxySSLKeySecret
+		}
 
 		additionHttpdTuningSettings := ""
 		additionHTTPConfPath, err := getPathOrDefault(flags.Tuning.Httpd, defaultApacheConf)
@@ -159,6 +170,9 @@ func GenerateSystemdService(
 			Volumes:       shared_utils.ProxyTftpdVolumes,
 			HTTPProxyFile: httpProxyConfig,
 		}
+		if podman.HasSecret(podman.CASecret) {
+			dataTftpd.CaSecret = podman.CASecret
+		}
 		if err := systemdGenerator(dataTftpd, "tftpd", tftpdImage, ""); err != nil {
 			return err
 		}
@@ -308,6 +322,10 @@ func Upgrade(
 		return err
 	}
 
+	if err := ExtractSecrets(); err != nil {
+		return err
+	}
+
 	hostData, err := podman.InspectHost()
 	if err != nil {
 		return err
@@ -450,5 +468,114 @@ func GetSystemID() error {
 	}
 	log.Trace().Msgf("SystemID: %s", systemid)
 
-	return podman.CreateSecret(SystemIDSecret, systemid)
+	return createSecret(SystemIDSecret, systemid)
+}
+
+var proxyConfigDir = "/etc/uyuni/proxy"
+
+// ExtractSecrets extracts certificates from YAML files and creates podman secrets.
+func ExtractSecrets() error {
+	if err := extractCASecret(path.Join(proxyConfigDir, "config.yaml")); err != nil {
+		return err
+	}
+	return extractHttpdSecrets(path.Join(proxyConfigDir, "httpd.yaml"))
+}
+
+func extractCASecret(configPath string) error {
+	config, err := loadYaml(configPath)
+	if err != nil || config == nil {
+		return err
+	}
+
+	updated, err := extractKeyToSecret(config, "ca_crt", podman.CASecret)
+	if err != nil {
+		return err
+	}
+
+	if updated {
+		return saveYaml(configPath, config)
+	}
+	return nil
+}
+
+func extractHttpdSecrets(httpdPath string) error {
+	config, err := loadYaml(httpdPath)
+	if err != nil || config == nil {
+		return err
+	}
+
+	httpd, ok := config["httpd"]
+	if !ok {
+		return nil
+	}
+
+	httpdMap := ensureStringMap(httpd)
+	if httpdMap == nil {
+		return nil
+	}
+	config["httpd"] = httpdMap
+
+	updated1, err := extractKeyToSecret(httpdMap, "server_crt", podman.ProxySSLCertSecret)
+	if err != nil {
+		return err
+	}
+	updated2, err := extractKeyToSecret(httpdMap, "server_key", podman.ProxySSLKeySecret)
+	if err != nil {
+		return err
+	}
+
+	if updated1 || updated2 {
+		return saveYaml(httpdPath, config)
+	}
+	return nil
+}
+
+func loadYaml(filePath string) (map[string]interface{}, error) {
+	if !shared_utils.FileExists(filePath) {
+		return nil, nil
+	}
+	data, err := os.ReadFile(filePath)
+	if err != nil {
+		return nil, shared_utils.Errorf(err, L("failed to read %s"), filePath)
+	}
+	var config map[string]interface{}
+	if err := yaml.Unmarshal(data, &config); err != nil {
+		return nil, shared_utils.Errorf(err, L("failed to unmarshal %s"), filePath)
+	}
+	return config, nil
+}
+
+func saveYaml(filePath string, config map[string]interface{}) error {
+	newData, err := yaml.Marshal(config)
+	if err != nil {
+		return shared_utils.Errorf(err, L("failed to marshal %s"), filePath)
+	}
+	if err := os.WriteFile(filePath, newData, 0644); err != nil {
+		return shared_utils.Errorf(err, L("failed to write %s"), filePath)
+	}
+	return nil
+}
+
+func extractKeyToSecret(m map[string]interface{}, key string, secretName string) (bool, error) {
+	if val, ok := m[key].(string); ok && val != "" {
+		if err := createSecret(secretName, val); err != nil {
+			return false, shared_utils.Errorf(err, L("failed to create %s secret"), secretName)
+		}
+		delete(m, key)
+		return true, nil
+	}
+	return false, nil
+}
+
+func ensureStringMap(data interface{}) map[string]interface{} {
+	if m, ok := data.(map[string]interface{}); ok {
+		return m
+	} else if m, ok := data.(map[interface{}]interface{}); ok {
+		res := make(map[string]interface{})
+		for k, v := range m {
+			res[fmt.Sprintf("%v", k)] = v
+		}
+		return res
+	}
+	return nil
 }
diff --git a/mgrpxy/shared/podman/podman_test.go b/mgrpxy/shared/podman/podman_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/uyuni-project/uyuni-tools/shared/testutils"
 	"github.com/uyuni-project/uyuni-tools/shared/types"
 	"github.com/uyuni-project/uyuni-tools/shared/utils"
+	"gopkg.in/yaml.v2"
 )
 
