49df34a4f4
The current implementation of IPsec configuration by IPsec
server/client supports Root CA only. This commit adds support
for Intermediate CA. Now, IPSec Auth Server send both certificates
to IPSec Auth client to store. If it's a self-signed certificate,
the same certificate is send as Root CA.
Test plan:
PASS: In a DX system with available enabled active status with IPsec
server being executed from controller-0 and a self-signed CA
installed. Run "ipsec-client pxecontroller --opcode 1" in
controller-1. Observe that 4 CAs certificates are created,
but they are the same certificate. Observe that a security
association is established between the hosts via "swanctl
--list-sas" command.
PASS: In a DX system with available enabled active status with IPsec
server being executed from controller-0 and a self-signed CA
installed. Run "ipsec-client pxecontroller --opcode 2" in
controller-1. Observe the previously created CertificateRequest
was deleted and generated a new one for controller-1's node.
The new certificate is sent to IPsec Client with Root and
Intermediate CA, which is the same, to be stored and the
swanctl rekey command executed successfully.
PASS: In a DX system with available enabled active status with IPsec
server being executed from controller-0 and an intermediate CA
installed. Run "ipsec-client pxecontroller --opcode 1" in
worker-0. Observe that 4 CAs certificates are created,
including Root and Intermediate CA. Observe that a security
association is established between the hosts via "swanctl
--list-sas" command.
PASS: In a DX system with available enabled active status with IPsec
server being executed from controller-0 and an Intermediate CA
installed. Run "ipsec-client pxecontroller --opcode 2" in
worker-0. Observe the previously created CertificateRequest
was deleted and generated a new one for worker-0's node.
The new certificate is sent to IPsec Client with Root and
Intermediate CA to be stored and the swanctl rekey command
executed successfully.
PASS: In a DX system, simulate the IPsec cert is about to expire,
run the script, verify IPsec cert, private key and trusted CA
cert are renewed.
Story: 2010940
Task: 49825
Change-Id: I25c973350c4f460233a4e6e5ddda8366b948d120
Signed-off-by: Leonardo Mendes <Leonardo.MendesSantana@windriver.com>
|
||
|---|---|---|
| api-ref/source | ||
| config-gate | ||
| controllerconfig | ||
| devstack | ||
| doc | ||
| releasenotes | ||
| storageconfig | ||
| sysinv | ||
| tmp/patch-scripts/EXAMPLE_SYSINV/scripts | ||
| tools/docker/images | ||
| tsconfig | ||
| workerconfig | ||
| .gitignore | ||
| .gitreview | ||
| .yamllint | ||
| .zuul.yaml | ||
| CONTRIBUTORS.wrs | ||
| LICENSE | ||
| README.rst | ||
| bindep.txt | ||
| centos_build_layer.cfg | ||
| centos_dev_wheels.inc | ||
| centos_iso_image.inc | ||
| centos_pkg_dirs | ||
| centos_pkg_dirs_containers | ||
| centos_stable_wheels.inc | ||
| debian_build_layer.cfg | ||
| debian_iso_image.inc | ||
| debian_pkg_dirs | ||
| debian_stable_wheels.inc | ||
| test-requirements.txt | ||
| tox.ini | ||
README.rst
config
The starlingx/config repository handles the StarlingX configuration management services.
Its key component is the System Inventory Service (Sysinv), which provides the system command-line interface (CLI)1.
This repository is not intended to be developed standalone, but rather as part of the StarlingX Source System, which is defined by the StarlingX manifest2.