{"action":"created","issue":{"url":"https://api.github.com/repos/cockpit-project/cockpit/issues/6359","repository_url":"https://api.github.com/repos/cockpit-project/cockpit","labels_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/6359/labels{/name}","comments_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/6359/comments","events_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/6359/events","html_url":"https://github.com/cockpit-project/cockpit/issues/6359","id":222744358,"number":6359,"title":"Changing OpenShift TLS certificates/kube config does not work","user":{"login":"martinpitt","id":200109,"avatar_url":"https://avatars3.githubusercontent.com/u/200109?v=4","gravatar_id":"","url":"https://api.github.com/users/martinpitt","html_url":"https://github.com/martinpitt","followers_url":"https://api.github.com/users/martinpitt/followers","following_url":"https://api.github.com/users/martinpitt/following{/other_user}","gists_url":"https://api.github.com/users/martinpitt/gists{/gist_id}","starred_url":"https://api.github.com/users/martinpitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinpitt/subscriptions","organizations_url":"https://api.github.com/users/martinpitt/orgs","repos_url":"https://api.github.com/users/martinpitt/repos","events_url":"https://api.github.com/users/martinpitt/events{/privacy}","received_events_url":"https://api.github.com/users/martinpitt/received_events","type":"User","site_admin":false},"labels":[{"id":279643827,"url":"https://api.github.com/repos/cockpit-project/cockpit/labels/knownissue","name":"knownissue","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":323,"created_at":"2017-04-19T13:47:57Z","updated_at":"2017-11-03T06:31:17Z","closed_at":null,"author_association":"MEMBER","body":"This is a long-standing bug. Creating this issue from the [Trello card](https://trello.com/c/DalY5Iva/471-changing-tls-client-certificates-still-uses-the-old-ones-can-reproduce-this-issue-with-kube-config) to have a place where I can keep notes, and we'll use that as a known issue.\r\n\r\n### Reproducer:\r\n\r\n - Take an [old kube config](https://raw.githubusercontent.com/cockpit-project/cockpit/944eded89ae9d5229b2dbd5463218e0a63beacfd/test/verify/files/openshift.kubeconfig) with a valid but not-authorized cert and place it in your `~/.kube/config`.\r\n\r\n - Start `test/vm-run openshift` log into cockpit and go to the kubernetes dashboard. You'll get an connection error.\r\n\r\n - Put the a kubeconfig file with the correct cert in place: `scp root@10.111.112.101:/root/.kube/config ~/.kube/config` (or test/verify/files/openshift.kubeconfig from master)\r\n\r\n - Click reconnect. You still get a connection error. Browser refresh gives you the same.\r\n\r\n - Log out of cockpit and back in. And it will connect correctly.\r\n\r\n### Upstream bug:\r\nThis is a bug  in glib-networking: https://bugzilla.gnome.org/show_bug.cgi?id=781578 (patch sent there).\r\n\r\n\r\n### Old debugging log, for posterity:\r\nDebug statements show that in all cases the correct CA and client certs are being passed through and set in `parse_stream_options()` (cockpitchannel.c), i. e. `connectable->tls_cert` and `connectable->tls_database` are both correct; but the former is apparently ignored.\r\n\r\nWith broken cert:\r\n\r\n    cockpit-bridge-DEBUG: 10.111.112.101:8443: tls handshake\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: sending GET request\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: output would block\r\n    cockpit-bridge-Message: https://10.111.112.101:8443/api: Unacceptable TLS certificate: untrusted-issuer\r\n    cockpit-bridge-Message: https://10.111.112.101:8443/api: couldn't read: Unacceptable TLS certificate\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: closing stream: unknown-hostkey\r\n\r\nAfter changing to working certs, the new certificate-authority-data gets used, but the new client-certificate-data is still the old one, thus the OpenShift server does not accept the user as its cert is not signed by the new CA:\r\n\r\n    cockpit-bridge-DEBUG: 10.111.112.101:8443: tls handshake\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: sending GET request\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: output would block\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: wrote 98 bytes\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: output queue empty\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: read 198 bytes\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: response: 401 Unauthorized\r\n\r\nafter logging out and back in, both are updated:\r\n\r\n    cockpit-bridge-DEBUG: 10.111.112.101:8443: tls handshake\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: sending GET request\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: output would block\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: wrote 98 bytes\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: output queue empty\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: read 271 bytes\r\n    cockpit-bridge-DEBUG: https://10.111.112.101:8443/api: response: 200 OK\r\n\r\nWhen extracting the CA and client certs as PEM from the kube config (done with adding extra `g_debug()`, the OpenShift server replies with the same. Each command corresponds to respective case above:\r\n\r\n    curl --cert ~/broken.crt --cacert ~/authbroken.crt https://10.111.112.101:8443/api  # untrusted-issuer\r\n    