Merge "Fix Galera self-signed SSL functionality"
This commit is contained in:
commit
ea327ee579
|
@ -21,11 +21,12 @@
|
||||||
- "{{ galera_ssl_ca_cert }}"
|
- "{{ galera_ssl_ca_cert }}"
|
||||||
- "{{ galera_ssl_cert }}"
|
- "{{ galera_ssl_cert }}"
|
||||||
- "{{ galera_ssl_key }}"
|
- "{{ galera_ssl_key }}"
|
||||||
|
- "{{ galera_ssl_ca_cert | dirname }}/galera-csr.pem"
|
||||||
when:
|
when:
|
||||||
- galera_ssl_self_signed_regen | bool
|
- galera_ssl_self_signed_regen | bool
|
||||||
- inventory_hostname == galera_server_bootstrap_node
|
- inventory_hostname == galera_server_bootstrap_node
|
||||||
|
|
||||||
- name: Create galera CA cert
|
- name: Create Galera CA cert
|
||||||
command: >
|
command: >
|
||||||
openssl req -new -nodes -x509 -subj
|
openssl req -new -nodes -x509 -subj
|
||||||
"{{ galera_ssl_ca_self_signed_subject }}"
|
"{{ galera_ssl_ca_self_signed_subject }}"
|
||||||
|
@ -36,7 +37,7 @@
|
||||||
- inventory_hostname == galera_server_bootstrap_node
|
- inventory_hostname == galera_server_bootstrap_node
|
||||||
notify: Restart all mysql
|
notify: Restart all mysql
|
||||||
|
|
||||||
- name: Get CA key contents and store as var
|
- name: Get CA cert contents and store as var
|
||||||
slurp:
|
slurp:
|
||||||
src: "{{ galera_ssl_ca_cert }}"
|
src: "{{ galera_ssl_ca_cert }}"
|
||||||
register: galera_ca
|
register: galera_ca
|
||||||
|
@ -44,21 +45,21 @@
|
||||||
when:
|
when:
|
||||||
- inventory_hostname == galera_server_bootstrap_node
|
- inventory_hostname == galera_server_bootstrap_node
|
||||||
|
|
||||||
- name: Register a fact for the CA key
|
- name: Register a fact for the CA cert
|
||||||
set_fact:
|
set_fact:
|
||||||
galera_server_ca_key: "{{ galera_ca.content }}"
|
galera_server_ca_cert: "{{ galera_ca.content }}"
|
||||||
when:
|
when:
|
||||||
- inventory_hostname == galera_server_bootstrap_node
|
- inventory_hostname == galera_server_bootstrap_node
|
||||||
|
|
||||||
- name: Create galera ssl request
|
- name: Create Galera SSL CSR
|
||||||
command: >
|
command: >
|
||||||
openssl req -new -nodes -sha256 -subj
|
openssl req -new -nodes -sha256 -subj
|
||||||
"{{ galera_ssl_self_signed_subject }}"
|
"{{ galera_ssl_self_signed_subject }}"
|
||||||
-days 3650
|
-days 3650
|
||||||
-keyout {{ galera_ssl_key }}
|
-keyout {{ galera_ssl_key }}
|
||||||
-out {{ galera_ssl_ca_cert | dirname }}/galera-req.pem
|
-out {{ galera_ssl_ca_cert | dirname }}/galera-csr.pem
|
||||||
-extensions v3_ca
|
-extensions v3_ca
|
||||||
creates={{ galera_ssl_ca_cert | dirname }}/galera-req.pem
|
creates={{ galera_ssl_ca_cert | dirname }}/galera-csr.pem
|
||||||
register: create_galera_ssl_request
|
register: create_galera_ssl_request
|
||||||
when:
|
when:
|
||||||
- inventory_hostname == galera_server_bootstrap_node
|
- inventory_hostname == galera_server_bootstrap_node
|
||||||
|
@ -74,25 +75,25 @@
|
||||||
- inventory_hostname == galera_server_bootstrap_node
|
- inventory_hostname == galera_server_bootstrap_node
|
||||||
notify: Restart all mysql
|
notify: Restart all mysql
|
||||||
|
|
||||||
- name: Get REQ key contents and store as var
|
- name: Get CSR private key contents and store as var
|
||||||
slurp:
|
slurp:
|
||||||
src: "{{ galera_ssl_ca_cert | dirname }}/galera-req.pem"
|
src: "{{ galera_ssl_key }}"
|
||||||
register: galera_req
|
register: galera_private_key
|
||||||
changed_when: false
|
changed_when: false
|
||||||
