pass in the configured DB ca (if any) to the container #345
Conversation
|
This looks related to #141 but is not an aspect I have incorporated. I was wanting to get in a version of remote database testing and then harden it with more of the options. |
|
It is, @Gauravtalreja1 ran into this when testing ext db stuff |
evgeni
force-pushed
the
ssldb
branch
5 times, most recently
from
f8a1e26 to
1ba7910
Compare
src/roles/foreman/tasks/main.yaml
Outdated
| state: present | ||
| name: foreman-database-url | ||
| data: "postgresql://{{ foreman_database_user }}:{{ foreman_database_password }}@{{ foreman_database_host }}:{{ foreman_database_port }}/{{ foreman_database_name }}?pool={{ foreman_database_pool }}&sslmode={{ foreman_database_sslmode }}{% if foreman_database_ssl_ca is defined %}&sslrootcert={{ foreman_database_ssl_ca }}{% endif %}" # yamllint disable-line rule:line-length | ||
| data: "postgresql://{{ foreman_database_user }}:{{ foreman_database_password }}@{{ foreman_database_host }}:{{ foreman_database_port }}/{{ foreman_database_name }}?pool={{ foreman_database_pool }}&sslmode={{ foreman_database_sslmode }}{% if foreman_database_sslrootcert is defined %}&sslrootcert=/etc/foreman/db-ca.crt{% endif %}" # yamllint disable-line rule:line-length |
There was a problem hiding this comment.
@ehelms the other roles (pulp, candlepin) use *_ssl_mode and *_ssl_ca, while foreman uses _sslmode and _sslrootcert. given those vars are internal, it doesn't hurt too much, but probably a good idea to still align them?
There was a problem hiding this comment.
Sounds fair, most of these names were lifted from their puppet predecessors.
evgeni
force-pushed
the
ssldb
branch
3 times, most recently
from
f5d3e14 to
921e621
Compare
Renames foreman_database_sslrootcert to foreman_database_ssl_ca and foreman_database_sslmode to foreman_database_ssl_mode
| containers.podman.podman_secret: | ||
| state: present | ||
| name: candlepin-db-ca | ||
| data: "{{ lookup('ansible.builtin.file', candlepin_database_ssl_ca) if candlepin_database_ssl_ca else 'empty' }}" |
There was a problem hiding this comment.
This is creating an empty secret if there is no database SSL cert? Why not use a when conditional on the sercret?
There was a problem hiding this comment.
Because then I need to also conditionally mount it, and that's painful ;)
No description provided.