Fix ironic-python-agent - CA bundle inject

[hjensas]

Currently the pxe-init script copies the certificate bundle directly to /etc/pki/ca-trust/extracted in the initramfs. When update-ca-trust runs under chroot the contents under pki/ca-trust/extracted is overwritten. See manual page: update-ca-trust(8) "EXTRACTED CONFIGURATION" section.

With this change the bundle is copied to /etc/pki/ca-trust/source/anchors directory in the initramfs instead, so that update-ca-trust will find the source and update CA certs and trusts correctly.

Jira: OSPRH-12526

[stuggi]

do we need this? our big ca bundle already has the internal-ca-bundle included.

[hjensas]

do we need this? our big ca bundle already has the internal-ca-bundle included.

Thanks Martin!
It is possible my root cause analysis is wrong.

We are injecting that (or atleast we intend to) since: #491

also after looking more at the lib-common, I think this patch would actually just mount the big ca bundle again under a different name. Anyhow ... I'll go back to figuring out the root cause.

[hjensas]

/recheck

[softwarefactory-project-zuul]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/69dabee1829c403a9edce379789c5bad

✔️ noop SUCCESS in 0s
✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 06m 52s
❌ podified-multinode-ironic-deployment POST_FAILURE in 47m 40s

[hjensas]

recheck

Task 
Collect logs, artifacts and docs
  failed running on host 
controller

kex_exchange_identification: read: Connection reset by peer

rsync: connection unexpectedly closed (0 bytes received so far) [Receiver]
rsync error: error in rsync protocol data stream (code 12) at io.c(226) [Receiver=3.1.3]

[steveb]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hjensas, steveb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [hjensas,steveb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hjensas]

/test ironic-operator-build-deploy-kuttl