8815: Now expect /usr/local/bin/crunchrunner. Bind mount host certificates to

/etc/arvados/ca-certificates.crt

diff --git a/crunch_scripts/crunchrunner b/crunch_scripts/crunchrunner
index f192c48772dd545c7a2f9201b612fed9c65c7cdc..02b00e44896db0eb76922a2885847bafbcd7f9b6 100755 (executable)
--- a/crunch_scripts/crunchrunner
+++ b/crunch_scripts/crunchrunner
@@ -1,2 +1,2 @@
 #!/bin/sh
-exec /usr/lib/crunchrunner/crunchrunner
+exec /usr/local/bin/crunchrunner

diff --git a/sdk/cli/bin/crunch-job b/sdk/cli/bin/crunch-job
index 88f9d561b46c41b4f31ea2efc1cfc225869e453b..82e8ef73230d9b16893838d9c8c27bbbce4859c8 100755 (executable)
--- a/sdk/cli/bin/crunch-job
+++ b/sdk/cli/bin/crunch-job
@@ -110,7 +110,12 @@ unless (defined $ENV{"CRUNCH_TMP"}) {
 }
 
 $ENV{"HOST_CRUNCHRUNNER_BIN"} ||= `which crunchrunner`;
-$ENV{"HOST_CERTS"} ||= "/etc/ssl/certs/ca-certificates.crt";
+unless (defined($ENV{"HOST_CERTS"}) {
+  if (-f "/etc/ssl/certs/ca-certificates.crt") {
+    $ENV{"HOST_CERTS"} = "/etc/ssl/certs/ca-certificates.crt";
+  } else if (-f "/etc/pki/tls/certs/ca-bundle.crt") {
+    $ENV{"HOST_CERTS"} = "/etc/pki/tls/certs/ca-bundle.crt";
+}
 
 # Create the tmp directory if it does not exist
 if ( ! -d $ENV{"CRUNCH_TMP"} ) {
@@ -922,8 +927,8 @@ for (my $todo_ptr = 0; $todo_ptr <= $#jobstep_todo; $todo_ptr ++)
 
       # Bind mount the crunchrunner binary and host TLS certificates file into
       # the container.
-      $command .= "--volume=\Q$ENV{HOST_CRUNCHRUNNER_BIN}:/usr/lib/crunchrunner/crunchrunner\E ";
-      $command .= "--volume=\Q$ENV{HOST_CERTS}:/usr/lib/crunchrunner/ca-certificates.crt\E ";
+      $command .= "--volume=\Q$ENV{HOST_CRUNCHRUNNER_BIN}:/usr/local/bin/crunchrunner\E ";
+      $command .= "--volume=\Q$ENV{HOST_CERTS}:/etc/arvados/ca-certificates.crt\E ";
 
       while (my ($env_key, $env_val) = each %ENV)
       {

diff --git a/sdk/go/crunchrunner/crunchrunner.go b/sdk/go/crunchrunner/crunchrunner.go
index 7d09a5d240ef74466e65ed2e64235e85051ed2e9..de63a20745e22c058eddb3c482d34c88a43252be 100644 (file)
--- a/sdk/go/crunchrunner/crunchrunner.go
+++ b/sdk/go/crunchrunner/crunchrunner.go
@@ -327,14 +327,23 @@ func main() {
                log.Fatal(err)
        }
 
-       certpath := path.Join(path.Dir(os.Args[0]), "ca-certificates.crt")
-       certdata, err := ioutil.ReadFile(certpath)
-       if err == nil {
-               log.Printf("Using TLS certificates at %v", certpath)
-               certs := x509.NewCertPool()
-               certs.AppendCertsFromPEM(certdata)
-               api.Client.Transport.(*http.Transport).TLSClientConfig.RootCAs = certs
+       // Container may not have certificates installed, so need to look for
+       // /etc/arvados/ca-certificates.crt in addition to normal system certs.
+       var certFiles = []string{
+               "/etc/ssl/certs/ca-certificates.crt", // Debian
+               "/etc/pki/tls/certs/ca-bundle.crt",   // Red Hat
+               "/etc/arvados/ca-certificates.crt",
+       }
+
+       certs := x509.NewCertPool()
+       for _, file := range certFiles {
+               data, err := ioutil.ReadFile(file)
+               if err == nil {
+                       log.Printf("Using TLS certificates at %v", file)
+                       certs.AppendCertsFromPEM(data)
+               }
        }
+       api.Client.Transport.(*http.Transport).TLSClientConfig.RootCAs = certs
 
        jobUuid := os.Getenv("JOB_UUID")
        taskUuid := os.Getenv("TASK_UUID")