Pelican fails to start if /etc/pelican/certificates is read-only

[brianhlin]

In Kubernetes, I was mounting the host cert/key to the default locations from a secret, which caused all of /etc/pelican-certificates to be mounted read-only. This then caused Pelican to fail to start up with:

time="2024-02-27T20:31:21Z" level=error msg="Fatal error occurred at the start of the program: Failure when configuring the server: Failed to create new private key file: open /etc/pelican/certificates/tlsca.key: read-only file system"

I'm mounting the cert/key elsewhere now but it would be nice to be able to use the default location.

[bbockelm]

@brianhlin - what if we simply put these in separate directories that don't overlap? Would that solve the probelm?

[brianhlin]

That may be overly optimizing for the k8s model. I think it'd looks a little wonky if the default values are:

/etc/pelican/certificates/host/tls.crt
/etc/pelican/certificates/host/tls.key
/etc/pelican/certificates/ca/tlsca.crt
/etc/pelican/certificates/ca/tlsca.key

Though as I type that out, it's 1) not so bad and 2) it's purely an aesthetic preference

[bbockelm]

I was thinking about maybe flattening things - certificates and internal-ca or somethjng.

[brianhlin]

@bbockelm sure that sounds reasonable to me