entitlement: using the same content for the entitlement.pem and entitlement-key.pem isn't safe

[kpouget]

As per this issue openshift-psap/blog-artifacts#6, using the same content for entitlement.pem and entitlement-key.pem isn't safe,

as confirmed by this command:

$ NAME=key
$ podman run --rm -it -v $KEY:/etc/pki/entitlement/$NAME.pem registry.access.redhat.com/ubi8-minimal:8.3-298 bash -x -c "cp /etc/pki/entitlement/$NAME.pem /etc/pki/entitlement/$NAME-key.pem; microdnf install kernel-devel"

+ cp /etc/pki/entitlement/key.pem /etc/pki/entitlement/key-key.pem
+ microdnf install kernel-devel
Downloading metadata...
Downloading metadata...
Downloading metadata...
Downloading metadata...
error: cannot update repo 'rhel-8-for-x86_64-baseos-rpms': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried; Last error: Curl error (58): Problem with the local SSL certificate for https://cdn.redhat.com/content/dist/rhel8/8/x86_64/baseos/os/repodata/repomd.xml [unable to set private key file: '/etc/pki/entitlement/key-key-key.pem' type PEM]

• NAME=entite --> doesn't work
• NAME=entitlement --> works

[kpouget]

So in mc_pem.yml, we should distinguish BASE64_ENCODED_PEM_FILE and BASE64_ENCODED_PEM_KEY_FILE:

sed -n '/BEGIN RSA PRIVATE KEY/q;p' {ID}.pem > entitlement.pem
sed -n '/BEGIN RSA PRIVATE KEY/,$p' {ID}.pem > entitlement-key.pem

[kpouget]

In addition, in the playbooks, we can validate the structure of the files:

# cat entitlement.pem | grep -- ---
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN ENTITLEMENT DATA-----
-----END ENTITLEMENT DATA-----
-----BEGIN RSA SIGNATURE-----
-----END RSA SIGNATURE-----

# cat entitlement-key.pem | grep -- ---
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----

[kpouget]

/close

GPU Operator >= v1.9 doesn't require entitlement, making this less relevant

[openshift-ci]

@kpouget: Closing this issue.

Details

In response to this:

/close

GPU Operator >= v1.9 doesn't require entitlement, making this less relevant

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.