fedora-infrastructure

#12754 Issue a client certificate for fedora-image-uploader to authenticate with Azure

Closed: Fixed a month ago by kevin. Opened 4 months ago by jcline.

Describe what you would like us to do:

Currently, fedora-image-uploader authenticates to Azure via a token. Azure also supports authenticating via client certificate. I'd like to switch over to certificates since the tokens default to expiring fairly frequently. The steps required to do this are:

Generate a key pair similar to:

openssl req -x509 -new -nodes -sha256 -days 3650 \
  -addext "extendedKeyUsage = clientAuth" \
  -subj "/CN=fedora-image-uploader" \
  -newkey rsa:4096 \
  -keyout fedora-image-uploader.key.pem \
  -out fedora-image-uploader.cert.pem

# The clients want the certificate and key in a single file:
cat fedora-image-uploader.key.pem fedora-image-uploader.cert.pem > fedora-image-uploader-key-and-cert.pem

Unfortunately it seems Azure requires it to be RSA. In the above example the cert is good for 10 years which might be too extreme, but whatever the admins are comfortable with is okay with me. The subject doesn't seem to matter either. Whatever the normal process is for generating a client cert and key is fine.

Share the certificate with me here, or, if you're feeling adventurous, you can register it with Azure yourself:

# The ID here is from the application registration in Microsoft Entra
az ad app credential reset --id fb48a308-6b5d-4b1a-93bb-461ff7cc007c --append \
  --display-name "Fedora Image Uploader" \
  --cert "@./fedora-image-uploader.cert.pem"

Repeat the process for staging. Its application ID is 31902398-d12a-4357-91fc-b2a1f0b3d794, viewable with az ad app list -o table if you want to register it, otherwise I'll take care of it.

Finally, I'll need to adjust the OpenShift playbook to mount the key, so I'll need to know what the path is for secret_file_privatefile.

When do you need this to be done by? (YYYY/MM/DD)

I manually set the current token to expire in September of 2026, so some time before that. This is in no way urgent, I just recently had to walk through setting up a certificate so I figured I should write all this down rather than forgetting until next year some time.

Metadata Update from @zlopez:
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: low-trouble, medium-gain

3 months ago

kevin commented 3 months ago

I'm a bit confused here... what CA is expected to issue this cert?

jcline commented 3 months ago

It can actually be self-signed, the CA does not matter. It'd make a lot of sense if you could register a CA and it pulled the service principal from a field on the cert, but... It's possible I'm just missing some panel, but I don't think that's possible.

kevin commented 2 months ago

Sorry this has lanugished. ;(

Did you want to use the same cert/key for staging as prod? or seperate?

The prod key is in {{ ansible_private }}files/cloud-image-uploader/fedora-image-uploader.key.pem

and the pub cert is:

jcline commented a month ago

Thanks, and no worries about it languishing.

Having a separate staging key would be great if it's not too much trouble.

Metadata Update from @kevin:
- Issue assigned to kevin

a month ago

kevin commented a month ago

ok, the stg one is here.

It's in private as {{ ansible_private }}files/cloud-image-uploader/fedora-image-uploader.stg.key.pem

ie, it has .stg in it so you can use {{ env_suffix }} with it.

Let us know if there's anything more to do here.

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

a month ago

Metadata

Assignee

kevin

Tags

Blocking

None

Depending on

None

Priority

Waiting on Assignee

fedora-infrastructure

Source Code

#12754 Issue a client certificate for fedora-image-uploader to authenticate with Azure Closed: Fixed a month ago by kevin. Opened 4 months ago by jcline.

Describe what you would like us to do:

When do you need this to be done by? (YYYY/MM/DD)

Metadata

cloud medium-gain low-trouble

#12754 Issue a client certificate for fedora-image-uploader to authenticate with Azure

Closed: Fixed a month ago by kevin. Opened 4 months ago by jcline.