From c2115296892ff17b47004463e07ab14eceab7931 Mon Sep 17 00:00:00 2001 From: Jonathon Anderson Date: Wed, 18 Mar 2026 18:10:38 -0600 Subject: [PATCH] Update wwctl upgrade to manage TLS configuration Also fixed an omission for API configuration in wwctl upgrade. Signed-off-by: Jonathon Anderson --- CHANGELOG.md | 1 + internal/app/wwclient/root.go | 2 +- internal/pkg/config/buildconfig.go.in | 2 +- internal/pkg/upgrade/config.go | 22 +++++++++ internal/pkg/upgrade/config_test.go | 57 +++++++++++++++++++++++ internal/pkg/warewulfd/server/server.go | 4 +- overlays/wwinit/rootfs/warewulf/config.ww | 2 +- 7 files changed, 85 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6e561ba9..9616988d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ### Fixed +- Include api configuration during `wwctl upgrade config` - Prevent `assetkey` from leaking into wwclient logs. - Remove requisite dependency between ignition disk target and ignition service. #2083 - Return HTTP 409 status when creating an existing overlay diff --git a/internal/app/wwclient/root.go b/internal/app/wwclient/root.go index 54bb0ead..498fcb85 100644 --- a/internal/app/wwclient/root.go +++ b/internal/app/wwclient/root.go @@ -260,7 +260,7 @@ func CobraRunE(cmd *cobra.Command, args []string) (err error) { port := conf.Warewulf.Port scheme := "http" if conf.Warewulf.TLSEnabled() { - port = conf.Warewulf.TlsPort + port = conf.Warewulf.TLSPort scheme = "https" } diff --git a/internal/pkg/config/buildconfig.go.in b/internal/pkg/config/buildconfig.go.in index 4150ef2a..114c860c 100644 --- a/internal/pkg/config/buildconfig.go.in +++ b/internal/pkg/config/buildconfig.go.in @@ -42,7 +42,7 @@ func (conf TFTPConf) Enabled() bool { // BaseConf. type WarewulfConf struct { Port int `yaml:"port,omitempty" default:"9873"` - TlsPort int `yaml:"tls port,omitempty" default:"9874"` + TLSPort int `yaml:"tls port,omitempty" default:"9874"` SecureP *bool `yaml:"secure,omitempty" default:"true"` TLSEnabledP *bool `yaml:"tls,omitempty"` UpdateInterval int `yaml:"update interval,omitempty" default:"60"` diff --git a/internal/pkg/upgrade/config.go b/internal/pkg/upgrade/config.go index 80b05e5e..03f241d5 100644 --- a/internal/pkg/upgrade/config.go +++ b/internal/pkg/upgrade/config.go @@ -25,6 +25,7 @@ type WarewulfYaml struct { Ipv6net string `yaml:"ipv6net"` Fqdn string `yaml:"fqdn"` Warewulf *WarewulfConf `yaml:"warewulf"` + API *APIConf `yaml:"api"` DHCP *DHCPConf `yaml:"dhcp"` TFTP *TFTPConf `yaml:"tftp"` NFS *NFSConf `yaml:"nfs"` @@ -52,6 +53,9 @@ func (legacy *WarewulfYaml) Upgrade() (upgraded *config.WarewulfYaml) { if legacy.Warewulf != nil { upgraded.Warewulf = legacy.Warewulf.Upgrade() } + if legacy.API != nil { + upgraded.API = legacy.API.Upgrade() + } if legacy.DHCP != nil { upgraded.DHCP = legacy.DHCP.Upgrade() } @@ -92,7 +96,9 @@ func (legacy *WarewulfYaml) Upgrade() (upgraded *config.WarewulfYaml) { type WarewulfConf struct { Port int `yaml:"port"` + TLSPort int `yaml:"tls port"` Secure *bool `yaml:"secure"` + TLSEnabled *bool `yaml:"tls"` UpdateInterval int `yaml:"update interval"` AutobuildOverlays *bool `yaml:"autobuild overlays"` EnableHostOverlay *bool `yaml:"host overlay"` @@ -105,7 +111,9 @@ type WarewulfConf struct { func (legacy *WarewulfConf) Upgrade() (upgraded *config.WarewulfConf) { upgraded = new(config.WarewulfConf) upgraded.Port = legacy.Port + upgraded.TLSPort = legacy.TLSPort upgraded.SecureP = legacy.Secure + upgraded.TLSEnabledP = legacy.TLSEnabled upgraded.UpdateInterval = legacy.UpdateInterval upgraded.AutobuildOverlaysP = legacy.AutobuildOverlays upgraded.EnableHostOverlayP = legacy.EnableHostOverlay @@ -117,6 +125,20 @@ func (legacy *WarewulfConf) Upgrade() (upgraded *config.WarewulfConf) { return upgraded } +type APIConf struct { + Enabled *bool `yaml:"enabled"` + TLSEnabled *bool `yaml:"tls"` + AllowedNets []config.IPNet `yaml:"allowed subnets"` +} + +func (legacy *APIConf) Upgrade() (upgraded *config.APIConf) { + upgraded = new(config.APIConf) + upgraded.EnabledP = legacy.Enabled + upgraded.TLSEnabledP = legacy.TLSEnabled + upgraded.AllowedNets = append([]config.IPNet{}, legacy.AllowedNets...) + return upgraded +} + type DHCPConf struct { Enabled *bool `yaml:"enabled"` Template string `yaml:"template"` diff --git a/internal/pkg/upgrade/config_test.go b/internal/pkg/upgrade/config_test.go index 90868a67..2a5f52a6 100644 --- a/internal/pkg/upgrade/config_test.go +++ b/internal/pkg/upgrade/config_test.go @@ -580,6 +580,63 @@ image mounts: readonly: true paths: datadir: /usr/share +`, + }, + { + name: "v4.6.5-tls", + legacyYaml: ` +ipaddr: 10.0.0.1 +netmask: 255.255.252.0 +network: 10.0.0.0 +warewulf: + port: 9873 + tls port: 9874 + secure: true + tls: true + update interval: 60 + autobuild overlays: true + host overlay: true +api: + enabled: true + tls: true + allowed subnets: + - 127.0.0.0/8 + - ::1/128 +dhcp: + enabled: true + range start: 10.0.1.1 + range end: 10.0.1.255 + systemd name: dhcpd +tftp: + enabled: true + systemd name: tftp +`, + upgradedYaml: ` +ipaddr: 10.0.0.1 +netmask: 255.255.252.0 +network: 10.0.0.0 +warewulf: + port: 9873 + tls port: 9874 + secure: true + tls: true + update interval: 60 + autobuild overlays: true + host overlay: true +api: + enabled: true + tls: true + allowed subnets: + - 127.0.0.0/8 + - ::1/128 +dhcp: + enabled: true + range start: 10.0.1.1 + range end: 10.0.1.255 + systemd name: dhcpd +tftp: + enabled: true + systemd name: tftp `, }, } diff --git a/internal/pkg/warewulfd/server/server.go b/internal/pkg/warewulfd/server/server.go index 4b4f30e6..bca975bb 100644 --- a/internal/pkg/warewulfd/server/server.go +++ b/internal/pkg/warewulfd/server/server.go @@ -122,8 +122,8 @@ func RunServer() error { } httpsHandler := configureRootHandler(apiHandler) go func() { - wwlog.Info("Starting HTTPS service on port %d", conf.Warewulf.TlsPort) - if err := http.ListenAndServeTLS(":"+strconv.Itoa(conf.Warewulf.TlsPort), crt, key, httpsHandler); err != nil { + wwlog.Info("Starting HTTPS service on port %d", conf.Warewulf.TLSPort) + if err := http.ListenAndServeTLS(":"+strconv.Itoa(conf.Warewulf.TLSPort), crt, key, httpsHandler); err != nil { errChan <- fmt.Errorf("could not start HTTPS service: %w", err) } }() diff --git a/overlays/wwinit/rootfs/warewulf/config.ww b/overlays/wwinit/rootfs/warewulf/config.ww index 4863d9ee..c2881256 100644 --- a/overlays/wwinit/rootfs/warewulf/config.ww +++ b/overlays/wwinit/rootfs/warewulf/config.ww @@ -12,5 +12,5 @@ WWIPMI_WRITE="{{$.Ipmi.Write.Bool}}" WWIPMI_VLAN="{{$.Ipmi.Tags.vlan}}" {{- end }} WWTLS={{$.Warewulf.TLSEnabled}} -WWTLSPORT={{$.Warewulf.TlsPort}} +WWTLSPORT={{$.Warewulf.TLSPort}} WWIPADDR={{$.Ipaddr}}