mgr/cephadm: Changes for creating root cert with manager cluster fsid

Signed-off-by: Anuradha Gadge <anuradha.gadge@ibm.com>

diff --git a/src/pybind/mgr/cephadm/cert_mgr.py b/src/pybind/mgr/cephadm/cert_mgr.py
index 0c56c7047882c9ba568d738cbed3f8264068535b..3744f7491a588509035bc57d1472dd484dcdf52f 100644 (file)
--- a/src/pybind/mgr/cephadm/cert_mgr.py
+++ b/src/pybind/mgr/cephadm/cert_mgr.py
@@ -12,7 +12,7 @@ class CertMgr:
     CEPHADM_ROOT_CA_KEY = 'cephadm_root_ca_key'
 
     def __init__(self, mgr: "CephadmOrchestrator", ip: str) -> None:
-        self.ssl_certs: SSLCerts = SSLCerts()
+        self.ssl_certs: SSLCerts = SSLCerts(mgr._cluster_fsid)
         old_cert = mgr.cert_key_store.get_cert(self.CEPHADM_ROOT_CA_CERT)
         old_key = mgr.cert_key_store.get_key(self.CEPHADM_ROOT_CA_KEY)
         if old_key and old_cert:

diff --git a/src/pybind/mgr/cephadm/ssl_cert_utils.py b/src/pybind/mgr/cephadm/ssl_cert_utils.py
index 467b32a4df040df022bdcde2c9797752142cd8c4..a8f2d32ed66b826c295ab5f9cac57dd2330052c5 100644 (file)
--- a/src/pybind/mgr/cephadm/ssl_cert_utils.py
+++ b/src/pybind/mgr/cephadm/ssl_cert_utils.py
@@ -15,11 +15,12 @@ class SSLConfigException(Exception):
 
 
 class SSLCerts:
-    def __init__(self) -> None:
+    def __init__(self, fsid: str) -> None:
         self.root_cert: Any
         self.root_key: Any
         self.key_file: IO[bytes]
         self.cert_file: IO[bytes]
+        self.cluster_fsid: str = fsid
 
     def generate_root_cert(
         self,
@@ -42,6 +43,7 @@ class SSLCerts:
         root_builder = root_builder.public_key(root_public_key)
 
         san_list: List[x509.GeneralName] = []
+        san_list.append(x509.DNSName(f'fsid-{self.cluster_fsid}'))
         if addr:
             san_list.extend([x509.IPAddress(ipaddress.ip_address(addr))])
         if custom_san_list:

diff --git a/src/pybind/mgr/cephadm/tests/test_node_proxy.py b/src/pybind/mgr/cephadm/tests/test_node_proxy.py
index 6f4ca6be1b565750bfd2cba74808ee5ee26ad1ed..dd5f99f508c27566fdd2ace91dd500186a1ef574 100644 (file)
--- a/src/pybind/mgr/cephadm/tests/test_node_proxy.py
+++ b/src/pybind/mgr/cephadm/tests/test_node_proxy.py
@@ -36,7 +36,7 @@ class FakeMgr:
         self.node_proxy = MagicMock()
         self.http_server = MagicMock()
         self.http_server.agent = MagicMock()
-        self.http_server.agent.ssl_certs = SSLCerts()
+        self.http_server.agent.ssl_certs = SSLCerts("59d1b32e-xxxx-11ef-xxxx-52540060267a")
         self.http_server.agent.ssl_certs.generate_root_cert(addr=self.get_mgr_ip())
         self.cert_mgr = FakeCertMgr()