Revision b6267745 lib/bootstrap.py
| b/lib/bootstrap.py | ||
|---|---|---|
| 88 | 88 |
backup=True) |
| 89 | 89 |
|
| 90 | 90 |
|
| 91 |
def GenerateClusterCrypto(new_cluster_cert, new_rapi_cert, new_confd_hmac_key, |
|
| 92 |
new_cds, rapi_cert_pem=None, cds=None, |
|
| 91 |
def GenerateClusterCrypto(new_cluster_cert, new_rapi_cert, new_spice_cert, |
|
| 92 |
new_confd_hmac_key, new_cds, |
|
| 93 |
rapi_cert_pem=None, spice_cert_pem=None, |
|
| 94 |
spice_cacert_pem=None, cds=None, |
|
| 93 | 95 |
nodecert_file=constants.NODED_CERT_FILE, |
| 94 | 96 |
rapicert_file=constants.RAPI_CERT_FILE, |
| 97 |
spicecert_file=constants.SPICE_CERT_FILE, |
|
| 98 |
spicecacert_file=constants.SPICE_CACERT_FILE, |
|
| 95 | 99 |
hmackey_file=constants.CONFD_HMAC_KEY, |
| 96 | 100 |
cds_file=constants.CLUSTER_DOMAIN_SECRET_FILE): |
| 97 | 101 |
"""Updates the cluster certificates, keys and secrets. |
| ... | ... | |
| 100 | 104 |
@param new_cluster_cert: Whether to generate a new cluster certificate |
| 101 | 105 |
@type new_rapi_cert: bool |
| 102 | 106 |
@param new_rapi_cert: Whether to generate a new RAPI certificate |
| 107 |
@type new_spice_cert: bool |
|
| 108 |
@param new_spice_cert: Whether to generate a new SPICE certificate |
|
| 103 | 109 |
@type new_confd_hmac_key: bool |
| 104 | 110 |
@param new_confd_hmac_key: Whether to generate a new HMAC key |
| 105 | 111 |
@type new_cds: bool |
| 106 | 112 |
@param new_cds: Whether to generate a new cluster domain secret |
| 107 | 113 |
@type rapi_cert_pem: string |
| 108 | 114 |
@param rapi_cert_pem: New RAPI certificate in PEM format |
| 115 |
@type spice_cert_pem: string |
|
| 116 |
@param spice_cert_pem: New SPICE certificate in PEM format |
|
| 117 |
@type spice_cacert_pem: string |
|
| 118 |
@param spice_cacert_pem: Certificate of the CA that signed the SPICE |
|
| 119 |
certificate, in PEM format |
|
| 109 | 120 |
@type cds: string |
| 110 | 121 |
@param cds: New cluster domain secret |
| 111 | 122 |
@type nodecert_file: string |
| 112 | 123 |
@param nodecert_file: optional override of the node cert file path |
| 113 | 124 |
@type rapicert_file: string |
| 114 | 125 |
@param rapicert_file: optional override of the rapi cert file path |
| 126 |
@type spicecert_file: string |
|
| 127 |
@param spicecert_file: optional override of the spice cert file path |
|
| 128 |
@type spicecacert_file: string |
|
| 129 |
@param spicecacert_file: optional override of the spice CA cert file path |
|
| 115 | 130 |
@type hmackey_file: string |
| 116 | 131 |
@param hmackey_file: optional override of the hmac key file path |
| 117 | 132 |
|
| ... | ... | |
| 145 | 160 |
logging.debug("Generating new RAPI certificate at %s", rapicert_file)
|
| 146 | 161 |
utils.GenerateSelfSignedSslCert(rapicert_file) |
| 147 | 162 |
|
| 163 |
# SPICE |
|
| 164 |
spice_cert_exists = os.path.exists(spicecert_file) |
|
| 165 |
spice_cacert_exists = os.path.exists(spicecacert_file) |
|
| 166 |
if spice_cert_pem: |
|
| 167 |
# spice_cert_pem implies also spice_cacert_pem |
|
| 168 |
logging.debug("Writing SPICE certificate at %s", spicecert_file)
|
|
| 169 |
utils.WriteFile(spicecert_file, data=spice_cert_pem, backup=True) |
|
| 170 |
logging.debug("Writing SPICE CA certificate at %s", spicecacert_file)
|
|
| 171 |
utils.WriteFile(spicecacert_file, data=spice_cacert_pem, backup=True) |
|
| 172 |
elif new_spice_cert or not spice_cert_exists: |
|
| 173 |
if spice_cert_exists: |
|
| 174 |
utils.CreateBackup(spicecert_file) |
|
| 175 |
if spice_cacert_exists: |
|
| 176 |
utils.CreateBackup(spicecacert_file) |
|
| 177 |
|
|
| 178 |
logging.debug("Generating new self-signed SPICE certificate at %s",
|
|
| 179 |
spicecert_file) |
|
| 180 |
(_, cert_pem) = utils.GenerateSelfSignedSslCert(spicecert_file) |
|
| 181 |
|
|
| 182 |
# Self-signed certificate -> the public certificate is also the CA public |
|
| 183 |
# certificate |
|
| 184 |
logging.debug("Writing the public certificate to %s",
|
|
| 185 |
spicecert_file) |
|
| 186 |
utils.io.WriteFile(spicecacert_file, mode=0400, data=cert_pem) |
|
| 187 |
|
|
| 148 | 188 |
# Cluster domain secret |
| 149 | 189 |
if cds: |
| 150 | 190 |
logging.debug("Writing cluster domain secret to %s", cds_file)
|
| ... | ... | |
| 166 | 206 |
|
| 167 | 207 |
""" |
| 168 | 208 |
# Generate cluster secrets |
| 169 |
GenerateClusterCrypto(True, False, False, False) |
|
| 209 |
GenerateClusterCrypto(True, False, False, False, False)
|
|
| 170 | 210 |
|
| 171 | 211 |
result = utils.RunCmd([constants.DAEMON_UTIL, "start", constants.NODED]) |
| 172 | 212 |
if result.failed: |
Also available in: Unified diff