add db and reportdb as cnames

Author: mbussolotto

mgradm/shared/podman/ssl.go

@@ -97,7 +97,8 @@ func prepareThirdPartyCertificates(
 		log.Info().Msg(L("Using provided 3rd party database certificates"))
 		if err := prepareThirdPartyCertificate(
 			&sslFlags.DB.CA, &sslFlags.DB.SSLPair, shared_podman.DBCASecret,
-			shared_podman.DBSSLCertSecret, shared_podman.DBSSLKeySecret, fqdn,
+			shared_podman.DBSSLCertSecret, shared_podman.DBSSLKeySecret,
+			fqdn, "db", "reportdb",
 		); err != nil {
 			errs = append(errs, err)
 		}
@@ -123,7 +124,7 @@ func PrepareSSLCertificates(image string, sslFlags *adm_utils.InstallSSLFlags, t
 	// Do we have secrets or certificates from volumes to reuse?
 	if !serverCertReady {
 		// Check if this is an upgrade scenario and there is existing CA and cert/key pair
-		serverCertReady, err = reuseExistingCertificates(image, fqdn, false)
+		serverCertReady, err = reuseExistingCertificates(image, []string{fqdn}, false)
 	}
 	if serverCertReady && err != nil {
 		// we found certificates, but there was trouble loading it
@@ -132,7 +133,9 @@ func PrepareSSLCertificates(image string, sslFlags *adm_utils.InstallSSLFlags, t
 
 	if !dbCertReady {
 		// Check if this is an upgrade scenario and there is existing CA and cert/key pair
-		dbCertReady, err = reuseExistingCertificates(image, fqdn, true)
+
+		fqdns := []string{fqdn, "db", "reportdb"}
+		dbCertReady, err = reuseExistingCertificates(image, fqdns, true)
 	}
 	if dbCertReady && err != nil {
 		// we found certificates, but there was trouble loading it
@@ -183,7 +186,7 @@ func validateCA(image string, sslFlags *adm_utils.InstallSSLFlags, tz string) er
 	return nil
 }
 
-func reuseExistingCertificates(image string, fqdn string, isDatabaseCheck bool) (reused bool, err error) {
+func reuseExistingCertificates(image string, fqdns []string, isDatabaseCheck bool) (reused bool, err error) {
 	// Write the ordered cert and Root CA to temp files
 	tempDir, cleaner, err := utils.TempDir()
 	defer cleaner()
@@ -195,7 +198,6 @@ func reuseExistingCertificates(image string, fqdn string, isDatabaseCheck bool)
 	if reuseExistingCertificatesFromSecrets(isDatabaseCheck) {
 		secretName := shared_podman.SSLCertSecret
 		caSecretName := shared_podman.CASecret
-		fqdns := []string{fqdn}
 		msg := L("Reusing the existing server certificate secrets")
 		if isDatabaseCheck {
 			secretName = shared_podman.DBSSLCertSecret
@@ -210,7 +212,7 @@ func reuseExistingCertificates(image string, fqdn string, isDatabaseCheck bool)
 	}
 
 	// Upgrading from 5.0- with all certs in files
-	return reuseExistingCertificatesFromMounts(image, tempDir, fqdn, isDatabaseCheck)
+	return reuseExistingCertificatesFromMounts(image, tempDir, fqdns, isDatabaseCheck)
 }
 
 func isFQDNMatchingCertificateSecret(secretName string, caSecretName string, fqdns ...string) bool {
@@ -279,7 +281,7 @@ func reuseExistingCertificatesFromSecrets(isDatabaseCheck bool) bool {
 func reuseExistingCertificatesFromMounts(
 	image string,
 	tempDir string,
-	fqdn string,
+	fqdns []string,
 	isDatabaseCheck bool,
 ) (bool, error) {
 	caPath := path.Join(tempDir, "existing-ca.crt")
@@ -327,9 +329,11 @@ func reuseExistingCertificatesFromMounts(
 	}
 
 	// We cannot reuse certificates not matching the requested FQDN
-	if !isFQDNMatchingCertificate(fqdn, serverCert, caPath) {
-		log.Warn().Msgf(L("Certificate file %[1]s doesn't match %[2]s FQDN."), crtCheckPath, fqdn)
-		return false, nil
+	for _, fqdn := range fqdns {
+		if !isFQDNMatchingCertificate(fqdn, serverCert, caPath) {
+			log.Warn().Msgf(L("Certificate file %[1]s doesn't match %[2]s."), crtCheckPath, fqdn)
+			return false, nil
+		}
 	}
 
 	// Check for server certificate key
@@ -401,14 +405,15 @@ func generateServerCertificate(image string, sslFlags *adm_utils.InstallSSLFlags
 		return err
 	}
 
+	cnames := append([]string{fqdn, "db", "reportdb"}, sslFlags.Cnames...)
 	env := map[string]string{
 		"CERT_O":       sslFlags.Org,
 		"CERT_OU":      sslFlags.OU,
 		"CERT_CITY":    sslFlags.City,
 		"CERT_STATE":   sslFlags.State,
 		"CERT_COUNTRY": sslFlags.Country,
 		"CERT_EMAIL":   sslFlags.Email,
-		"CERT_CNAMES":  strings.Join(append([]string{fqdn}, sslFlags.Cnames...), " "),
+		"CERT_CNAMES":  strings.Join(cnames, " "),
 		"CERT_PASS":    sslFlags.Password,
 		"HOSTNAME":     fqdn,
 	}

uyuni-tools.changes.mbussolotto.single_pg_hba_conf

@@ -1 +1,2 @@
+- Add db and reportdb as cnames to the certificate (bsc#12099).
 - Do not call uyuni-postgres-config.sh in mgradm (bsc#12099).