openQA etc: use a single-cert CA cert file for staging rabbitmq (#13422)

See infra/tickets#13422
for details on this. It seems like rabbitmq staging has been
switch to the 'new' CA cert, and the consumers don't actually
read/trust both certs in the combined CA cert file, only the
first (old) one, so they don't trust the new one. This should
deploy and use a new file with only the new CA cert in it. We
copy it out of the private repo for convenience but it's not
actually private, hence the 0644 perms.

Signed-off-by: Adam Williamson <awilliam@redhat.com>

inventory/group_vars/openqa_servers_common

@@ -30,7 +30,7 @@ openqa_amqp_prod_certfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_userna
 openqa_amqp_prod_keyfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_username }}-key.pem"
 openqa_amqp_prod_url: "amqps://{{ openqa_amqp_prod_username }}:@rabbitmq.fedoraproject.org/%2Fpubsub"
 openqa_amqp_prod_username: "openqa"
-openqa_amqp_stg_cacertfile: "/etc/fedora-messaging/stg-cacert.pem"
+openqa_amqp_stg_cacertfile: "/etc/fedora-messaging/stg-cacert-single.pem"
 openqa_amqp_stg_certfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_stg_username }}-cert.pem"
 openqa_amqp_stg_keyfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_stg_username }}-key.pem"
 openqa_amqp_stg_url: "amqps://{{ openqa_amqp_stg_username }}:@rabbitmq.stg.fedoraproject.org/%2Fpubsub"

roles/openqa/dispatcher/tasks/main.yml

@@ -286,7 +286,7 @@
   - config
   - fedora-messaging
 
-- name: Deploy the Fedora infra fedora-messaging cert
+- name: Deploy the cert for authenticating with fedora-messaging
   ansible.builtin.copy:
     src: "{{ private }}/files/rabbitmq/{{ openqa_env }}/pki/issued/{{ openqa_amqp_this_username }}.crt"
     dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_this_username }}-cert.pem"
@@ -298,7 +298,7 @@
   - config
   - fedora-messaging
 
-- name: Deploy the Fedora infra fedora-messaging key
+- name: Deploy the key for authenticating with fedora-messaging
   ansible.builtin.copy:
     src: "{{ private }}/files/rabbitmq/{{ openqa_env }}/pki/private/{{ openqa_amqp_this_username }}.key"
     dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_this_username }}-key.pem"
@@ -310,7 +310,7 @@
   - config
   - fedora-messaging
 
-- name: Deploy the Fedora infra fedora-messaging prod cert on stg (for stg consumers that listen on prod)
+- name: Deploy the fedora-messaging prod auth cert on stg (for stg consumers that listen on prod)
   ansible.builtin.copy:
     src: "{{ private }}/files/rabbitmq/production/pki/issued/{{ openqa_amqp_prod_username }}.crt"
     dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_username }}-cert.pem"
@@ -322,7 +322,7 @@
   - config
   - fedora-messaging
 
-- name: Deploy the Fedora infra fedora-messaging prod key on stg (for stg consumers that listen on prod)
+- name: Deploy the fedora-messaging prod auth key on stg (for stg consumers that listen on prod)
   ansible.builtin.copy:
     src: "{{ private }}/files/rabbitmq/production/pki/private/{{ openqa_amqp_prod_username }}.key"
     dest: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_username }}-key.pem"
@@ -334,6 +334,20 @@
   - config
   - fedora-messaging
 
+- name: Deploy a working CA certificate file on staging (see https://forge.fedoraproject.org/infra/tickets/issues/13422)
+  ansible.builtin.copy:
+    src: "{{ private }}/files/rabbitmq/{{ openqa_env }}/pki/ca.crt"
+    dest: "/etc/fedora-messaging/{{ openqa_env_prefix }}cacert-single.pem"
+    # this is just a server cert, it is not actually private, we're
+    # just getting it from the private repo as it's convenient
+    mode: "0644"
+    owner: root
+    group: geekotest
+  when: "deployment_type is defined and deployment_type == 'stg'"
+  tags:
+  - config
+  - fedora-messaging
+
 - name: Configure fedora-messaging scheduler
   ansible.builtin.template: src=fedora_openqa_scheduler.toml.j2 dest=/etc/fedora-messaging/fedora_openqa_scheduler.toml owner=root group=root mode=0640
   notify: