2a8d2638b3
This patch set implements the PKICatalog [0] requirements as well as PeglegManagedDocument [1] generation requirements outlined in the spec [2]. Included in this patch set: * New CLI entry point called "pegleg site secrets generate-pki" * PeglegManagedDocument generation logic in engine.cache.managed_document * Refactored PKICatalog logic in engine.cache.pki_catalog derived from the Promenade PKI implementation [3], responsible for generating certificates, CAs, and keypairs * Refactored PKIGenerator logic in engine.cache.pki_generator derived from Promenade Generator implementation [4], responsible for reading in pegleg/PKICatalog/v1 documents (as well as promenade/PKICatalog/v1 documents for backwards compatibility) and generating required secrets and storing them into the paths specified under [0] * Unit tests for all of the above [5] * Example pki-catalog.yaml document under pegleg/site_yamls * Validation schema for pki-catalog.yaml (TODO: implement validation logic here: [6]) * Updates to CLI documentation and inclusion of PKICatalog and PeglegManagedDocument documentation * Documentation updates with PKI information [7] TODO (in follow-up patch sets): * Expand on overview documentation to include new Pegleg responsibilities * Allow the original repository (not the copied one) to be the destination where the secrets are written to * Finish up cert expiry/revocation logic [0] https://airship-specs.readthedocs.io/en/latest/specs/approved/pegleg-secrets.html#document-generation [1] https://airship-specs.readthedocs.io/en/latest/specs/approved/pegleg-secrets.html#peglegmanageddocument [2] https://airship-specs.readthedocs.io/en/latest/specs/approved/pegleg-secrets.html [3] https://github.com/openstack/airship-promenade/blob/master/promenade/pki.py [4] https://github.com/openstack/airship-promenade/blob/master/promenade/generator.py [5] https://review.openstack.org/#/c/611739/ [6] https://review.openstack.org/#/c/608159/ [7] https://review.openstack.org/#/c/611738/ Change-Id: I3010d04cac6d22c656d144f0dafeaa5e19a13068
121 lines
4.1 KiB
YAML
121 lines
4.1 KiB
YAML
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
- project:
|
|
templates:
|
|
- openstack-python36-jobs
|
|
- openstack-cover-jobs
|
|
- release-notes-jobs-python3
|
|
check:
|
|
jobs:
|
|
- openstack-tox-pep8
|
|
- airship-pegleg-tox-py36
|
|
- airship-pegleg-doc-build
|
|
- airship-pegleg-docker-build-gate
|
|
gate:
|
|
jobs:
|
|
- openstack-tox-pep8
|
|
- airship-pegleg-tox-py36
|
|
- airship-pegleg-doc-build
|
|
- airship-pegleg-docker-build-gate
|
|
post:
|
|
jobs:
|
|
- airship-pegleg-docker-publish
|
|
|
|
- nodeset:
|
|
name: airship-pegleg-single-node
|
|
nodes:
|
|
- name: primary
|
|
label: ubuntu-xenial
|
|
|
|
- job:
|
|
name: airship-pegleg-tox-py36
|
