keystore: don't restart systemvm cloud.service post cert import#3134
Conversation
This ensures that the systemvm agent (cloud.service) is not restarted when old keystore does not exist. However, on subsequent reboots of systemvm this will try to restart cloud.service after importing X509 certificates. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
… old ks/certs are invalid Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
yadvr
changed the title
yadvr
requested review from
GabrielBrascher,
PaulAngus,
rafaelweingartner and
wido
|
@blueorangutan package |
|
@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress. |
|
Packaging result: ✔centos6 ✔centos7 ✖debian. JID-2541 |
|
@blueorangutan test |
|
@rhtyd a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests |
GabrielBrascher
left a comment
GabrielBrascher
left a comment
There was a problem hiding this comment.
Code LGTM, thanks @rhtyd!
|
Trillian test result (tid-3325)
|
|
Tests LGTM. |
…e#3134) This ensures that the systemvm agent (cloud.service) is not restarted on certificate import. The agent has an inbuilt logic to attempt reconnection. If the old certificates/keystore is invalid agent will attempt reconnection. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
…e#3134) This ensures that the systemvm agent (cloud.service) is not restarted on certificate import. The agent has an inbuilt logic to attempt reconnection. If the old certificates/keystore is invalid agent will attempt reconnection. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> (cherry picked from commit 53ec27c) Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
4 participants
This ensures that the systemvm agent (cloud.service) is not restarted
on certificate import. The agent has an inbuilt logic to attempt reconnection.
If the old certificates/keystore is invalid agent will attempt reconnection.
Types of changes
How Has This Been Tested?
Deployed a CPU-bound environment (hypervisor host with limited CPU and 1core), saw that previously irrespective of keystore setup the restart logic would cause agent to restart (sig.kill is the reason seen in logs) and on management server side it would seem agent connects, then disconnects, then connects and is finally in
Upstate. With this fix, the reconnection attempt won't be observed on the management server side. The agent will keep attempting reconnection when certificates are invalid, the cert import script does not need to restart cloud service manually.