fix upgrade from fat container (bsc#1267980)#805
Conversation
23294ed to
7dcfedc
Compare
62bb091 to
eee6c3f
Compare
mbussolotto
changed the title
There was a problem hiding this comment.
Pull request overview
This PR adjusts the podman upgrade/install SSL handling to better support upgrades from “fat” containers (bsc#12099), and removes a DB-container configuration step from mgradm.
Changes:
- Extend database certificate hostname/SAN validation and generation to include
dbandreportdb. - Update certificate reuse logic to validate multiple hostnames for DB certs during upgrades.
- Stop invoking
uyuni-postgres-config.shfrommgradm(removes theRunConfigPgslpath).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| uyuni-tools.changes.mbussolotto.single_pg_hba_conf | Adds changelog entries for the upgrade/certificate behavior changes. |
| mgradm/shared/podman/ssl.go | Updates DB cert preparation/reuse/generation to validate/include db and reportdb hostnames. |
| mgradm/shared/podman/podman.go | Adjusts upgrade flow conditions for split-DB setup; removes postgres-config invocation path. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| return err | ||
| } | ||
|
|
||
| cnames := append([]string{fqdn, "db", "reportdb"}, sslFlags.Cnames...) |
There was a problem hiding this comment.
Hold on here. @nadvornik removed this just last month - #790
These should no longer be needed as internal connections should use non-ssl access and external reportdb needs proper FQDN anyway.
There was a problem hiding this comment.
ok, I saw the PR but I didn't investigate too much on it. It seems that's not working for the upgrade.
There was a problem hiding this comment.
if this was the intention, I might modify rhn.conf during the db split to set:
report_db_ssl_enabled = 0
db_ssl_enabled = 0
There was a problem hiding this comment.
Indeed, that should fix the original bug as then there is no ssl name to check.
41d7156 to
3ad9872
Compare
3ad9872 to
8eda4d3
Compare
|
@uyuni-project/release-engineering this should be merge simultaneously with uyuni-project/uyuni#12099. Thanks! |
|
mbussolotto
changed the title
What does this PR change?
Codespace
Check if you already have a running container clicking on
Test coverage
No tests
DONE
Links
Issue(s): https://github.com/SUSE/spacewalk/issues/30928
Changelogs
Make sure the changelogs entries you are adding are compliant with https://github.com/uyuni-project/uyuni/wiki/Contributing#changelogs and https://github.com/uyuni-project/uyuni/wiki/Contributing#uyuni-projectuyuni-repository
If you don't need a changelog check, please mark this checkbox:
If you uncheck the checkbox after the PR is created, you will need to re-run
changelog_test(see below)Before you merge
Check How to branch and merge properly!