Skip to content

Commit 45d749d

Browse files
authored
Fix TLS gen() func to use updated csr file: (tinkerbell#128)
## Description This fixes a regression in the docker-compose where the `TINKERBELL_HOST_IP` in the .env file wasn't showing up as a sans ip in the TLS certificate. This caused all TLS communication with the Tink server to fail with an error like: `x509: certificate is valid for 192.168.56.4, 127.0.0.1, not 192.168.2.150` This was happening because the updated csr.json file was not being used to generate the TLS certs. In this line [here](https://github.com/tinkerbell/sandbox/blob/467e0b54da44ba6657842268a75ad3b66cc35b8a/deploy/compose/generate-tls-certs/generate.sh#L16), the csr.json is updated and written to this location [here](https://github.com/tinkerbell/sandbox/blob/467e0b54da44ba6657842268a75ad3b66cc35b8a/deploy/compose/generate-tls-certs/generate.sh#L39). But this line [here](https://github.com/tinkerbell/sandbox/blob/467e0b54da44ba6657842268a75ad3b66cc35b8a/deploy/compose/generate-tls-certs/generate.sh#L30), where the TLS certs are generated, was not using this updated location. It was using this hardcoded location: `/app/csr.json`. ## Why is this needed Fixes: tinkerbell#127 ## How Has This Been Tested? ## How are existing users impacted? What migration steps/scripts do we need? The certs docker volume will need to be deleted and then re-run `docker-compose up -d` ## Checklist: I have: - [ ] updated the documentation and/or roadmap (if required) - [ ] added unit or e2e tests - [ ] provided instructions on how to upgrade
2 parents c21d11e + ce098d2 commit 45d749d

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

deploy/compose/generate-tls-certs/generate.sh

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,9 @@ gen() {
2626
local ca_crt_destination="$1"
2727
local server_crt_destination="$2"
2828
local server_key_destination="$3"
29+
local csr_file="$4"
2930
cfssl gencert -initca /app/ca-csr.json | cfssljson -bare ca -
30-
cfssl gencert -config /app/ca-config.json -ca ca.pem -ca-key ca-key.pem -profile server /app/csr.json | cfssljson -bare server
31+
cfssl gencert -config /app/ca-config.json -ca ca.pem -ca-key ca-key.pem -profile server "${csr_file}" | cfssljson -bare server
3132
mv ca.pem "${ca_crt_destination}"
3233
mv server.pem "${server_crt_destination}"
3334
mv server-key.pem "${server_key_destination}"
@@ -52,7 +53,7 @@ main() {
5253
echo "IP ${sans_ip} already in ${csr_file}"
5354
fi
5455
if [ ! -f "${ca_crt_file}" ] && [ ! -f "${server_crt_file}" ] && [ ! -f "${server_key_file}" ]; then
55-
gen "${ca_crt_file}" "${server_crt_file}" "${server_key_file}"
56+
gen "${ca_crt_file}" "${server_crt_file}" "${server_key_file}" "${csr_file}"
5657
cp "${server_crt_file}" "${bundle_crt_file}"
5758
else
5859
echo "Files [${ca_crt_file}, ${server_crt_file}, ${server_key_file}] already exist"

0 commit comments

Comments
 (0)