Repository: chef/automate
Pull request #8232 (2023-09-15 13:22:08)

check only empty field for config_file path
### :nut_and_bolt: Description: What code changed, and why?

<!-- /!\ Please ensure that you are NOT disclosing any customer information without their consent /!\ -->

### :chains: Related Resources

### :+1: Definition of Done

### :athletic_shoe: How to Build and Test the Change

### :white_check_mark: Checklist

**All PRs** must tick these:

- [ ] I have read the [CONTRIBUTING document](https://github.com/chef/automate/blob/master/CONTRIBUTING.md).
- [ ] All commits signed-off for the [Developer Certification of Origin](https://github.com/chef/chef/blob/master/CONTRIBUTING.md#developer-certification-of-origin-dco).

With occasional exceptions, all PRs **from Progress employees** must tick these:

- [ ] Is the code clear? *(complicated code or lots of comments--subdivide and use well-named methods, meaningful variable names, etc.)*
- [ ] Consistency checked? *(user notifications, user prompts, visual patterns, code patterns, variable names)*
- [ ] Repeated code blocks eliminated? *(adapt and reuse existing components, blocks, functions, etc.)*
- [ ] Spelling, grammar, typos checked? *(at a minimum use `make spell` in any component directory)*
- [ ] Code well-formatted? *(indents, line breaks, etc. improve rather than hinder readability)*

All PRs **from Progress employees** should tick these if appropriate:

- [ ] Tests added/updated? (all new code needs new tests)
- [ ] Docs added/updated? (all customer-facing changes)

*Please add a note next to any checkbox above if you are NOT ticking it.*

### :camera: Screenshots, if applicable


netlify[bot]: ### <span aria-hidden="true">👷</span> Deploy Preview for *chef-automate* processing.


|  Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | bcaf70553ef2cf46cb63275831c067f4fc50ad26 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/sites/chef-automate/deploys/65045a821b6472000852e172 |

Patch:
diff --git a/VERSION b/VERSION
index d68454340..3cfc36663 100644
--- a/VERSION
+++ b/VERSION
@@ -1,1 +1,1 @@
-4.10.16
\ No newline at end of file
+4.10.19
\ No newline at end of file
diff --git a/components/automate-backend-deployment/habitat/plan.sh b/components/automate-backend-deployment/habitat/plan.sh
index 12dae0ad0..f47f2ee54 100644
--- a/components/automate-backend-deployment/habitat/plan.sh
+++ b/components/automate-backend-deployment/habitat/plan.sh
@@ -115,3 +115,5 @@ do_install() {
 do_strip() {
   return 0
 }
+
+
diff --git a/components/automate-cli/cmd/chef-automate/pullAndGenerateConfig.go b/components/automate-cli/cmd/chef-automate/pullAndGenerateConfig.go
index 6cb46003f..a8ee4a157 100644
--- a/components/automate-cli/cmd/chef-automate/pullAndGenerateConfig.go
+++ b/components/automate-cli/cmd/chef-automate/pullAndGenerateConfig.go
@@ -561,11 +561,8 @@ func (p *PullConfigsImpl) fetchInfraConfig() (*ExistingInfraConfigToml, error) {
 		sharedConfigToml.Automate.Config.Fqdn = a2Fqdn
 	}
 
-	root_ca, fqdn, err := getChefServerFqdnAndLBRootCA(EXISTING_INFRA_MODE)
-	if err != nil {
-		return nil, status.Wrap(err, status.ConfigError, "unable to fetch Chef Server FQDN and LB_ROOT_CA")
-	}
-	sharedConfigToml.ChefServer.Config.RootCA, sharedConfigToml.ChefServer.Config.Fqdn = root_ca, fqdn
+	fqdn, root_ca := getChefServerFqdnAndLBRootCA(a2ConfigMap)
+	sharedConfigToml.ChefServer.Config.Fqdn, sharedConfigToml.ChefServer.Config.RootCA = fqdn, root_ca
 
 	return sharedConfigToml, nil
 }
@@ -681,21 +678,13 @@ func setExternalPGDetails(instanceUrl, superUserName, superUserPassword, dBUserN
 	}
 }
 
