fix(provision): Add a CA and sign certificates with it

refs #17177

As discussed [here](https://forum.arvados.org/t/debugging-arvados-deployed-with-salt/58/8)
and [here](https://gitter.im/arvados/community?at=5fc65683496ca3372e3474a3), Arvados needs
certs signed by a known CA to work correctly.

This PR adds a CA and leaves a copy of the certificate in the installer directory.

Arvados-DCO-1.1-Signed-off-by: Javier Bértoli <jbertoli@curii.com>

diff --git a/tools/salt-install/Vagrantfile b/tools/salt-install/Vagrantfile
index ed3466ddebd81182540b234d63bbd221efd4b8e9..1f587296b25e981a080c70f510861359b87cbd54 100644 (file)
--- a/tools/salt-install/Vagrantfile
+++ b/tools/salt-install/Vagrantfile
@@ -33,6 +33,7 @@ Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
     arv.vm.provision "shell",
                      path: "provision.sh",
                      args: [
+                       "--debug",
                        "--test",
                        "--vagrant",
                        "--ssl-port=8443"

diff --git a/tools/salt-install/provision.sh b/tools/salt-install/provision.sh
index a207d019875a7b43bc2dfed1e116f4a9410ab1a5..9aa5f19b123eb2894d275e1b05e3a78890dd2c15 100755 (executable)
--- a/tools/salt-install/provision.sh
+++ b/tools/salt-install/provision.sh
@@ -1,4 +1,4 @@
-#!/bin/bash 
+#!/bin/bash -x
 
 # Copyright (C) The Arvados Authors. All rights reserved.
 #
@@ -139,7 +139,7 @@ file_roots:
   base:
     - ${S_DIR}
     - ${F_DIR}/*
-    - ${F_DIR}/*/test/salt/states
+    - ${F_DIR}/*/test/salt/states/examples
 
 pillar_roots:
   base:
@@ -154,8 +154,8 @@ mkdir -p ${P_DIR}
 cat > ${S_DIR}/top.sls << EOFTSLS
 base:
   '*':
-    - example_single_host_host_entries
-    - example_add_snakeoil_certs
+    - single_host.host_entries
+    - single_host.snakeoil_certs
     - locale
     - nginx.passenger
     - postgres
@@ -182,7 +182,6 @@ base:
     - postgresql
 EOFPSLS
 
-
 # Get the formula and dependencies
 cd ${F_DIR} || exit 1
 for f in postgres arvados nginx docker locale; do
@@ -258,9 +257,16 @@ if [ "x${RESTORE_PSQL}" = "xyes" ]; then
 fi
 # END FIXME! #16992 Temporary fix for psql call in arvados-api-server
 
-# If running in a vagrant VM, add default user to docker group
+# Leave a copy of the Arvados CA so the user can copy it where it's required
+echo "Copying the Arvados CA file to the installer dir, so you can import it"
+# If running in a vagrant VM, also add default user to docker group
 if [ "x${VAGRANT}" = "xyes" ]; then
-  usermod -a -G docker vagrant 
+  cp /etc/ssl/certs/arvados-snakeoil-ca.pem /vagrant
+
+  echo "Adding the vagrant user to the docker group"
+  usermod -a -G docker vagrant
+else
+  cp /etc/ssl/certs/arvados-snakeoil-ca.pem ${SCRIPT_DIR}
 fi
 
 # Test that the installation finished correctly

diff --git a/tools/salt-install/single_host/arvados.sls b/tools/salt-install/single_host/arvados.sls
index dffd6575e02dc768daa7696e4a4eb94ee2146036..a06244270c237150f159220fffaab4de1a9f2f19 100644 (file)
--- a/tools/salt-install/single_host/arvados.sls
+++ b/tools/salt-install/single_host/arvados.sls
@@ -73,7 +73,7 @@ arvados:
     tls:
       # certificate: ''
       # key: ''
-      # required to test with snakeoil certs
+      # required to test with arvados-snakeoil certs
       insecure: true
 