|
description: |
|
|
Executes unit tests under Python 3.6
|
|
parent: openstack-tox-py36
|
|
pre-run:
|
|
- tools/gate/playbooks/install-cfssl.yaml
|
|
irrelevant-files:
|
|
- ^.*\.rst$
|
|
- ^doc/.*$
|
|
- ^etc/.*$
|
|
- ^releasenotes/.*$
|
|
- ^setup.cfg$
|
|
|
|
- job:
|
|
name: airship-pegleg-doc-build
|
|
description: |
|
|
Locally build the documentation to check for errors
|
|
run: tools/gate/playbooks/doc-build.yaml
|
|
timeout: 300
|
|
nodeset: airship-pegleg-single-node
|
|
irrelevant-files:
|
|
- ^tests/.*$
|
|
- ^setup.cfg$
|
|
|
|
- job:
|
|
name: airship-pegleg-docker-build-gate
|
|
timeout: 1800
|
|
run: tools/gate/playbooks/docker-image-build.yaml
|
|
nodeset: airship-pegleg-single-node
|
|
irrelevant-files:
|
|
- '^doc/.*'
|
|
vars:
|
|
publish: false
|
|
tags:
|
|
dynamic:
|
|
patch_set: true
|
|
|
|
- job:
|
|
name: airship-pegleg-docker-publish
|
|
timeout: 1800
|
|
run: tools/gate/playbooks/docker-image-build.yaml
|
|
nodeset: airship-pegleg-single-node
|
|
secrets:
|
|
- airship_pegleg_quay_creds
|
|
irrelevant-files:
|
|
- '^doc/.*'
|
|
vars:
|
|
publish: true
|
|
tags:
|
|
dynamic:
|
|
branch: true
|
|
commit: true
|
|
static:
|
|
- latest
|
|
|
|
- secret:
|
|
name: airship_pegleg_quay_creds
|
|
data:
|
|
username: !encrypted/pkcs1-oaep
|
|
- BI1sCnCyps8RaXf/BQ2ZtobrXn4MfnimRr5wE5Rv3U95NCCK5EoUwBEvnz7yNmQ8m99D7
|
|
9Gx4qA0N1ry7QL+o2Ll0D/ahb/HsaVBNU3CeVfe+3shpEVEuSi2xrA8K9LQPfIK1237vr
|
|
wVvN/R+y/uYm7mpPr/aEPjQwJf3wgEK8xV/ZTvqYSVCpGylbfV0tWxm6uEVdBc1kMPLJN
|
|
8uItJPaAaYMkFEasnVlI/DV8suiK13BLT7bNpNZBQsQ3AlcBCoq9mt50C3slV1wIneaz9
|
|
qK+O++z7r8OTWUDMQqWE5d1m6jz1WIp5DROmnOvb9dfS73XsTcgmXwilrQt3VSvFCToga
|
|
gAVHcoWbIKfxgrbOhoLFr+68id3VwVKN+NXgkoxTAJSzFCWwrs0X4n4W6D4O9buQyFTiZ
|
|
s9o5rB1f2bdF5iI8Npqg6YchPtWn2eR78w1hRyge2HJk2RQgN1CqjpbiQ0uiEy0QA/Ksu
|
|
VTtuONyV3T7FUYXaK3cHYrCwhV/idquSNRCWnKQAbs8mU8w298UbpOq4lZk1Njeg9StIs
|
|
0DYyG1SX2k4mBS4//9i488qBSss2CBMhZWHbesSDi/OW4fNzz/2wm2FaW1uaJJSOTXEyJ
|
|
E3p4+eejcYknXR+XD6BWfSvSwabsCezGSCg7wg7CRFsuTYXx5a4y/+P8Jh+Y7Y=
|
|
password: !encrypted/pkcs1-oaep
|
|
- x/0RHX1OlOfFgyb5ed0sknZQi8waSQLzWv+Aog0CziVMf9r3MtZ29LAcrqp9VUdFRYGCk
|
|
Hf71TJb1Zb8b+WNcUJH2JjVo//Z1smU5F5xEqzhz0gTm1HYQjMAlqd1VNDYv0IpWl2dLE
|
|
sGnEOT/Uq0RfH3rRt+33GagmXBUNuOIMdx41ubrMaF6ddg8IbjISRaCdfPOlNIrj24gCj
|
|
a16UNiSyAhvqkod2G2HO7JE7Nv2//5hI1MD1o7sip8/eub12XtHMjpDRKR+KymX81LGAS
|
|
PeCAn+Hw41uUKnxI/OTW47YtNvQVZZ4gRTOKTumsSNSceFfbf5ljm/JHTWx0SO6Z/kvzH
|
|
RAJwBmLPHg7leD2wF9vWXwcmlyWJFyeEW/K/+6gYycQ2H0OnRuRxzYaNpSa96zPWUfNsA
|
|
3TEKJcXjFXJSr00KnWmUZw8ZmPYAziu+pZoBXpkIhYoP1MAtggv/pvVsODDHmokP9nVE6
|
|
s6YbtUXzthM/TgsE5KMZ2QP4udetj11RGDC+7fz/edtLcrpL3Nrq2rkJ2tRV+yR1ElKGx
|
|
b2YX7cwM/vx3DPhWRBPJJfOoSRl+ZJByDM1KKWmAB91LT9vB3oVk/vq2XUsbTH2w20LcK
|
|
xBXFJMtVHOavHIIWM7qHvkvZzWSBON7ydspje9MbYtTS5/97ccdLxDHA0MX0wM=
|