10684: Add -ca-certs option

diff --git a/sdk/go/arvadosclient/arvadosclient.go b/sdk/go/arvadosclient/arvadosclient.go
index dc3eddba6518940d0793e519b503e9a5df361e93..021b9471ff93814b81c933923e819f821efd8f1b 100644 (file)
--- a/sdk/go/arvadosclient/arvadosclient.go
+++ b/sdk/go/arvadosclient/arvadosclient.go
@@ -105,7 +105,11 @@ type ArvadosClient struct {
        Retries int
 }
 
-var CertFiles = []string{"/etc/arvados/ca-certificates.crt"}
+var CertFiles = []string{
+       "/etc/arvados/ca-certificates.crt",
+       "/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu/Gentoo etc.
+       "/etc/pki/tls/certs/ca-bundle.crt",   // Fedora/RHEL
+}
 
 // MakeTLSConfig sets up TLS configuration for communicating with Arvados and Keep services.
 func MakeTLSConfig(insecure bool) *tls.Config {
@@ -119,14 +123,14 @@ func MakeTLSConfig(insecure bool) *tls.Config {
                        if err == nil {
                                success := certs.AppendCertsFromPEM(data)
                                if !success {
-                                       fmt.Errorf("Did not load any certificates from %v", file)
+                                       fmt.Printf("Unable to load any certificates from %v", file)
                                } else {
                                        tlsconfig.RootCAs = certs
                                        break
                                }
                        }
                }
-               // Will use system default CA roots if /etc/arvados/ca-certificates.crt not found.
+               // Will use system default CA roots instead.
        }
 
        return &tlsconfig

diff --git a/sdk/go/keepclient/keepclient.go b/sdk/go/keepclient/keepclient.go
index 1df0fa3f6acf8baf8ea30319a4dfc564149501e3..79a87156a6cd829a87cd77a2ba357ce1484a4cdc 100644 (file)
--- a/sdk/go/keepclient/keepclient.go
+++ b/sdk/go/keepclient/keepclient.go
@@ -4,7 +4,6 @@ package keepclient
 import (
        "bytes"
        "crypto/md5"
-       "crypto/tls"
        "errors"
        "fmt"
        "git.curoverse.com/arvados.git/sdk/go/arvadosclient"

diff --git a/services/crunch-run/crunchrun.go b/services/crunch-run/crunchrun.go
index b14fa2c28b1b9dac146c289ef869b1f2391539ea..10b3a61c88a84a95863c22489b7a700ac3b5c6a5 100644 (file)
--- a/services/crunch-run/crunchrun.go
+++ b/services/crunch-run/crunchrun.go
@@ -912,10 +912,13 @@ func main() {
        cgroupRoot := flag.String("cgroup-root", "/sys/fs/cgroup", "path to sysfs cgroup tree")
        cgroupParent := flag.String("cgroup-parent", "docker", "name of container's parent cgroup (ignored if -cgroup-parent-subsystem is used)")
        cgroupParentSubsystem := flag.String("cgroup-parent-subsystem", "", "use current cgroup for given subsystem as parent cgroup for container")
+       caCertsPath := flag.String("ca-certs", "/etc/arvados/ca-certificates.crt", "Path to TLS root certificates")
        flag.Parse()
 
        containerId := flag.Arg(0)
 
+       arvadosclient.CertFiles = []string{*caCertsPath}
+
        api, err := arvadosclient.MakeArvadosClient()
        if err != nil {
                log.Fatalf("%s: %v", containerId, err)