     ### TOKENS

diff --git a/tools/salt-install/single_host/nginx_controller_configuration.sls b/tools/salt-install/single_host/nginx_controller_configuration.sls
index 7c99d2dea7538e042321b1f78b1811cb8224723b..96fc383d77ece468dea8cdce15dd7ff8b0611758 100644 (file)
--- a/tools/salt-install/single_host/nginx_controller_configuration.sls
+++ b/tools/salt-install/single_host/nginx_controller_configuration.sls
@@ -53,7 +53,7 @@ nginx:
               - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
               - proxy_set_header: 'X-External-Client $external_client'
             # - include: 'snippets/letsencrypt.conf'
-            - include: 'snippets/snakeoil.conf'
+            - include: 'snippets/arvados-snakeoil.conf'
             - access_log: /var/log/nginx/__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/__CLUSTER__.__DOMAIN__.error.log
             - client_max_body_size: 128m

diff --git a/tools/salt-install/single_host/nginx_keepproxy_configuration.sls b/tools/salt-install/single_host/nginx_keepproxy_configuration.sls
index fc4854e5a8d35fad8cabb628f3383a5a4f65dc83..61c1384741bbe9565085d1f04d90f3b28fdf1d89 100644 (file)
--- a/tools/salt-install/single_host/nginx_keepproxy_configuration.sls
+++ b/tools/salt-install/single_host/nginx_keepproxy_configuration.sls
@@ -53,6 +53,6 @@ nginx:
             - proxy_http_version: '1.1'
             - proxy_request_buffering: 'off'
             # - include: 'snippets/letsencrypt.conf'
-            - include: 'snippets/snakeoil.conf'
+            - include: 'snippets/arvados-snakeoil.conf'
             - access_log: /var/log/nginx/keepproxy.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/keepproxy.__CLUSTER__.__DOMAIN__.error.log

diff --git a/tools/salt-install/single_host/nginx_keepweb_configuration.sls b/tools/salt-install/single_host/nginx_keepweb_configuration.sls
index 513c0393e0e98b2f9f48634527d083c1e415b1a3..88083e3c506c71bd92e0c49aab1b73b2711269ec 100644 (file)
--- a/tools/salt-install/single_host/nginx_keepweb_configuration.sls
+++ b/tools/salt-install/single_host/nginx_keepweb_configuration.sls
@@ -53,6 +53,6 @@ nginx:
             - proxy_http_version: '1.1'
             - proxy_request_buffering: 'off'
             # - include: 'snippets/letsencrypt.conf'
-            - include: 'snippets/snakeoil.conf'
+            - include: 'snippets/arvados-snakeoil.conf'
             - access_log: /var/log/nginx/collections.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/collections.__CLUSTER__.__DOMAIN__.error.log

diff --git a/tools/salt-install/single_host/nginx_webshell_configuration.sls b/tools/salt-install/single_host/nginx_webshell_configuration.sls
index 495de82d235e2bebb511b56e559110f16b4573c5..80e9f57d6b329fc10a2b7b41908c8d5eaac29535 100644 (file)
--- a/tools/salt-install/single_host/nginx_webshell_configuration.sls
+++ b/tools/salt-install/single_host/nginx_webshell_configuration.sls
@@ -69,7 +69,7 @@ nginx:
                 - add_header: "'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'"
 
