Run pulp container on https #73

fao89 · 2021-04-23T20:57:08Z

Related thread: https://listman.redhat.com/archives/pulp-dev/2021-April/msg00043.html

pulpbot · 2021-04-23T20:59:39Z

WARNING!!! This PR is not attached to an issue. In most cases this is not advisable. Please see our PR docs for more information about how to attach this PR to an issue.

mdellweg · 2021-04-26T08:43:40Z

assets/pulpcore-api.prep

 }
 openssl ec -in /etc/pulp/certs/token_private_key.pem -pubout -out /etc/pulp/certs/token_public_key.pem
+openssl x509 -req -in /etc/pulp/certs/pulp_webserver.csr -CA /etc/pulp/certs/ca.crt -CAkey /etc/pulp/certs/ca.key \
+    -CAcreateserial -out /etc/pulp/certs/pulp_webserver.crt


That is not how execlineb works...
You need to foreground every single command that does not support chain calling, despite the last one.

I got confused when reading about foreground, thank you for the help!

mdellweg · 2021-04-26T17:31:16Z

I believe, you need to set verify-ssl or similar to false for the curl calls.

daviddavis · 2021-04-26T17:57:20Z

This work looks great. Can I ask for a huge favor? Can we wait until after April 30 to merge this work (or at least hold off publishing the new containers until then)? The students working on the UI are using these and have their final project deadline on April 30. I don't want to mess them up.

fao89 · 2021-04-26T19:46:57Z

This work looks great. Can I ask for a huge favor? Can we wait until after April 30 to merge this work (or at least hold off publishing the new containers until then)? The students working on the UI are using these and have their final project deadline on April 30. I don't want to mess them up.

yes, this is just a POC, and it may break CI for almost every plugin. It needs to be proper advertised before merged, so people can have time to improve functional tests to deal with https

fao89 · 2021-04-26T21:01:01Z

Related thread: https://listman.redhat.com/archives/pulp-dev/2021-April/msg00043.html

mdellweg · 2021-05-04T09:05:08Z

This is a major change in the way the single container works.
Can we somehow make the switch to https optional? So we do not break every automation we have when merging this?

daviddavis · 2021-05-04T12:07:27Z

We created an https tag that @fao89 is using to test things out.

Ideally I think we'd like to get all the other tags moved over to https but this seems like a monumental undertaking when one considers all the repos, release branches, etc.

mdellweg · 2021-05-04T12:21:20Z

What about the opposite tag (http / nossl / ...), and some day, we announce the switchover of latest?
Can we make the ssl version to be a thin container layer on top of the nossl version?

fao89 · 2021-05-06T00:09:42Z

Followed: https://docs.oracle.com/cd/E52668_01/E66514/html/ceph-issues-24424028.html

mdellweg · 2021-05-07T14:48:00Z

pulp_ci_centos/SSL/Containerfile

@@ -0,0 +1,8 @@
+FROM pulp/pulp-ci-centos:latest


mdellweg · 2021-05-07T14:50:57Z

.github/workflows/publish_images.yaml

@@ -37,6 +37,13 @@ jobs:
          if [ "$VERSION" = "latest" ]; then
            docker build --file pulp_ci_centos/Containerfile --tag pulp/pulp-ci-centos:latest .
            docker build --file pulp_galaxy_ng/Containerfile --tag pulp/pulp-galaxy-ng:latest .
+            # SSL
+            docker build --file pulp_ci_centos/SSL/Containerfile --tag pulp/pulp-ci-centos:https .
+            sed -i "s/latest/https/g" pulp_galaxy_ng/Containerfile


This is changing the files checked into this repository.
May be OK in CI, but the moment we are going to write up these steps in the README, it may get weird. WDYT?

I didn't want to have a new container file just because of the tag, maybe we need to use a template

template + makefile?

So you would turn the SSL/Containerfile into a template? Would you template it on the fly? Or use the Makefile to template files we want to check into git? I really don't know what's the best way.
Another thought: We are now building the images with 3 layers of dependency. Maybe it is time to start using make to sort out the build sequence.
BTW: we could call that file pulp-ci-centos8/Containerfile.https. No one really says that it must be called Containerfile. So one nice naming schema would be <image_name>/Containerfile.<tag>. Wdyt?