-func getChefServerFqdnAndLBRootCA(deploymentType string) (string, string, error) {
-	if deploymentType == EXISTING_INFRA_MODE {
-		ExistingInfraConfig, err := getExistingInfraConfig(filepath.Join(initConfigHabA2HAPathFlag.a2haDirPath, "config.toml"))
-		if err != nil {
-			return "", "", err
-		}
-		return ExistingInfraConfig.ChefServer.Config.RootCA, ExistingInfraConfig.ChefServer.Config.Fqdn, nil
-	} else if deploymentType == AWS_MODE {
-		AWSConfig, err := getAwsConfig(filepath.Join(initConfigHabA2HAPathFlag.a2haDirPath, "config.toml"))
-		if err != nil {
-			return "", "", err
+func getChefServerFqdnAndLBRootCA(config map[string]*dc.AutomateConfig) (string, string) {
+	for _, ele := range config {
+		if ele.Global != nil && ele.Global.V1 != nil && ele.Global.V1.ChefServer != nil && len(strings.TrimSpace(ele.Global.V1.ChefServer.Fqdn.Value)) > 0 && len(strings.TrimSpace(ele.Global.V1.ChefServer.RootCa.Value)) > 0 {
+			return ele.Global.V1.ChefServer.Fqdn.Value, ele.Global.V1.ChefServer.RootCa.Value
 		}
-		return AWSConfig.ChefServer.Config.RootCA, AWSConfig.ChefServer.Config.Fqdn, nil
 	}
-	return "", "", errors.New("deployment type unknown")
+	return "", ""
 }
 
 func (p *PullConfigsImpl) getOsCertsByIp(osConfigMap map[string]*ConfigKeys) []CertByIP {
@@ -947,11 +936,8 @@ func (p *PullConfigsImpl) fetchAwsConfig() (*AwsConfigToml, error) {
 		sharedConfigToml.Aws.Config.OsUserAccessKeySecret = objStorageConfig.secrectKey
 	}
 
-	root_ca, fqdn, err := getChefServerFqdnAndLBRootCA(AWS_MODE)
-	if err != nil {
-		return nil, status.Wrap(err, status.ConfigError, "unable to fetch Chef Server FQDN and LB_ROOT_CA")
-	}
-	sharedConfigToml.ChefServer.Config.RootCA, sharedConfigToml.ChefServer.Config.Fqdn = root_ca, fqdn
+	fqdn, root_ca := getChefServerFqdnAndLBRootCA(a2ConfigMap)
+	sharedConfigToml.ChefServer.Config.Fqdn, sharedConfigToml.ChefServer.Config.RootCA = fqdn, root_ca
 
 	return sharedConfigToml, nil
 }
diff --git a/lib/config/hadeployconfigverify.go b/lib/config/hadeployconfigverify.go
index 67eee5024..1a3d8b0e7 100644
--- a/lib/config/hadeployconfigverify.go
+++ b/lib/config/hadeployconfigverify.go
@@ -211,7 +211,7 @@ func (c *HaDeployConfig) verifyAutomateSettings() error {
 	if err := validateNumberField(automateSettings.InstanceCount, "automate instance_count", true); err != nil {
 		errorList.PushBack(err)
 	}
-	if err := validateRequiredString(automateSettings.ConfigFile, "config_file", "configs/automate.toml"); err != nil {
+	if err := validateRequiredString(automateSettings.ConfigFile, "config_file"); err != nil {
 		errorList.PushBack(err)
 	}
 	if err := validatePort(automateSettings.TeamsPort, "teams_port", false); err != nil {
diff --git a/terraform/a2ha-terraform/modules/automate/files/config.toml.erb b/terraform/a2ha-terraform/modules/automate/files/config.toml.erb
index e5937cee9..4e46cd130 100644
--- a/terraform/a2ha-terraform/modules/automate/files/config.toml.erb
+++ b/terraform/a2ha-terraform/modules/automate/files/config.toml.erb
@@ -269,9 +269,12 @@
 <% end %>
 
 <% if overrides[:automate_config_file] %>
-<%= File.read(overrides[:automate_config_file]) %> 
+  <% if File.exist?(overrides[:automate_config_file]) %>
+    <%= File.read(overrides[:automate_config_file]) %>
+  <% end %>
 <% end %>
 
