cloud_controller_ng post-start still fails with MySQL TLS issuer error when ccdb.ca_cert is absent

[iaftab-alam]

Summary

Our WG validation job is failing in bosh-deploy-cf-develop with a cloud_controller_ng post-start failure.

The failure appears to be a remaining uncovered MySQL TLS path: MARIADB_TLS_DISABLE_PEER_VERIFICATION is present in BPM/pre-start, but not in cloud_controller_ng/bin/post-start. The post-start script runs buildpacks:install, which opens a ccdb connection and still fails when ccdb.ca_cert is absent.

Environment

upgrade-trelawney in our cf-d pipelines

Failure

Error: Action Failed get_task:
1 of 4 post-start scripts failed.
Failed Jobs: cloud_controller_ng.
Successful Jobs: bosh-dns, policy-server, policy-server-internal.

From cloud_controller_ng/post-start.stderr.log:

+ install_buildpacks
+ chpst -u vcap:vcap bundle exec rake buildpacks:install
rake aborted!
Sequel::DatabaseConnectionError:
Mysql2::Error::ConnectionError:
TLS/SSL error: unable to get local issuer certificate

The stack traces:

mysql2/client.rb:92:in `connect'
cloud_controller/db.rb:61:in `get_connection'
cloud_controller/db.rb:30:in `connect'
cloud_controller/db.rb:90:in `load_models'
cloud_controller/background_job_environment.rb:18:in `setup_environment'
cloud_controller_ng/lib/tasks/buildpacks.rake:5

VM Verification

MARIADB_TLS_DISABLE_PEER_VERIFICATION is present in BPM and pre-start:

/var/vcap/jobs/cloud_controller_ng/config/bpm.yml:17:    MARIADB_TLS_DISABLE_PEER_VERIFICATION: '1'
/var/vcap/jobs/cloud_controller_ng/config/bpm.yml:51:    MARIADB_TLS_DISABLE_PEER_VERIFICATION: '1'
/var/vcap/jobs/cloud_controller_ng/config/bpm.yml:66:    MARIADB_TLS_DISABLE_PEER_VERIFICATION: '1'
/var/vcap/jobs/cloud_controller_ng/bin/pre-start:14:export MARIADB_TLS_DISABLE_PEER_VERIFICATION="1"

But it is not present in cloud_controller_ng/bin/post-start:

30:function install_buildpacks {
33:    chpst -u vcap:vcap bundle exec rake buildpacks:install
44:  install_buildpacks

Question

Should cloud_controller_ng/bin/post-start also conditionally export:

MARIADB_TLS_DISABLE_PEER_VERIFICATION=1

when ccdb.db_scheme is mysql and ccdb.ca_cert is not configured?