PR#287: Freeze Break Request: Update openshift ssl certs - fedora-infra/ansible

fedora-infra / ansible

#287 Freeze Break Request: Update openshift ssl certs

Merged 3 years ago by kevin. Opened 3 years ago by kevin.

Unknown source fix-openshift-certs into master

Freeze Break Request: Update openshift ssl certs

Kevin Fenzi • 3 years ago

150f53e

inventory/group_vars/all

file modified

+4 -4

		`@@ -254,10 +254,10 @@`
		`wildcard_int_file: wildcard-2020.fedoraproject.org.intermediate.cert`

		`# This is the openshift wildcard cert. Until it exists set it equal to wildcard`
		`- os_wildcard_cert_name: wildcard-2017.app.os.fedoraproject.org`
		`- os_wildcard_crt_file: wildcard-2017.app.os.fedoraproject.org.cert`
		`- os_wildcard_key_file: wildcard-2017.app.os.fedoraproject.org.key`
		`- os_wildcard_int_file: wildcard-2017.app.os.fedoraproject.org.intermediate.cert`
		`+ os_wildcard_cert_name: wildcard-2020.app.os.fedoraproject.org`
		`+ os_wildcard_crt_file: wildcard-2020.app.os.fedoraproject.org.cert`
		`+ os_wildcard_key_file: wildcard-2020.app.os.fedoraproject.org.key`
		`+ os_wildcard_int_file: wildcard-2020.app.os.fedoraproject.org.intermediate.cert`

		`# Everywhere, always, we should sign messages and validate signatures.`
		`# However, we allow individual hosts and groups to override this. Use this very`

playbooks/include/proxies-certificates.yml

file modified

+2 -2

		`@@ -36,8 +36,8 @@`
		`- app.os.fedoraproject.org`

		`- role: httpd/certificate`
		`- certname: wildcard-2017.app.os.fedoraproject.org`
		`- SSLCertificateChainFile: wildcard-2017.app.os.fedoraproject.org.intermediate.cert`
		`+ certname: wildcard-2020.app.os.fedoraproject.org`
		`+ SSLCertificateChainFile: wildcard-2020.app.os.fedoraproject.org.intermediate.cert`
		`tags:`
		`- app.os.fedoraproject.org`

kevin commented 3 years ago

These certs are used for *.app.os.fedoraproject.org.
ie, things that don't also have/use a fedoraproject.org route.
THis includes the console and some apps that just never bothered to make
a fedoraproject route.

Fixes 9162

Signed-off-by: Kevin Fenzi kevin@scrye.com

Metadata Update from @kevin:
- Pull-request tagged with: freeze-break-request

3 years ago