+
 [erchef.v1.sys.api]
   s3_url_ttl = 28800
 
diff --git a/terraform/a2ha-terraform/reference_architectures/existing_nodes/main.tf b/terraform/a2ha-terraform/reference_architectures/existing_nodes/main.tf
index f75391685..7901343ec 100644
--- a/terraform/a2ha-terraform/reference_architectures/existing_nodes/main.tf
+++ b/terraform/a2ha-terraform/reference_architectures/existing_nodes/main.tf
@@ -458,5 +458,5 @@ module "keystore_opensearch" {
   location                    = var.location
   google_service_account_file = var.google_service_account_file
   tmp_path                    = var.tmp_path
-  depends_on                  = [module.bootstrap_automate]
+  depends_on                  = [module.bootstrap_automate, module.opensearch]
 }


Test patch:
diff --git a/components/automate-cli/pkg/verifyserver/models/batchcheck_test.go b/components/automate-cli/pkg/verifyserver/models/batchcheck_test.go
index 9c4e054ae..623b93153 100644
--- a/components/automate-cli/pkg/verifyserver/models/batchcheck_test.go
+++ b/components/automate-cli/pkg/verifyserver/models/batchcheck_test.go
@@ -345,7 +345,7 @@ func TestPopulateWith(t *testing.T) {
 			filePath: "./testdata/InvalidHaOnPrem.toml",
 			want:     &Config{},
 			wantErr:  true,
-			err:      errors.New("invalid or empty: ssh_user\ninvalid or empty: ssh_key_file\nautomate private ip 1324.2534.1is not valid\ninvalid or empty: chef_server_private_ips\ninvalid or empty: opensearch_private_ips\ninvalid or empty: postgresql_private_ips\nurl should not include the protocol (http:// or https://): automate fqdn\nempty value: automate instance_count\ninvalid value 'automate.toml' for field 'config_file'. Expected values are: configs/automate.toml\ninvalid format. Failed to decode root_ca for automate\ninvalid format. Failed to decode private_key for automate\ninvalid format. Failed to decode public_key for automate\ninvalid format. Failed to decode private_key for automate ip\ninvalid format. Failed to decode public_key for automate ip\ninvalid value 'chef server instance_count' for field 'two'\ninvalid format. Failed to decode private_key for chef-infra-server\ninvalid format. Failed to decode public_key for chef-infra-server\ninvalid format. Failed to decode private_key for chef server ip\ninvalid format. Failed to decode public_key for chef server ip\nempty value: opensearch instance_count\nopensearch root_ca and/or admin_key and/or admin_cert and/or public_key and/or private_key are missing. Otherwise set enable_custom_certs to false\nopensearch ip public_key and/or private_key are missing in certs_by_ip. Otherwise set enable_custom_certs to false\nempty value: postgresql instance_count\ninvalid format. Failed to decode root_ca for postgresql\ninvalid format. Failed to decode private_key for postgresql\ninvalid format. Failed to decode public_key for postgresql\npostgresql ip 0.0.1 for certs is not valid\ninvalid format. Failed to decode private_key for postgresql ip\ninvalid format. Failed to decode public_key for postgresql ip"),
+			err:      errors.New("invalid or empty: ssh_user\ninvalid or empty: ssh_key_file\nautomate private ip 1324.2534.1is not valid\ninvalid or empty: chef_server_private_ips\ninvalid or empty: opensearch_private_ips\ninvalid or empty: postgresql_private_ips\nurl should not include the protocol (http:// or https://): automate fqdn\nempty value: automate instance_count\ninvalid format. Failed to decode root_ca for automate\ninvalid format. Failed to decode private_key for automate\ninvalid format. Failed to decode public_key for automate\ninvalid format. Failed to decode private_key for automate ip\ninvalid format. Failed to decode public_key for automate ip\ninvalid value 'chef server instance_count' for field 'two'\ninvalid format. Failed to decode private_key for chef-infra-server\ninvalid format. Failed to decode public_key for chef-infra-server\ninvalid format. Failed to decode private_key for chef server ip\ninvalid format. Failed to decode public_key for chef server ip\nempty value: opensearch instance_count\nopensearch root_ca and/or admin_key and/or admin_cert and/or public_key and/or private_key are missing. Otherwise set enable_custom_certs to false\nopensearch ip public_key and/or private_key are missing in certs_by_ip. Otherwise set enable_custom_certs to false\nempty value: postgresql instance_count\ninvalid format. Failed to decode root_ca for postgresql\ninvalid format. Failed to decode private_key for postgresql\ninvalid format. Failed to decode public_key for postgresql\npostgresql ip 0.0.1 for certs is not valid\ninvalid format. Failed to decode private_key for postgresql ip\ninvalid format. Failed to decode public_key for postgresql ip"),
