podman machine: Propagate SSL_CERT_FILE and SSL_CERT_DIR to systemd e…

[bjorndown]

…nvironment.

Fixes #16041.

Signed-off-by: Björn Mosler [email protected]

Does this PR introduce a user-facing change?

SSL_CERT_FILE and SSL_CERT_DIR are propagated to VM by podman machine. 

[mheon]

@baude @ashley-cui PTAL

[bjorndown]

I am currently testing on macOS. Given

% env | grep SSL
SSL_CERT_FILE=/Users/bjorm/googlecert4.pem
SSL_CERT_DIR=/Users/bjorm/certs

% ls -l  /Users/bjorm/certs
total 24
-rw-r--r--  1 bjorm  staff  1939 Nov  9 20:38 googlecert.pem
-rw-r--r--  1 bjorm  staff  1939 Nov  9 20:38 googlecert2.pem
-rw-r--r--  1 bjorm  staff  1939 Nov  9 20:38 googlecert3.pem

turns into

[core@localhost ~]$ env | grep SSL
SSL_CERT_DIR=/etc/containers/certs.d/certs
SSL_CERT_FILE=/etc/containers/certs.d/googlecert4.pem

[core@localhost ~]$ ls -l /etc/containers/certs.d
total 16
-rw-r--r--. 1 root root 1939 Nov 10 15:11 googlecert.pem
-rw-r--r--. 1 root root 1939 Nov 10 15:11 googlecert2.pem
-rw-r--r--. 1 root root 1939 Nov 10 15:11 googlecert3.pem
-rw-r--r--. 1 root root 1939 Nov 10 15:11 googlecert4.pem

Need to fix path of SSL_CERT_DIR inside VM.

[bjorndown]

SSL_CERT_DIR is now /etc/containers/certs.d inside the VM.

[bjorndown]

rebased, removed a Fixed comment in commit message.

[vrothberg]

LGTM

[rhatdan]

LGTM once you remove the spaces on the import files.
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bjorndown, rhatdan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rhatdan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bjorndown]

@rhatdan I addressed all the issues that were raised. Can we move forward?

[rhatdan]

Thanks @bjorndown
/lgtm

[igitur]

Hi all,

I'd love some help here. I'm using podman on Windows behind a corporate proxy that uses SSL inspection. I have the SSL_CERT_DIR and SSL_CERT_FILE environment variables populated, but I can't get them to bite in podman. I inspected the podman source and see that the relevant code is in ignition.go, but when exactly is that executed? I've tried resetting my environment and doing podman machine init --log-level=debug and podman machine start --log-level=debug but nowhere do I see the certificates being copied into the VM. podman machine ssh and I can see /etc/containers/certs.d/ is indeed empty. I'd like to avoid having to copy the certs manually into the VM. Please point me to the correct steps to get the certificates to be copied. Much appreciated.