CA check improvements for `rancher-agent` about rancher HOT 11 CLOSED

@MbolotSuse sure, updated my comment with the information we discussed offline.

from rancher.

Blocked on design review currently.

from rancher.

Depends on #45628.

from rancher.

#45974

from rancher.

Tested this with results over in Qase test run /RM/1631. I noted the following failure:

VALIDATION STEPS

1. Setup Rancher v2.9-head with a valid cert.pem and/or key.pem file.
   • Ensured agentTLSMode=system-store in the helm install command.
2. Ran command kubectl get settings agent-tls-mode -o yaml and noted that the value is strict:

$ kubectl get settings agent-tls-mode -o yaml
apiVersion: management.cattle.io/v3
customized: false
default: strict
kind: Setting
metadata:
  creationTimestamp: "2024-07-02T20:30:00Z"
  generation: 1
  name: agent-tls-mode
  resourceVersion: "936"
  uid: ba85e161-b9b9-4450-9265-d01d04ca59f9
source: ""
value: ""

There are two other scenarios that have the same steps as above that have not been tested yet due to this failure. Marking as blocked until this is resolved.

from rancher.

@markusewalker Can you provide more details? The default on 2.9.0 will be strict, but the actual value should be as in the helm command, system-store - your output doesn't provide sufficient detail to determine if that is the case.

from rancher.

@markusewalker - Can you verify what the helm command is actually rendering templates into? I'm able to verify that based on the release/v2.9 branch the chart should set Env variables as expected. So I'd like to confirm what you're seeing there to identify if the issue is with the helm chart, or "after the chart".

For instance, in my testing I can see:

Default values file (no ENV var expected):

→ helm template ./chart/|grep -A1 CATTLE_AGENT_TLS

And when I set the agentTLSMode we see:

→ helm template ./chart/ --set agentTLSMode=system-store|grep -A1 CATTLE_AGENT_TLS
        - name: CATTLE_AGENT_TLS_MODE
          value: "system-store"

from rancher.

@mallardduck is helm template the only means in which this can be tested? I used the following command:

helm install rancher rancher-latest/rancher --namespace cattle-system --set global.cattle.psp.enabled=false \
 --set ingress.tls.source=secret  --set hostname=$NAME --set rancherImageTag=v2.9-head \
 --set bootstrapPassword=<retracted>--set agentTLSMode="system-store"

If so, I can attempt to retest. I had used this method as the reference guide given implied that helm install should work.

from rancher.

@markusewalker - No it's just the easiest way to directly see the rendered helm results w/o a cluster. You can also do the install command you shared, but append --dry-run --debug and get similar results to the helm template command. However that method does require a k8s cluster for some minimal (hence dry run) cluster state checking.

I think I see the issue and it's much more simple; I believe you're not using the correct chart. From what I can see the newest chart published in rancher-latest helm repo is v2.9.0-rc1 from May 7th. The changes to add this feature to the chart itself were only merged 4 days ago so will not be in v2.9.0-rc1 charts.

@MbolotSuse - I'm not familiar with this area, wondering if you are? I assume they need a v2.9.0-rc2 since charts probably aren't published on alpha by design? Or maybe should they just test from the local ./charts folder?

from rancher.

@mallardduck v2.9.0-rc7 recently became available. I will try with that version and see if I have successful results.

from rancher.

Re-ran the test cases outlined in Qase test run /RM/1631. Using v2.9.0-alpha7, I was successfully able to validate this issue. Summary of the scenarios tested provided below:

from rancher.