 		},
 		{
 			name:     "PopulateWith OnPrem Db Aws Managed Config",
diff --git a/lib/config/hadeployconfigverify_test.go b/lib/config/hadeployconfigverify_test.go
index 1d9a6d0dd..0a54625c7 100644
--- a/lib/config/hadeployconfigverify_test.go
+++ b/lib/config/hadeployconfigverify_test.go
@@ -33,7 +33,7 @@ func TestParseAndVerify(t *testing.T) {
 			name:    "Verify OnPrem Config",
 			args:    args{configFile: "./testdata/HaOnPrem.toml"},
 			wantErr: true,
-			err:     errors.New("invalid or empty: ssh_user\ninvalid or empty: ssh_key_file\nautomate private ip 1324.2534.1is not valid\ninvalid or empty: chef_server_private_ips\ninvalid or empty: opensearch_private_ips\ninvalid or empty: postgresql_private_ips\nurl should not include the protocol (http:// or https://): automate fqdn\nempty value: automate instance_count\ninvalid value 'automate.toml' for field 'config_file'. Expected values are: configs/automate.toml\ninvalid format. Failed to decode root_ca for automate\ninvalid format. Failed to decode private_key for automate\ninvalid format. Failed to decode public_key for automate\ninvalid format. Failed to decode private_key for automate ip\ninvalid format. Failed to decode public_key for automate ip\ninvalid value 'chef server instance_count' for field 'two'\ninvalid format. Failed to decode private_key for chef-infra-server\ninvalid format. Failed to decode public_key for chef-infra-server\ninvalid format. Failed to decode private_key for chef server ip\ninvalid format. Failed to decode public_key for chef server ip\nempty value: opensearch instance_count\nopensearch root_ca and/or admin_key and/or admin_cert and/or public_key and/or private_key are missing. Otherwise set enable_custom_certs to false\nopensearch ip public_key and/or private_key are missing in certs_by_ip. Otherwise set enable_custom_certs to false\nempty value: postgresql instance_count\ninvalid format. Failed to decode root_ca for postgresql\ninvalid format. Failed to decode private_key for postgresql\ninvalid format. Failed to decode public_key for postgresql\npostgresql ip 0.0.1 for certs is not valid\ninvalid format. Failed to decode private_key for postgresql ip\ninvalid format. Failed to decode public_key for postgresql ip"),
+			err:     errors.New("invalid or empty: ssh_user\ninvalid or empty: ssh_key_file\nautomate private ip 1324.2534.1is not valid\ninvalid or empty: chef_server_private_ips\ninvalid or empty: opensearch_private_ips\ninvalid or empty: postgresql_private_ips\nurl should not include the protocol (http:// or https://): automate fqdn\nempty value: automate instance_count\ninvalid format. Failed to decode root_ca for automate\ninvalid format. Failed to decode private_key for automate\ninvalid format. Failed to decode public_key for automate\ninvalid format. Failed to decode private_key for automate ip\ninvalid format. Failed to decode public_key for automate ip\ninvalid value 'chef server instance_count' for field 'two'\ninvalid format. Failed to decode private_key for chef-infra-server\ninvalid format. Failed to decode public_key for chef-infra-server\ninvalid format. Failed to decode private_key for chef server ip\ninvalid format. Failed to decode public_key for chef server ip\nempty value: opensearch instance_count\nopensearch root_ca and/or admin_key and/or admin_cert and/or public_key and/or private_key are missing. Otherwise set enable_custom_certs to false\nopensearch ip public_key and/or private_key are missing in certs_by_ip. Otherwise set enable_custom_certs to false\nempty value: postgresql instance_count\ninvalid format. Failed to decode root_ca for postgresql\ninvalid format. Failed to decode private_key for postgresql\ninvalid format. Failed to decode public_key for postgresql\npostgresql ip 0.0.1 for certs is not valid\ninvalid format. Failed to decode private_key for postgresql ip\ninvalid format. Failed to decode public_key for postgresql ip"),
 		},
 		{
 			name:    "Verify OnPrem Db Self-Managed Config",