feat(rpm): replace init-pki.sh with openshell-gateway generate-certs#1258
Draft
TaylorMutch wants to merge 3 commits intomainfrom
Draft
feat(rpm): replace init-pki.sh with openshell-gateway generate-certs#1258TaylorMutch wants to merge 3 commits intomainfrom
TaylorMutch wants to merge 3 commits intomainfrom
Conversation
Introduce `openshell-gateway generate-certs` modeled on envoyproxy/gateway's certgen pattern. The Helm pre-install/pre-upgrade hook now runs the gateway image instead of an alpine + openssl shell job — one image to mirror in air-gapped environments, one PKI implementation, real test coverage. Reuses `openshell_bootstrap::pki::generate_pki` for CA/server/client cert generation. Idempotency contract preserved: both Secrets exist → skip; one exists → fail with `kubectl delete` recovery hint; neither exists → POST both `kubernetes.io/tls` Secrets. The server CLI gains optional subcommand support: bare `openshell-gateway` still runs the gateway, `generate-certs` runs the new path. `--db-url` moved from clap-required to call-site validated to avoid the clap flatten + required-field landmine.
Presence of `--output-dir <DIR>` switches the subcommand from Kubernetes
Secret writes to filesystem writes, making the kube flags optional.
Local layout matches `deploy/rpm/init-pki.sh` exactly:
<dir>/{ca.crt, ca.key, server/tls.{crt,key}, client/tls.{crt,key}}
Stages writes to a sibling `<dir>.certgen.tmp` and renames into place for
atomic per-file installation. Sets 0o700 on directories and 0o600 on key
files. Reuses `openshell_bootstrap::mtls::store_pki_bundle` to populate
the CLI auto-discovery directory at $XDG_CONFIG_HOME/openshell/gateways/
openshell/mtls/, mirroring init-pki.sh's local-CLI UX.
Same idempotency contract as the Kubernetes path: all six files present →
skip (and self-heal the CLI mTLS copy if missing); partial → fail with a
recovery hint; nothing → generate and write.
Sets up the seam for a follow-up PR that swaps init-pki.sh for the Rust
command in the systemd unit. The shell script and unit are untouched here.
Cuts the RPM gateway over to the unified Rust certgen path. The systemd
user unit's first ExecStartPre now invokes:
/usr/bin/openshell-gateway generate-certs --output-dir %S/openshell/tls
producing the same six-PEM layout init-pki.sh built (ca.{crt,key},
server/tls.{crt,key}, client/tls.{crt,key}) and the same CLI mTLS copy
under $XDG_CONFIG_HOME/openshell/gateways/openshell/mtls/. None of the
OPENSHELL_TLS_* / OPENSHELL_PODMAN_TLS_* paths in the unit change.
Adds host.containers.internal to the gateway's built-in SAN list so
podman containers reaching their host validate cleanly with no
per-deployment --server-san flag. Docker (host.docker.internal) and
Kubernetes (cluster.local DNS) were already covered.
Drops 197 lines of openssl shell, the install/file lines for the script
itself, and updates the docs (man page, RPM CONFIGURATION.md, env-file
generator comment) to point at the new entrypoint. The %S state dir,
unit security hardening, and consumer paths are untouched.
TaylorMutch
force-pushed
the
tmutch/rpm-certgen-cutover
branch
from
bea306f to
6c7d354
Compare
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RPM cutover: the gateway systemd user unit's
ExecStartPrenow invokesopenshell-gateway generate-certs --output-dir %S/openshell/tlsinstead of the 197-linedeploy/rpm/init-pki.shopenssl wrapper. One PKI implementation, one file layout, real test coverage.Changes
openshell.spec):ExecStartPre=/usr/bin/openshell-gateway generate-certs --output-dir %S/openshell/tls(wasinit-pki.sh %S/openshell/tls).install -pm 0755 deploy/rpm/init-pki.sh ...line and the matching%files gatewayentry.deploy/rpm/init-pki.shdeleted (-197 lines).pki.rs::DEFAULT_SERVER_SANSgainshost.containers.internalso podman parity is built-in. Docker (host.docker.internal) and Kubernetes (cluster.local DNS) were already covered. The RPM systemd unit needs no extra--server-sanflag; k8s Helm chart also picks it up automatically.deploy/man/openshell-gateway.8.md), RPMCONFIGURATION.md, and the comment ininit-gateway-env.shall point at the new entrypoint.The output paths, file modes, and CLI auto-discovery copy are byte-for-byte identical to what
init-pki.shproduced — everyOPENSHELL_TLS_*/OPENSHELL_PODMAN_TLS_*path in the unit stays valid without edits.Testing
Local binary smoke
$ openshell-gateway generate-certs --output-dir /tmp/test/state/openshell/tls INFO openshell_server::certgen: PKI files created. dir=/tmp/test/state/openshell/tls $ ls -la /tmp/test/state/openshell/tls/{ca.crt,ca.key,server,client}/... -rw-r--r-- ca.crt -rw------- ca.key -rw-r--r-- server/tls.crt -rw------- server/tls.key -rw-r--r-- client/tls.crt -rw------- client/tls.key $ openssl x509 -in tls/server/tls.crt -noout -ext subjectAltName DNS:openshell, DNS:openshell.openshell.svc, DNS:openshell.openshell.svc.cluster.local, DNS:localhost, DNS:host.docker.internal, DNS:host.containers.internal, IP Address:127.0.0.1 $ openshell-gateway generate-certs --output-dir /tmp/test/state/openshell/tls INFO openshell_server::certgen: PKI files already exist, skipping.Helm cluster regression check
Deleted both Secrets, redeployed via Skaffold, confirmed:
kubernetes.io/tlsSecrets created with 3 keys each, chain verifies viaopenssl verify.host.containers.internalalongside the existing 6 — no duplicates.Pre-commit
mise run pre-commitpasses (clippy-D warnings, fmt, markdownlint, tests).pki.rs::tests::build_server_sans_includes_defaults_and_extrascontinues to pass — usesDEFAULT_SERVER_SANS.len(), auto-adapts.What this PR does not test locally
ExecStartPreexecution on a real Fedora host. Plan: install the COPR-built RPM in a Fedora VM (orpodman run --systemd=always fedora) and runsystemctl --user enable --now openshell-gateway.service, then verify the 6 PEMs land under~/.local/state/openshell/tls/.Checklist
architecture/gateway.mdalready describes both modes from feat(server): add generate-certs subcommand; replace alpine PKI hook #1257)CONFIGURATION.mdupdated