Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Keyring vs USS keystore separation #1654

Merged
merged 24 commits into from
Sep 24, 2020
Merged

Keyring vs USS keystore separation #1654

merged 24 commits into from
Sep 24, 2020

Conversation

stevenhorsman
Copy link
Member

@stevenhorsman stevenhorsman commented Sep 14, 2020 •
edited
Loading

PR type

  • Update user experience of using keyring vs USS keystores to make it clearer and easier

Relevant issues

Implements #1603

Changes proposed in this PR

  • Add a new zowe-setup-keyring-certificates.env with the new parameters
  • Tidy up the existing zowe-setup-certificates.env to remove the comments on the overloaded parameters
  • Update zowe-setup-certificates.sh to be compatible with KEYSTORE_ALIAS being used for ZOWE_CERTIFICATE_LABEL
  • Update tests

Is there a related doc issue or Pull Request?

Doc issue number: zowe/docs-site#1421

@stevenhorsman
Add check that keyring mode is set
0c3d206 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Only run ZWEKRING when that mode is turned on
ebdcf26 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Add check of keystore mode in create-keyring task
73747c4 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Merge remote-tracking branch 'origin/staging' into users/stevenh/zip-…
f42f2a8 
…1603

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Only run keyring jcl and setup if in that mode
bdb7bf7 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Fix indentation
8002952 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Fix typo
479fdd8 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Merge remote-tracking branch 'origin/staging' into users/stevenh/zip-…
c632289 
…1603
@stevenhorsman
Temp skip some keyring test to improve speed
400bc67 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Re-add overloading fix
a215fef 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Add debug
14a5858 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
swtich condition
1dfd19f 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Undo debug changes
9c00bcc 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Remove comments that apply to keyring
e4cd215 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Merge branch 'staging' into users/stevenh/zip-1603
e7e3d5b
@stevenhorsman stevenhorsman marked this pull request as draft September 15, 2020 11:24
@stevenhorsman
Attempt to increase timeout
42df4d8 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman
Copy link
Member Author

Keystore tests: https://wash.zowe.org:8443/view/Zowe/job/zowe-install-test/view/change-requests/job/PR-1654/8/
convenience tests: https://wash.zowe.org:8443/view/Zowe/job/zowe-install-test/view/change-requests/job/PR-1654/9/
ptf tests: https://wash.zowe.org:8443/view/Zowe/job/zowe-install-test/view/change-requests/job/PR-1654/11/

@stevenhorsman stevenhorsman marked this pull request as ready for review September 16, 2020 13:23
@stevenhorsman
Copy link
Member Author

@vit-tomica @Joe-Winchester - I think I've captured what we discussed about separating the setup-certificate.env files to help the usability, so can you take a look at this PR and see what you think please?

@vit-tomica
Copy link
Contributor

This is much better. Cert configuration will be much clearer now.

@vit-tomica vit-tomica self-requested a review September 16, 2020 16:15
Joe-Winchester
Joe-Winchester approved these changes Sep 23, 2020
View reviewed changes
bin/zowe-setup-keyring-certificates.env Outdated Show resolved Hide resolved
bin/zowe-setup-keyring-certificates.env
# Location for generated certificates and/or JWT token
KEYSTORE_DIRECTORY=/global/zowe/keystore
# This variable has to be set to the Zowe certificate's LABEL specified in the JCL.
ZOWE_CERTIFICATE_LABEL=localhost
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In ZWEKRING JCL the parm is SET LOCALCA='localca'
Should the ZOWE_CERTIFICATE_LABEL= match this so the default here should be
ZOWE_CERTIFICATE_LABEL=localca ?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand - the JCL has SET LABEL='localhost', so does match?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes - my bad. LABEL='localhost' and I was confusing it with LOCALCA='localca'. Looking at the ZWEKRING results the certificate is localhost and the CA is localca so that all matches. Tks for the clarification

image

@stevenhorsman
Add default keyrign name
84fb47c 
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
@stevenhorsman stevenhorsman merged commit 0a5aec8 into staging Sep 24, 2020
@stevenhorsman stevenhorsman deleted the users/stevenh/zip-1603 branch September 24, 2020 15:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Joe-Winchester Joe-Winchester Joe-Winchester approved these changes

@vit-tomica vit-tomica vit-tomica approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@stevenhorsman @vit-tomica @Joe-Winchester