Lazy Cert Regeneration Design
by Devan Goodwin
There are a few ways certs get regenerated:
1. During refresh pools if
(a) the product name/attributes change
(b) provided products are added/removed
(c) subscription dates changed
(d) subscription was revoked
- quantity changes could lead to certs getting revoked if we're over
the limit, but does not regenerate anything.
- we do not regenerate on content set changes (we do for provided
products, but not just content sets within one of those provided
products). we do not store content data locally in some deployments so
there's nothing to compare against to see if anything changed.
- I am assuming the business rules would require us to immediately
revoke for (d), but to use lazy revocation for all of the others.
2. An explicit call to regenerate everything for some product, I do not
know where/if IT uses this: PUT /entitlements/product/{productId} Lazy
regeneration should probably be used here. (doesn't matter what changed,
we don't really know, but we can rest assured it wasn't anyone losing
their subscription access)
3. An explicit call to regenerate everything for a given consumer: PUT
/consumers/{uuid}/certificates. IMO we should not do any lazy
regeneration here, I think the use case for this call was for security
reasons and the like.
4. If configured for environments, whenever content is promoted/demoted
to an environment, we mass regenerate for those consumers. Lazy regen
seems good here.
This seems fairly straightforward so far. The request was for
distributor consumer types only.
- Add a "dirty" column to cp_entitlement, flip it to true as desired for
entitlements when they need regeneration during (1) or (2) above.
- In GET /consumers/{uuid}/export check all entitlements for the dirty
flag, if any are found regenerate them, then proceed normally.
jbowes has proposed possibly leveraging lazy regen for all consumers of
all types for some cert v2 purposes. (might need more info from you on
this jbowes) I think this just implies expanding the hooks for
triggering regeneration to:
GET /consumers/{uuid}
GET /consumers/{uuid}/entitlements
GET /consumers/{uuid}/certificates (both JSON and ZIP calls)
GET /consumers/{uuid}/certificates/serials
I don't think this is much more work, the method to scan for dirty
entitlements and regenerate would be shared across all these API calls.
The implementation is cleaner particularly in the locations where we
decide to set dirty flag or not, if this is not specific to just one
consumer type and path through the code.
Thoughts?
Thanks,
Devan
12 years
Missing liquibase dependency
by Lukas Zapletal
Hey,
installed katello nightly this morning and liquibase package was not
installed for some reason. I know it is temporarily in Devan/candlepin
repo, but I think candlepin.spec is missing the Require for it.
Let me know when this is fixed (rpm is ready), thanks.
--
Later,
Lukas "lzap" Zapletal
#katello #systemengine
12 years, 1 month
Not able to install Candlepin
by Richard Worwood
Has there been any progress on this as I'm just trying to install
Candlepin and am getting this issue?
Thanks
George
> Packaged but not yet in stable, I just submitted the Fedora builds to
> stable this morning, EPEL6 needs more time in testing.
On Thu, May 3, 2012 at 9:15 AM, Jesus M. Rodriguez <jmrodri at
gmail.com <https://fedorahosted.org/mailman/listinfo/candlepin>>
wrote:
>* I believe liquibase was packaged for fedora, unsure if it's on epel. Which*>* repo are you using?*>**>* Jesus*>**>* On May 3, 2012 6:58 AM, "Lukas Zapletal" <lzap+pub at redhat.com <https://fedorahosted.org/mailman/listinfo/candlepin>> wrote:*>>**>>* Hello,*>>**>>* we are not able to install Candlepin:*>>**>>* Error: Package: candlepin-0.5.29-1.el6.noarch (candlepin)*>>* Requires: liquibase >= 2.0.3*>>**>>* This is RHEL 6.2.*>>**>>* I'd like to ask to bump Candlepin RPMs to version that includes cpsetup*>>* -k option. We had to add it to Katello recently and our installer fails*>>* without it.*>>**>>* Thanks!*>>**>>* --*>>* Later,*>>**>>* Lukas Zapletal | E32E400A*>>* RHN Satellite Engineering*>>* Red Hat Czech s.r.o. Brno*>>* _______________________________________________*>>* candlepin mailing list*>>* candlepin at lists.fedorahosted.org <https://fedorahosted.org/mailman/listinfo/candlepin>*>>* https://fedorahosted.org/mailman/listinfo/candlepin*>**>**>* _______________________________________________*>* candlepin mailing list*>* candlepin at lists.fedorahosted.org <https://fedorahosted.org/mailman/listinfo/candlepin>*>* https://fedorahosted.org/mailman/listinfo/candlepin*>**
12 years, 1 month
Not able to install Candlepin
by Lukas Zapletal
Hello,
we are not able to install Candlepin:
Error: Package: candlepin-0.5.29-1.el6.noarch (candlepin)
Requires: liquibase >= 2.0.3
This is RHEL 6.2.
I'd like to ask to bump Candlepin RPMs to version that includes cpsetup
-k option. We had to add it to Katello recently and our installer fails
without it.
Thanks!
--
Later,
Lukas Zapletal | E32E400A
RHN Satellite Engineering
Red Hat Czech s.r.o. Brno
12 years, 1 month
