ca412b85c2
This commit adds more IPSec info to the collect tool to help
debugging/troubleshooting IPsec related issues. Now, the
certificates loaded in the ipsec daemon and the content of
the certificates are collected by the tool.
At the moment, the following ipsec data are collected:
- swanctl --list-certs
- swanctl --list-conns
- swanctl --list-sas
- ip -s xfrm policy
- ip -s xfrm state
- The content of the certificates (var/extra/certs/etc/swanctl)
Test Plan:
PASS: Run 'collect --all', IPSec information collected correctly
under var/extra.
Story: 2010940
Task: 51472
Change-Id: Icd99e495153a52d78683544f5e7ac36f1544f85a
Signed-off-by: Leonardo Mendes <Leonardo.MendesSantana@windriver.com>
47 lines
1.3 KiB
Plaintext
47 lines
1.3 KiB
Plaintext
# certs.include format:
|
|
#
|
|
# Ignore anything that does not start with slash
|
|
# Replace "%%RELEASE%%" with the cluster's current release
|
|
# If the line ends with slash treat it like a directory
|
|
# Otherwise, treat it like a file
|
|
|
|
# 1. k8s certificates:
|
|
/etc/kubernetes/pki/
|
|
/etc/etcd/
|
|
/var/lib/kubelet/pki/kubelet-client-current.pem
|
|
/var/lib/kubelet/pki/kubelet.crt
|
|
|
|
# 2. DC admin endpoint certificates
|
|
/etc/ssl/private/admin-ep-cert.pem
|
|
/opt/platform/config/%%RELEASE%%/dc-adminep-root-ca.crt
|
|
|
|
# 3. docker registry certificates
|
|
/etc/ssl/private/registry-cert.crt
|
|
/etc/docker/certs.d/registry.local:9001/registry-cert.crt
|
|
/etc/docker/certs.d/registry.central:9001/registry-cert.crt
|
|
|
|
# 4. openldap certificates
|
|
/etc/ldap/certs/openldap-cert.crt
|
|
|
|
# 5. GUI/REST API certificates
|
|
/etc/ssl/private/server-cert.pem
|
|
|
|
# 6. Installed ssl CA certificates
|
|
/etc/pki/ca-trust/source/anchors/
|
|
# The following path is hardcoded with regex in collect_certificates:
|
|
# /opt/platform/config/%%RELEASE%%/ssl_ca/ssl_ca_[0-9]{20}
|
|
|
|
# 7. ceph
|
|
/run/ceph/mgr/restful.crt
|
|
|
|
# 8. platform config
|
|
/opt/platform/config/%%RELEASE%%/
|
|
/opt/platform/config/%%RELEASE%%/etcd/
|
|
/opt/platform/config/%%RELEASE%%/kubernetes/pki/
|
|
/opt/platform/config/%%RELEASE%%/registry.central/registry-cert.crt
|
|
/opt/platform/config/%%RELEASE%%/ca-cert.pem
|
|
|
|
# 9. IPSec certificates
|
|
/etc/swanctl/x509/
|
|
/etc/swanctl/x509ca/
|