[2-EL9] Fix update-ca-trust error - p11-kit: couldn't make directory writable

[bdunne]

TODO:

• Test in an env with SSL between pods
• Double check ownership and permissions on the /etc/pki directories after the mv

Helpful discussion in https://bugzilla.redhat.com/show_bug.cgi?id=2241240

CP4AIOPS-11300

New startup logs:

$ oc logs -f httpd-84c96f9985-bj6tp
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.254.20.246. Set the 'ServerName' directive globally to suppress this message
[Wed Feb 26 23:20:51.265974 2025] [ssl:warn] [pid 1:tid 1] AH01909: %{REQUEST_HOST}:443:0 server certificate does NOT include an ID which matches the server name
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.254.20.246. Set the 'ServerName' directive globally to suppress this message
[Wed Feb 26 23:20:51.284887 2025] [ssl:warn] [pid 1:tid 1] AH01873: Init: Session Cache is not configured [hint: SSLSessionCache]
[Wed Feb 26 23:20:51.285541 2025] [ssl:warn] [pid 1:tid 1] AH01909: %{REQUEST_HOST}:443:0 server certificate does NOT include an ID which matches the server name
[Wed Feb 26 23:20:51.286239 2025] [lbmethod_heartbeat:notice] [pid 1:tid 1] AH02282: No slotmem from mod_heartmonitor
[Wed Feb 26 23:20:51.293035 2025] [mpm_event:notice] [pid 1:tid 1] AH00489: Apache/2.4.62 (Red Hat Enterprise Linux) OpenSSL/3.2.2 configured -- resuming normal operations
[Wed Feb 26 23:20:51.293056 2025] [core:notice] [pid 1:tid 1] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND -E /dev/stderr'

[Fryguy]

Do you need to chmod anything after copying it over?

[bdunne]

I don't think so. After this, we don't try to write anything in /etc/pki.

[Fryguy]

I was more thinking that whatever serves/uses the cert might need the certs to be a particular way (kind of like how things in ~/.ssh need specific perms set)

[bdunne]

Oh, I'll double check the ownership, but the script appears to set the correct permissions on the directories. (That's why we're getting the error that prevents us from running it in the first place 😄 )

[bdunne]

The ownership is our_uid:root, but the file and directory permissions are correct.

[miq-bot]

Checked commit bdunne@e0485ee with ruby 3.1.5, rubocop 1.56.3, haml-lint 0.51.0, and yamllint
0 files checked, 0 offenses detected
Everything looks fine. 🏆