zlopez/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

openQA etc: use a single-cert CA cert file for staging rabbitmq (#13422)

Browse source 
See infra/tickets#13422
for details on this. It seems like rabbitmq staging has been
switch to the 'new' CA cert, and the consumers don't actually
read/trust both certs in the combined CA cert file, only the
first (old) one, so they don't trust the new one. This should
deploy and use a new file with only the new CA cert in it. We
copy it out of the private repo for convenience but it's not
actually private, hence the 0644 perms.

Signed-off-by: Adam Williamson <awilliam@redhat.com>
This commit is contained in:
Adam Williamson 2026-06-20 14:34:36 +02:00
commit 49f42faa1b
2 changed files with 19 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
inventory/group_vars/openqa_servers_common
View file

@ -30,7 +30,7 @@ openqa_amqp_prod_certfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_userna
openqa_amqp_prod_keyfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_prod_username }}-key.pem"
openqa_amqp_prod_url: "amqps://{{ openqa_amqp_prod_username }}:@rabbitmq.fedoraproject.org/%2Fpubsub"
openqa_amqp_prod_username: "openqa"
openqa_amqp_stg_cacertfile: "/etc/fedora-messaging/stg-cacert.pem"
openqa_amqp_stg_cacertfile: "/etc/fedora-messaging/stg-cacert-single.pem"
openqa_amqp_stg_certfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_stg_username }}-cert.pem"
openqa_amqp_stg_keyfile: "/etc/pki/fedora-messaging/{{ openqa_amqp_stg_username }}-key.pem"
openqa_amqp_stg_url: "amqps://{{ openqa_amqp_stg_username }}:@rabbitmq.stg.fedoraproject.org/%2Fpubsub"