             # - include: 'snippets/letsencrypt.conf'
-            - include: 'snippets/snakeoil.conf'
+            - include: 'snippets/arvados-snakeoil.conf'
             - access_log: /var/log/nginx/webshell.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/webshell.__CLUSTER__.__DOMAIN__.error.log
 

diff --git a/tools/salt-install/single_host/nginx_websocket_configuration.sls b/tools/salt-install/single_host/nginx_websocket_configuration.sls
index 1848a8737ea0fb8e10ff9c884ac87111b2a17b42..60d757f89424248b5684e1f9c9aaaba5aa1adfaf 100644 (file)
--- a/tools/salt-install/single_host/nginx_websocket_configuration.sls
+++ b/tools/salt-install/single_host/nginx_websocket_configuration.sls
@@ -54,6 +54,6 @@ nginx:
             - proxy_http_version: '1.1'
             - proxy_request_buffering: 'off'
             # - include: 'snippets/letsencrypt.conf'
-            - include: 'snippets/snakeoil.conf'
+            - include: 'snippets/arvados-snakeoil.conf'
             - access_log: /var/log/nginx/ws.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/ws.__CLUSTER__.__DOMAIN__.error.log

diff --git a/tools/salt-install/single_host/nginx_workbench2_configuration.sls b/tools/salt-install/single_host/nginx_workbench2_configuration.sls
index 733397adf31556f70c0a47415a2649bb01c441da..4a0190ad187a0f3ae9e7f9dc70abfc768f6da8db 100644 (file)
--- a/tools/salt-install/single_host/nginx_workbench2_configuration.sls
+++ b/tools/salt-install/single_host/nginx_workbench2_configuration.sls
@@ -44,6 +44,6 @@ nginx:
             - location /config.json:
               - return: {{ "200 '" ~ '{"API_HOST":"__CLUSTER__.__DOMAIN__"}' ~ "'" }}
             # - include: 'snippets/letsencrypt.conf'
-            - include: 'snippets/snakeoil.conf'
+            - include: 'snippets/arvados-snakeoil.conf'
             - access_log: /var/log/nginx/workbench2.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/workbench2.__CLUSTER__.__DOMAIN__.error.log

diff --git a/tools/salt-install/single_host/nginx_workbench_configuration.sls b/tools/salt-install/single_host/nginx_workbench_configuration.sls
index 9a382e777cc4dbf81f2834b63816c495977c64f2..6a17ee74597397e41f7a67373f236a78ec76be4b 100644 (file)
--- a/tools/salt-install/single_host/nginx_workbench_configuration.sls
+++ b/tools/salt-install/single_host/nginx_workbench_configuration.sls
@@ -55,7 +55,7 @@ nginx:
               - proxy_set_header: 'X-Real-IP $remote_addr'
               - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
             # - include: 'snippets/letsencrypt.conf'
-            - include: 'snippets/snakeoil.conf'
+            - include: 'snippets/arvados-snakeoil.conf'
             - access_log: /var/log/nginx/workbench.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/workbench.__CLUSTER__.__DOMAIN__.error.log
 

diff --git a/tools/salt-install/tests/run-test.sh b/tools/salt-install/tests/run-test.sh
index cf61d92b5db2d594e748cc8eee4db9f79b237b3a..8d9de6fdf0b12e338208fa8ba2fcd89b5b995139 100755 (executable)
--- a/tools/salt-install/tests/run-test.sh
+++ b/tools/salt-install/tests/run-test.sh
@@ -7,6 +7,15 @@ export ARVADOS_API_TOKEN=changemesystemroottoken
 export ARVADOS_API_HOST=__CLUSTER__.__DOMAIN__:__HOST_SSL_PORT__
 export ARVADOS_API_HOST_INSECURE=true
 
+set -o pipefail
+
+# First, validate that the CA is installed and that we can query it with no errors.
+if ! curl -s -o /dev/null https://workbench.${ARVADOS_API_HOST}/users/welcome?return_to=%2F; then
+  echo "The Arvados CA was not correctly installed. Although some components will work,"
+  echo "others won't. Please verify that the CA cert file was installed correctly and"
+  echo "retry running these tests."
+  exit 1
+fi
 
 # https://doc.arvados.org/v2.0/install/install-jobs-image.html
 echo "Creating Arvados Standard Docker Images project"