|
 |
75bab6 |
From 1aa3f7a7fd24c651aafde150351328148fd517be Mon Sep 17 00:00:00 2001
|
|
|
75bab6 |
From: Rob Crittenden <rcritten@redhat.com>
|
|
|
75bab6 |
Date: Thu, 6 May 2021 14:10:44 -0400
|
|
|
75bab6 |
Subject: [PATCH] Only attempt to upgrade ACME configuration files if deployed
|
|
|
75bab6 |
|
|
|
75bab6 |
This can happen on upgrades from older deployments that lack
|
|
|
75bab6 |
an ACME installation and don't meet the minimum requirements
|
|
|
75bab6 |
to deploy one automatically.
|
|
|
75bab6 |
|
|
|
75bab6 |
Also don't consider missing ACME schema a total failure, just
|
|
|
75bab6 |
log and skip it.
|
|
|
75bab6 |
|
|
|
75bab6 |
https://pagure.io/freeipa/issue/8832
|
|
|
75bab6 |
|
|
|
75bab6 |
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
|
|
|
75bab6 |
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
|
|
|
75bab6 |
---
|
|
|
75bab6 |
ipaserver/install/server/upgrade.py | 13 ++++++++++++-
|
|
|
75bab6 |
1 file changed, 12 insertions(+), 1 deletion(-)
|
|
|
75bab6 |
|
|
|
75bab6 |
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
|
|
|
75bab6 |
index e60524084..75bf26b8e 100644
|
|
|
75bab6 |
--- a/ipaserver/install/server/upgrade.py
|
|
|
75bab6 |
+++ b/ipaserver/install/server/upgrade.py
|
|
|
75bab6 |
@@ -1122,7 +1122,8 @@ def ca_upgrade_schema(ca):
|
|
|
75bab6 |
acme_schema_ldif = path
|
|
|
75bab6 |
break
|
|
|
75bab6 |
else:
|
|
|
75bab6 |
- raise RuntimeError('ACME schema file not found')
|
|
|
75bab6 |
+ logger.info('ACME schema is not available')
|
|
|
75bab6 |
+ return False
|
|
|
75bab6 |
|
|
|
75bab6 |
schema_files=[
|
|
|
75bab6 |
'/usr/share/pki/server/conf/schema-certProfile.ldif',
|
|
|
75bab6 |
@@ -1530,6 +1531,16 @@ def ca_update_acme_configuration(ca, fqdn):
|
|
|
75bab6 |
"""
|
|
|
75bab6 |
Re-apply the templates in case anyting has been updated.
|
|
|
75bab6 |
"""
|
|
|
75bab6 |
+ logger.info('[Updating ACME configuration]')
|
|
|
75bab6 |
+ if not os.path.isdir(os.path.join(paths.PKI_TOMCAT, 'acme')):
|
|
|
75bab6 |
+ logger.info('ACME is not deployed, skipping')
|
|
|
75bab6 |
+ return
|
|
|
75bab6 |
+
|
|
|
75bab6 |
+ if not os.path.exists(paths.PKI_ACME_ISSUER_CONF):
|
|
|
75bab6 |
+ logger.info('ACME configuration file %s is missing',
|
|
|
75bab6 |
+ paths.PKI_ACME_ISSUER_CONF)
|
|
|
75bab6 |
+ return
|
|
|
75bab6 |
+
|
|
|
75bab6 |
password = directivesetter.get_directive(
|
|
|
75bab6 |
paths.PKI_ACME_ISSUER_CONF,
|
|
|
75bab6 |
'password',
|
|
|
75bab6 |
--
|
|
|
75bab6 |
2.31.1
|
|
|
75bab6 |
|