 func TestCheckDirPermissions(t *testing.T) {
@@ -217,3 +218,66 @@ func TestGenerateSystemdService(t *testing.T) {
 	// Restore the mocked variables
 	systemdGenerator = generateSystemdFile
 }
+
+func TestExtractSecrets(t *testing.T) {
+	tempDir := t.TempDir()
+	oldProxyConfigDir := proxyConfigDir
+	proxyConfigDir = tempDir
+	defer func() { proxyConfigDir = oldProxyConfigDir }()
+
+	secrets := make(map[string]string)
+	oldCreateSecret := createSecret
+	createSecret = func(name string, value string) error {
+		secrets[name] = value
+		return nil
+	}
+	defer func() { createSecret = oldCreateSecret }()
+
+	configPath := path.Join(tempDir, "config.yaml")
+	configData := "ca_crt: CA_CERT_CONTENT\nother_key: other_value\n"
+	if err := os.WriteFile(configPath, []byte(configData), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	httpdPath := path.Join(tempDir, "httpd.yaml")
+	httpdData := "httpd:\n  server_crt: SERVER_CERT_CONTENT\n" +
+		"  server_key: SERVER_KEY_CONTENT\n  other_httpd_key: other_httpd_value\n"
+	if err := os.WriteFile(httpdPath, []byte(httpdData), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := ExtractSecrets(); err != nil {
+		t.Errorf("ExtractSecrets failed: %v", err)
+	}
+
+	// Verify secrets
+	testutils.AssertEquals(t, "Wrong CA secret", "CA_CERT_CONTENT", secrets[podman.CASecret])
+	testutils.AssertEquals(t, "Wrong server cert secret", "SERVER_CERT_CONTENT", secrets[podman.ProxySSLCertSecret])
+	testutils.AssertEquals(t, "Wrong server key secret", "SERVER_KEY_CONTENT", secrets[podman.ProxySSLKeySecret])
+
+	// Verify files are updated (keys removed)
+	data, _ := os.ReadFile(configPath)
+	var config map[string]interface{}
+	if err := yaml.Unmarshal(data, &config); err != nil {
+		t.Fatalf("Failed to unmarshal config.yaml: %v", err)
+	}
+	if _, ok := config["ca_crt"]; ok {
+		t.Error("ca_crt was not removed from config.yaml")
+	}
+	testutils.AssertEquals(t, "other_key was modified", "other_value", config["other_key"])
+
+	data, _ = os.ReadFile(httpdPath)
+	var httpdConfig map[string]interface{}
+	if err := yaml.Unmarshal(data, &httpdConfig); err != nil {
+		t.Fatalf("Failed to unmarshal httpd.yaml: %v", err)
+	}
+
+	httpd := ensureStringMap(httpdConfig["httpd"])
+	if _, ok := httpd["server_crt"]; ok {
+		t.Error("server_crt was not removed from httpd.yaml")
+	}
+	if _, ok := httpd["server_key"]; ok {
+		t.Error("server_key was not removed from httpd.yaml")
+	}
+	testutils.AssertEquals(t, "other_httpd_key was modified", "other_httpd_value", httpd["other_httpd_key"])
+}
diff --git a/mgrpxy/shared/templates/httpd.go b/mgrpxy/shared/templates/httpd.go
@@ -39,6 +39,15 @@ ExecStart=/bin/sh -c '/usr/bin/podman run \
 	{{- if .SystemIDSecret }}
 	--secret {{ .SystemIDSecret }},type=mount,mode=0444,target="/etc/sysconfig/rhn/systemid" \
 	{{- end }}
+	{{- if .CaSecret }}
+	--secret {{ .CaSecret }},type=mount,mode=0444,target="/etc/pki/trust/anchors/RHN-ORG-TRUSTED-SSL-CERT" \
+	{{- end }}
+	{{- if .CertSecret }}
+	--secret {{ .CertSecret }},type=mount,mode=0444,target="/etc/apache2/ssl.crt/server.crt" \
+	{{- end }}
+	{{- if .KeySecret }}
+	--secret {{ .KeySecret }},type=mount,mode=0400,target="/etc/apache2/ssl.key/server.key" \
+	{{- end }}
 	{{- if .HTTPProxyFile }}
 	-v {{ .HTTPProxyFile }}:{{ .HTTPProxyFile }}:ro \
 	{{- end }}
@@ -60,6 +69,9 @@ type HttpdTemplateData struct {
 	Volumes        []types.VolumeMount
 	HTTPProxyFile  string
 	SystemIDSecret string
+	CaSecret       string
+	CertSecret     string
+	KeySecret      string
 }
 
