From 4b8ec15b69f236652a208450a532b366dbd69cb8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Han?= Date: Wed, 24 Feb 2021 11:35:01 +0100 Subject: [PATCH] ceph: do not use curl ca-cert for signed certificates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cURL's ca-cert and Golang TLS config for ca-certs have a different meaning, it seems that the Golang implementation will always lookup the local certs first and then proceeds with the specificed cert, if the system's certs works it will never go to the specificied certificate. cURL however, does the opposite by strictly checking the specified cert. If the certificate is signed we don't need to force a specific certificate, thus by using capath instead we let cURL determine what's best to validate against. Signed-off-by: Sébastien Han --- pkg/operator/ceph/cluster/osd/spec.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/operator/ceph/cluster/osd/spec.go b/pkg/operator/ceph/cluster/osd/spec.go index 358d24de1..17b01400a 100644 --- a/pkg/operator/ceph/cluster/osd/spec.go +++ b/pkg/operator/ceph/cluster/osd/spec.go @@ -175,7 +175,7 @@ fi # TLS args if [ -n "$VAULT_CACERT" ]; then - ARGS+=(--cacert "${VAULT_CACERT}") + ARGS+=(--capath $(dirname "${VAULT_CACERT}")) fi if [ -n "$VAULT_CLIENT_CERT" ]; then ARGS+=(--cert "${VAULT_CLIENT_CERT}")