Pulp

Note that this probably applies to several subpackages and needs to be fixed in our spec files as well as Fedora's spec files after the keys are generated as part of the first-time setup.

As suggested, I considered the initial-service-setup [1] recommendation but the generated key pair and certificates are required by the pulp code running in httpd. So, there is no pulp service (systemd unit or upstart script) that can be used to hook this into service startup.

The proposal:¶

1. Move the RSA key pair generation script code out of pulp.spec into a new script named: pulp-gen-key-pair.
2. Remove call to pulp-gen-ca-certificate from pulp.spec.
3. Add new script named: pulp-setup that calls:

• pulp-gen-key-pair
• pulp-gen-ca-certificate
• pulp-mange-db

and update installation documentation to run pulp-setup instead of pulp-manage-db.

4. Leave upgrade documentation referencing pulp-manage-db unchanged.

5. Ensure both pulp-gen-key-pair and pulp-gen-ca-certificate scripts are idempotent. When the generated files exist, they print an appropriate message and exit.

6. Ignore the pulp-gen-nodes-certificate that is called when nodes is installed by the RPM since Sat 6.2 no longer uses nodes and it has been deprecated upstream.

Questions:

1. Thinking of clustered pulp installations - is calling pulp-manage-db by pulp-setup still appropriate?

2. Better ideas?

[1] https://fedoraproject.org/wiki/Packaging:Initial_Service_Setup

I really like this write up, thanks @jortel.

I like the idea of pulp-setup, but if all it does is call those 3 scripts I think having the user just call them one after another manually will be fine. My thinking is that it's not doing much at all and the user will get some understanding about pulp-manage-db that will be useful to them at upgrade time. -0 to keeping pulp-set.

Even though nodes is deprecated, I don't think we can knowingly break it until it is removed. To handle that aspect, consider adding documentation to the nodes setup indicating when and where they should call pulp-gen-nodes-certificate. That would be straightforward to do I think.

+1 to pulp-gen-key-pair and pulp-gen-ca-certificate scripts be idempotent and when the generated files exist, they print an appropriate message and exit.

For a clustered install which of these 3 scripts (pulp-gen-key-pair, pulp-gen-ca-certificate, pulp-mange-db) needs to run on all nodes, and which needs to run exactly once?

Also, we should consider having someone from product security review this PR

Thanks for the comments, bmbouter.

bmbouter wrote:

Even though nodes is deprecated, I don't think we can knowingly break it until it is removed. To handle that aspect, consider adding documentation to the nodes setup indicating when and where they should call pulp-gen-nodes-certificate. That would be straightforward to do I think.

Agreed. Good suggestion.

I was not planning to break nodes .. just ignore it (and the problem) by leaving the pulp-gen-node-cert in the pulp.spec. But, I like your idea better :)

For a clustered install which of these 3 scripts (pulp-gen-key-pair, pulp-gen-ca-certificate, pulp-mange-db) needs to run on all nodes, and which needs to run exactly once?

It's my understanding that pulp-manage-db would only be run once for the cluster and pulp-gen-key-pair and pulp-gen-ca-certificate would be run on each node. Is this correct?