curl --cert ~/broken.crt --cacert ~/authworking.crt https://10.111.112.101:8443/api  # 401 Unauthorized\r\n    curl --cert ~/working.crt --cacert ~/authworking.crt https://10.111.112.101:8443/api  # 200 OK"},"comment":{"url":"https://api.github.com/repos/cockpit-project/cockpit/issues/comments/341630282","html_url":"https://github.com/cockpit-project/cockpit/issues/6359#issuecomment-341630282","issue_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/6359","id":341630282,"user":{"login":"cockpituous","id":14330603,"avatar_url":"https://avatars1.githubusercontent.com/u/14330603?v=4","gravatar_id":"","url":"https://api.github.com/users/cockpituous","html_url":"https://github.com/cockpituous","followers_url":"https://api.github.com/users/cockpituous/followers","following_url":"https://api.github.com/users/cockpituous/following{/other_user}","gists_url":"https://api.github.com/users/cockpituous/gists{/gist_id}","starred_url":"https://api.github.com/users/cockpituous/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cockpituous/subscriptions","organizations_url":"https://api.github.com/users/cockpituous/orgs","repos_url":"https://api.github.com/users/cockpituous/repos","events_url":"https://api.github.com/users/cockpituous/events{/privacy}","received_events_url":"https://api.github.com/users/cockpituous/received_events","type":"User","site_admin":false},"created_at":"2017-11-03T06:31:17Z","updated_at":"2017-11-03T06:31:17Z","author_association":"CONTRIBUTOR","body":"verify/rhel-7-4\nOoops, it happened again<hr>\n```\n# ----------------------------------------------------------------------\n# testReconnectChangeCert (check_openshift.TestOpenshift)\n#\nWarning: Permanently added '[127.0.0.2]:2501' (ECDSA) to the list of known hosts.\r\nWarning: Permanently added '[127.0.0.2]:2502' (ECDSA) to the list of known hosts.\r\n/etc/profile.d/lang.sh: line 19: warning: setlocale: LC_CTYPE: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 20: warning: setlocale: LC_COLLATE: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 23: warning: setlocale: LC_MESSAGES: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 26: warning: setlocale: LC_NUMERIC: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 29: warning: setlocale: LC_TIME: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 19: warning: setlocale: LC_CTYPE: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 20: warning: setlocale: LC_COLLATE: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 23: warning: setlocale: LC_MESSAGES: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 26: warning: setlocale: LC_NUMERIC: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 29: warning: setlocale: LC_TIME: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 19: warning: setlocale: LC_CTYPE: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 20: warning: setlocale: LC_COLLATE: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 23: warning: setlocale: LC_MESSAGES: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 26: warning: setlocale: LC_NUMERIC: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 29: warning: setlocale: LC_TIME: cannot change locale (en_US.UTF-8): No such file or directory\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nNo resources found.\nTraceback (most recent call last):\n  File \"/build/cockpit/bots/../test/verify/check-openshift\", line 380, in testReconnectChangeCert\n    b.wait_present(\"#service-list\")\n  File \"/build/cockpit/test/common/testlib.py\", line 230, in wait_present\n    return self.wait_js_func('ph_is_present', selector)\n  File \"/build/cockpit/test/common/testlib.py\", line 224, in wait_js_func\n    return self.phantom.wait(\"%s(%s)\" % (func, ','.join(map(jsquote, args))))\n  File \"/build/cockpit/test/common/testlib.py\", line 825, in <lambda>\n    return lambda *args: self._invoke(name, *args)\n  File \"/build/cockpit/test/common/testlib.py\", line 851, in _invoke\n    raise Error(res['error'])\nError: timeout\n\n\nnot ok 159 testReconnectChangeCert (check_openshift.TestOpenshift) # duration: 180s\nWrote TestOpenshift-testReconnectChangeCert-rhel-7-4-127.0.0.2-2501-FAIL.png\nWrote TestOpenshift-testReconnectChangeCert-rhel-7-4-127.0.0.2-2501-FAIL.html\nJournal extracted to TestOpenshift-testReconnectChangeCert-rhel-7-4-127.0.0.2-2501-FAIL.log\nJournal extracted to TestOpenshift-testReconnectChangeCert-openshift-127.0.0.2-2502-FAIL.log\n/etc/profile.d/lang.sh: line 19: warning: setlocale: LC_CTYPE: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 20: warning: setlocale: LC_COLLATE: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 23: warning: setlocale: LC_MESSAGES: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 26: warning: setlocale: LC_NUMERIC: cannot change locale (en_US.UTF-8): No such file or directory\n/etc/profile.d/lang.sh: line 29: warning: setlocale: LC_TIME: cannot change locale (en_US.UTF-8): No such file or directory\n```\nFirst occurrence: 2017-11-03T06:32:39.336406 | revision d2d3cdbf22b5528577164ab6d4a7fe738b99c04b, [logs](http://fedorapeople.org/groups/cockpit/logs/master-20171103-062222-d2d3cdbf-verify-rhel-7-4/log.html)\nTimes recorded: 1\nLatest occurrences:\n\n- 2017-11-03T06:32:39.336406 | revision d2d3cdbf22b5528577164ab6d4a7fe738b99c04b, [logs](http://fedorapeople.org/groups/cockpit/logs/master-20171103-062222-d2d3cdbf-verify-rhel-7-4/log.html)\n"}}
{"actor":{"display_login":"cockpituous"}}