I agree with everything you said, including the part: "I really don't know what's the best way"
<image_name>/Containerfile.<tag>sounds really good!

himdel · 2021-05-10T14:18:03Z

I'd like to request this feature be optional, with an option to go back to http.

We're using this for Cypress testing, and having to generate a self-signed certificate only to ignore it seems unecessary for that case, if it can be reasonably avoided :).

(context: ansible/ansible-hub-ui#378 (comment) )

[noissue]

fao89 force-pushed the https_container branch 3 times, most recently from 8591e5e to 34a0f06 Compare April 23, 2021 22:15

mdellweg reviewed Apr 26, 2021

View reviewed changes

fao89 force-pushed the https_container branch 5 times, most recently from 76dc21c to 295b8d4 Compare April 26, 2021 17:13

fao89 force-pushed the https_container branch 3 times, most recently from fe60008 to 23375b2 Compare April 26, 2021 17:55

fao89 force-pushed the https_container branch 2 times, most recently from 3c69af4 to e933527 Compare April 26, 2021 19:42

fao89 force-pushed the https_container branch from e933527 to 5a13ae0 Compare April 26, 2021 20:15

fao89 mentioned this pull request Apr 30, 2021

Cypress on GitHub Actions ansible/ansible-hub-ui#378

Merged

fao89 force-pushed the https_container branch 4 times, most recently from 291d7f7 to 58d2c19 Compare May 4, 2021 00:21

fao89 force-pushed the https_container branch 2 times, most recently from 46efe5a to 48e7e0e Compare May 6, 2021 00:08

fao89 force-pushed the https_container branch 10 times, most recently from 7a7fb19 to 0cf64fc Compare May 7, 2021 14:12

fao89 marked this pull request as ready for review May 7, 2021 14:20

mdellweg reviewed May 7, 2021

View reviewed changes

fao89 mentioned this pull request May 13, 2021

Enable https tests pulp/plugin_template#379

Merged

fao89 force-pushed the https_container branch from 0cf64fc to 804c209 Compare June 2, 2021 15:18

fao89 mentioned this pull request Jun 2, 2021

Https template #84

Closed

fao89 force-pushed the https_container branch 4 times, most recently from fb27d74 to a73a5ac Compare June 2, 2021 16:35

fao89 force-pushed the https_container branch from a73a5ac to a5c5ab1 Compare July 5, 2021 13:20

Run pulp container on https

Verified

This commit was created on github.com and signed with GitHub’s verified signature. The key has expired.

GPG key ID: 4AEE18F83AFDEB23
Expired

Verified
Learn about vigilant mode

6eeb819

[noissue]

fao89 force-pushed the https_container branch from a5c5ab1 to 6eeb819 Compare July 5, 2021 13:37

fao89 closed this Jul 14, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Run pulp container on https #73

Run pulp container on https #73

fao89 commented Apr 23, 2021 •

edited

Loading

pulpbot commented Apr 23, 2021

mdellweg Apr 26, 2021

fao89 Apr 26, 2021

mdellweg commented Apr 26, 2021

daviddavis commented Apr 26, 2021

fao89 commented Apr 26, 2021

fao89 commented Apr 26, 2021

mdellweg commented May 4, 2021

daviddavis commented May 4, 2021

mdellweg commented May 4, 2021

fao89 commented May 6, 2021

mdellweg May 7, 2021

mdellweg May 7, 2021

fao89 May 10, 2021

fao89 May 10, 2021

mdellweg May 11, 2021

fao89 May 11, 2021

himdel commented May 10, 2021 •

edited

Loading

Run pulp container on https #73

Run pulp container on https #73

Conversation

fao89 commented Apr 23, 2021 • edited Loading

pulpbot commented Apr 23, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mdellweg commented Apr 26, 2021

daviddavis commented Apr 26, 2021

fao89 commented Apr 26, 2021

fao89 commented Apr 26, 2021

mdellweg commented May 4, 2021

daviddavis commented May 4, 2021

mdellweg commented May 4, 2021

fao89 commented May 6, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

himdel commented May 10, 2021 • edited Loading

fao89 commented Apr 23, 2021 •

edited

Loading

himdel commented May 10, 2021 •

edited

Loading