 // Render will create the systemd configuration file.
diff --git a/mgrpxy/shared/templates/templates_test.go b/mgrpxy/shared/templates/templates_test.go
@@ -23,6 +23,9 @@ func TestTemplatesRender(t *testing.T) {
 				Volumes:        []types.VolumeMount{{Name: "vol1", MountPath: "/mnt/vol1"}},
 				HTTPProxyFile:  "/etc/sysconfig/proxy",
 				SystemIDSecret: "system-id-secret",
+				CaSecret:       "ca-secret",
+				CertSecret:     "cert-secret",
+				KeySecret:      "key-secret",
 			},
 		},
 		{
@@ -58,6 +61,7 @@ func TestTemplatesRender(t *testing.T) {
 			template: TFTPDTemplateData{
 				Volumes:       []types.VolumeMount{{Name: "tftp-vol", MountPath: "/srv/tftpboot"}},
 				HTTPProxyFile: "/etc/sysconfig/proxy",
+				CaSecret:      "ca-secret",
 			},
 		},
 	}
diff --git a/mgrpxy/shared/templates/tftpd.go b/mgrpxy/shared/templates/tftpd.go
@@ -36,6 +36,9 @@ ExecStart=/bin/sh -c '/usr/bin/podman run \
 	{{- range .Volumes }}
 	-v {{ .Name }}:{{ .MountPath }} \
 	{{- end }}
+	{{- if .CaSecret }}
+	--secret {{ .CaSecret }},type=mount,mode=0444,target="/etc/pki/trust/anchors/RHN-ORG-TRUSTED-SSL-CERT" \
+	{{- end }}
 	{{- if .HTTPProxyFile }}
 	-v {{ .HTTPProxyFile }}:{{ .HTTPProxyFile }}:ro \
 	{{- end }}
@@ -56,6 +59,7 @@ WantedBy=multi-user.target default.target
 type TFTPDTemplateData struct {
 	Volumes       []types.VolumeMount
 	HTTPProxyFile string
+	CaSecret      string
 }
 
 // Render will create the TFTPD systemd configuration file.
diff --git a/shared/podman/secret.go b/shared/podman/secret.go
@@ -40,6 +40,10 @@ const (
 	DBSSLCertSecret = "uyuni-db-cert"
 	// DBSSLKeySecret is the name of the podman secret containing the report database SSL certificate key.
 	DBSSLKeySecret = "uyuni-db-key"
+	// ProxySSLCertSecret is the name of the podman secret containing the proxy SSL certificate.
+	ProxySSLCertSecret = "uyuni-proxy-cert"
+	// ProxySSLKeySecret is the name of the podman secret containing the proxy SSL certificate key.
+	ProxySSLKeySecret = "uyuni-proxy-key"
 )
 
 // CreateCredentialsSecretsIfMissing creates the podman secrets, one for the user name and one for the password.
diff --git a/uyuni-tools.changes.nadvornik.proxy_secrets b/uyuni-tools.changes.nadvornik.proxy_secrets
@@ -0,0 +1 @@
+- Use podman secrets for SSL on proxy
