From b1ede44aed3c58a9c1abcb35a78e0fc15bfc37f6 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Tue, 11 May 2021 13:26:00 -0400 Subject: [PATCH] Filter out the pki healthcheck sources if IPA CA is not installed The pki checks spew the error "Invalid PKI instance: pki-tomcat" so we need to suppress them in the IPA CA-less installation case. So if the IPA CA is not configured then don't register the pki sources. A side-effect is that to user the sources will not be listed at all in this case. This should not affect pki-healthcheck and it will continue to return errors in the unconfigured case. https://github.com/freeipa/freeipa-healthcheck/issues/201 Signed-off-by: Rob Crittenden --- src/ipahealthcheck/core/core.py | 12 ++++++++++++ src/ipahealthcheck/ipa/plugin.py | 4 ++++ 2 files changed, 16 insertions(+) diff --git a/src/ipahealthcheck/core/core.py b/src/ipahealthcheck/core/core.py index eaa2d9c..d6b2357 100644 --- a/src/ipahealthcheck/core/core.py +++ b/src/ipahealthcheck/core/core.py @@ -281,6 +281,13 @@ class RunChecks: if rval is not None: return rval + # If we have IPA configured without a CA then we want to skip + # the pkihealthcheck plugins otherwise they will generated a + # lot of false positives. The IPA plugins are loaded first so + # which should set ca_configured in its registry to True or + # False. We will skip the pkihealthcheck plugins only if + # ca_configured is False which means that it was set by IPA. + ca_configured = False for name, registry in find_registries(self.entry_points).items(): try: registry.initialize(framework, config, options) @@ -292,6 +299,11 @@ class RunChecks: except Exception as e: logger.error("Unable to initialize %s: %s" % (name, e)) continue + if hasattr(registry, 'ca_configured'): + ca_configured = registry.ca_configured + if 'pkihealthcheck' in name and ca_configured is False: + logger.debug('IPA CA is not configured, skipping %s', name) + continue for plugin in find_plugins(name, registry): plugins.append(plugin) diff --git a/src/ipahealthcheck/ipa/plugin.py b/src/ipahealthcheck/ipa/plugin.py index 67d93e5..54d1ed3 100644 --- a/src/ipahealthcheck/ipa/plugin.py +++ b/src/ipahealthcheck/ipa/plugin.py @@ -35,6 +35,7 @@ class IPARegistry(Registry): super(IPARegistry, self).__init__() self.trust_agent = False self.trust_controller = False + self.ca_configured = False def initialize(self, framework, config, options=None): super(IPARegistry, self).initialize(framework, config) @@ -82,5 +83,8 @@ class IPARegistry(Registry): if role.get('status') == 'enabled': self.trust_controller = True + ca = cainstance.CAInstance(api.env.realm, host_name=api.env.host) + self.ca_configured = ca.is_configured() + registry = IPARegistry() -- 2.31.1