Skip to content
This repository has been archived by the owner on Mar 4, 2024. It is now read-only.

Certificates fails to regenerate after client's IP address change #24

Open
radraw opened this issue Jul 26, 2023 · 0 comments
Open

Certificates fails to regenerate after client's IP address change #24

radraw opened this issue Jul 26, 2023 · 0 comments

Comments

@radraw
Copy link

radraw commented Jul 26, 2023

When IP address of the client changes due to DHCP error condition certificate is generated automatically with new (wrong) IP address. However when original IP address is restored certificate doesn't generate again anymore. I found there is some problem with just getting proper certificate file path in tls_client.py code. Applying the following workaround patch (it's for kubernetes-worker case) fixes the issue:

--- tls_client.py	2022-12-15 13:47:32.462117145 +0100
+++ tls_client-workaround.py	2022-12-15 13:38:46.315904443 +0100
@@ -49,12 +49,20 @@
     chain = tls.get_chain()
     if chain:
         server_cert = server_cert + '\n' + chain
+    #log("debug: server_cert: " + str(server_cert))
+    #log("debug: server_key: " + str(server_cert))
     if server_cert and server_key:
+        #log("debug:")
         layer_options = layer.options('tls-client')
         cert_path = layer_options.get('server_certificate_path')
         key_path = layer_options.get('server_key_path')
+        #workaround:
+        cert_path = '/srv/kubernetes/server.crt'
+        key_path = '/srv/kubernetes/server.key'
         cert_changed = data_changed('server_certificate', server_cert)
         key_changed = data_changed('server_key', server_key)
+        log("debug: layer_options: " + str(layer_options))
+        log("debug: cert_path: " + str(cert_path))
         if cert_path:
             if cert_changed or not os.path.exists(cert_path):
                 log('Writing server certificate to {0}'.format(cert_path))

After applying the patch certificate is generating again with currently configured (proper restored) IP address.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant