8815: Now expect /usr/local/bin/crunchrunner. Bind mount host certificates to

[arvados.git] / sdk / go / crunchrunner / crunchrunner.go

diff --git a/sdk/go/crunchrunner/crunchrunner.go b/sdk/go/crunchrunner/crunchrunner.go
index 8e24e18fda845866909aff7f6bba1bd02234d53c..de63a20745e22c058eddb3c482d34c88a43252be 100644 (file)
--- a/sdk/go/crunchrunner/crunchrunner.go
+++ b/sdk/go/crunchrunner/crunchrunner.go
@@ -1,13 +1,17 @@
 package main
 
 import (
+       "crypto/x509"
        "fmt"
        "git.curoverse.com/arvados.git/sdk/go/arvadosclient"
        "git.curoverse.com/arvados.git/sdk/go/keepclient"
+       "io/ioutil"
        "log"
+       "net/http"
        "os"
        "os/exec"
        "os/signal"
+       "path"
        "strings"
        "syscall"
 )
@@ -113,6 +117,8 @@ func setupCommand(cmd *exec.Cmd, taskp TaskDef, outdir string, replacements map[
                cmd.Stdout = os.Stdout
        }
 
+       cmd.Stderr = os.Stderr
+
        if taskp.Env != nil {
                // Set up subprocess environment
                cmd.Env = os.Environ()
@@ -209,6 +215,10 @@ func runner(api IArvadosClient,
                "$(task.outdir)": outdir,
                "$(task.keep)":   keepmount}
 
+       log.Printf("crunchrunner: $(task.tmpdir)=%v", tmpdir)
+       log.Printf("crunchrunner: $(task.outdir)=%v", outdir)
+       log.Printf("crunchrunner: $(task.keep)=%v", keepmount)
+
        // Set up subprocess
        for k, v := range taskp.Command {
                taskp.Command[k] = substitute(v, replacements)
@@ -317,6 +327,24 @@ func main() {
                log.Fatal(err)
        }
 
+       // Container may not have certificates installed, so need to look for
+       // /etc/arvados/ca-certificates.crt in addition to normal system certs.
+       var certFiles = []string{
+               "/etc/ssl/certs/ca-certificates.crt", // Debian
+               "/etc/pki/tls/certs/ca-bundle.crt",   // Red Hat
+               "/etc/arvados/ca-certificates.crt",
+       }
+
+       certs := x509.NewCertPool()
+       for _, file := range certFiles {
+               data, err := ioutil.ReadFile(file)
+               if err == nil {
+                       log.Printf("Using TLS certificates at %v", file)
+                       certs.AppendCertsFromPEM(data)
+               }
+       }
+       api.Client.Transport.(*http.Transport).TLSClientConfig.RootCAs = certs
+
        jobUuid := os.Getenv("JOB_UUID")
        taskUuid := os.Getenv("TASK_UUID")
        tmpdir := os.Getenv("TASK_WORK")