when:
|
when:
|
||||||
- inventory_hostname == galera_server_bootstrap_node
|
- inventory_hostname == galera_server_bootstrap_node
|
||||||
|
|
||||||
- name: Register a fact for the REQ key
|
- name: Register a fact for the CSR private key
|
||||||
set_fact:
|
set_fact:
|
||||||
galera_server_req_key: "{{ galera_req.content }}"
|
galera_server_private_key: "{{ galera_private_key.content }}"
|
||||||
when:
|
when:
|
||||||
- inventory_hostname == galera_server_bootstrap_node
|
- inventory_hostname == galera_server_bootstrap_node
|
||||||
|
|
||||||
- name: Create galera ssl cert
|
- name: Create Galera SSL signed cert
|
||||||
command: >
|
command: >
|
||||||
openssl x509 -req
|
openssl x509 -req
|
||||||
-days 3650
|
-days 3650
|
||||||
-in {{ galera_ssl_ca_cert | dirname }}/galera-req.pem
|
-in {{ galera_ssl_ca_cert | dirname }}/galera-csr.pem
|
||||||
-CA {{ galera_ssl_ca_cert }}
|
-CA {{ galera_ssl_ca_cert }}
|
||||||
-CAkey {{ galera_ssl_key | dirname }}/galera-ca.key
|
-CAkey {{ galera_ssl_key | dirname }}/galera-ca.key
|
||||||
-out {{ galera_ssl_cert }}
|
-out {{ galera_ssl_cert }}
|
||||||
|
@ -102,7 +103,7 @@
|
||||||
- inventory_hostname == galera_server_bootstrap_node
|
- inventory_hostname == galera_server_bootstrap_node
|
||||||
notify: Restart all mysql
|
notify: Restart all mysql
|
||||||
|
|
||||||
- name: Get CERT key contents and store as var
|
- name: Get signed cert contents and store as var
|
||||||
slurp:
|
slurp:
|
||||||
src: "{{ galera_ssl_cert }}"
|
src: "{{ galera_ssl_cert }}"
|
||||||
register: galera_cert
|
register: galera_cert
|
||||||
|
@ -110,13 +111,13 @@
|
||||||
when:
|
when:
|
||||||
- inventory_hostname == galera_server_bootstrap_node
|
- inventory_hostname == galera_server_bootstrap_node
|
||||||
|
|
||||||
- name: Register a fact for the CERT key
|
- name: Register a fact for the signed cert contents
|
||||||
set_fact:
|
set_fact:
|
||||||
galera_server_cert_key: "{{ galera_cert.content }}"
|
galera_server_cert: "{{ galera_cert.content }}"
|
||||||
when:
|
when:
|
||||||
- inventory_hostname == galera_server_bootstrap_node
|
- inventory_hostname == galera_server_bootstrap_node
|
||||||
|
|
||||||
- name: Copy CA cert and key (SELF)
|
- name: Copy CA cert, private key, and signed cert (SELF)
|
||||||
copy:
|
copy:
|
||||||
content: "{{ hostvars[galera_server_bootstrap_node][item.key] | b64decode }}"
|
content: "{{ hostvars[galera_server_bootstrap_node][item.key] | b64decode }}"
|
||||||
dest: "{{ item.dest }}"
|
dest: "{{ item.dest }}"
|
||||||
|
@ -124,12 +125,12 @@
|
||||||
group: "mysql"
|
group: "mysql"
|
||||||
mode: "{{ item.mode | default('0640') }}"
|
mode: "{{ item.mode | default('0640') }}"
|
||||||
with_items:
|
with_items:
|
||||||
- key: "galera_server_ca_key"
|
- key: "galera_server_ca_cert"
|
||||||
dest: "{{ galera_ssl_ca_cert }}"
|
dest: "{{ galera_ssl_ca_cert }}"
|
||||||
- key: "galera_server_req_key"
|
- key: "galera_server_private_key"
|
||||||
dest: "{{ galera_ssl_cert }}"
|
|
||||||
- key: "galera_server_cert_key"
|
|
||||||
dest: "{{ galera_ssl_key }}"
|
dest: "{{ galera_ssl_key }}"
|
||||||
|
- key: "galera_server_cert"
|
||||||
|
dest: "{{ galera_ssl_cert }}"
|
||||||
mode: "0600"
|
mode: "0600"
|
||||||
when:
|
when:
|
||||||
- inventory_hostname != galera_server_bootstrap_node
|
- inventory_hostname != galera_server_bootstrap_node
|
||||||
|
|
Loading…
Reference in New Issue