From 9aef6dd9818176a2fc5c089dff694118beb5a9a5 Mon Sep 17 00:00:00 2001 From: Damian Dabrowski Date: Wed, 7 May 2025 19:01:56 +0200 Subject: [PATCH] Add hashi_vault pki backend support This patch defines necessary variables for the 'hashi_vault' pki backend which is the alternative to the default 'standalone' backend. Additionally, it: - changes the format of 'san' parameter to the new one changed in [1] - passes `pki_default_backend` when trigerring PKI role so its aware of the default backend in case it's not explicitly specified in the cert definition. - adopts this role to the recent changes in PKI role [2][3][4] [1] https://review.opendev.org/c/openstack/openstack-ansible/+/948886 [2] https://opendev.org/openstack/ansible-role-pki/commit/fc7db0207421dc97b484cf2ef04784292cc683f2 [3] https://opendev.org/openstack/ansible-role-pki/commit/7cff89ee71ea99cbe1fd16f01f8341b3609b793b [4] https://opendev.org/openstack/ansible-role-pki/commit/f03bcc19d585f0e5fc67146015c44b9650b2fe13 Signed-off-by: Damian Dabrowski Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/948881 Change-Id: I914b9531822d600ae40b0d7400fda4184ef45e0d --- defaults/main.yml | 35 ++++++++++++++++++++++++----------- tasks/main.yml | 3 ++- templates/rabbitmq.conf.j2 | 4 ++-- 3 files changed, 28 insertions(+), 14 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index ead4eb9d..8c419a86 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -151,11 +151,18 @@ rabbitmq_pki_intermediate_cert_name: "{{ openstack_pki_service_intermediate_cert rabbitmq_pki_intermediate_cert_path: >- {{ rabbitmq_pki_dir ~ '/roots/' ~ rabbitmq_pki_intermediate_cert_name ~ '/certs/' ~ rabbitmq_pki_intermediate_cert_name ~ '.crt' }} rabbitmq_pki_regen_cert: "" +rabbitmq_pki_backend: "{{ openstack_pki_backend | default('standalone') }}" rabbitmq_pki_certificates: - name: "rabbitmq_{{ ansible_facts['hostname'] }}" - provider: ownca cn: "{{ ansible_facts['hostname'] }}" - san: "{{ 'DNS:' ~ ansible_facts['hostname'] ~ ',IP:' ~ rabbitmq_node_address ~ ',DNS:' ~ ansible_facts['fqdn'] }}" + san: + dns: + - "{{ ansible_facts['hostname'] }}" + - "{{ ansible_facts['fqdn'] }}" + ip: + - "{{ rabbitmq_node_address }}" + # standalone backend only + provider: ownca signed_by: "{{ rabbitmq_pki_intermediate_cert_name }}" # RabbitMQ destination files for SSL certificates @@ -165,27 +172,33 @@ rabbitmq_ssl_ca_cert: /etc/rabbitmq/rabbitmq-ca.pem # Installation details for SSL certificates rabbitmq_pki_install_certificates: - - src: "{{ rabbitmq_user_ssl_cert | default(rabbitmq_pki_certs_path ~ 'rabbitmq_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}" + - name: "rabbitmq_{{ ansible_facts['hostname'] }}" + type: "certificate_chain" dest: "{{ rabbitmq_ssl_cert }}" owner: "rabbitmq" group: "rabbitmq" - mode: "0644" - - src: "{{ rabbitmq_user_ssl_key | default(rabbitmq_pki_keys_path ~ 'rabbitmq_' ~ ansible_facts['hostname'] ~ '.key.pem') }}" + # standalone backend only + src: "{{ rabbitmq_user_ssl_cert }}" + - name: "rabbitmq_{{ ansible_facts['hostname'] }}" + type: "private_key" dest: "{{ rabbitmq_ssl_key }}" owner: "rabbitmq" group: "rabbitmq" - mode: "0600" - - src: "{{ rabbitmq_user_ssl_ca_cert | default(rabbitmq_pki_intermediate_cert_path) }}" + # standalone backend only + src: "{{ rabbitmq_user_ssl_key }}" + - name: "rabbitmq_{{ ansible_facts['hostname'] }}" + type: "ca_bundle" dest: "{{ rabbitmq_ssl_ca_cert }}" owner: "rabbitmq" group: "rabbitmq" - mode: "0644" + # standalone backend only + src: "{{ rabbitmq_user_ssl_ca_cert }}" # Define user-provided SSL certificates in: # /etc/openstack_deploy/user_variables.yml -# rabbitmq_user_ssl_cert: -# rabbitmq_user_ssl_key: -# rabbitmq_user_ssl_ca_cert: +rabbitmq_user_ssl_cert: "" +rabbitmq_user_ssl_key: "" +rabbitmq_user_ssl_ca_cert: "" # These are highly recommended for TLSv1.2 but cannot be used # with TLSv1.3. If TLSv1.3 is enabled, these lines will not be diff --git a/tasks/main.yml b/tasks/main.yml index 8dd3a36c..e3d3e438 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -50,13 +50,14 @@ name: pki tasks_from: "{{ rabbitmq_pki_create_ca | ternary('main.yml', 'main_certs.yml') }}" vars: + pki_backend: "{{ rabbitmq_pki_backend }}" pki_setup_host: "{{ rabbitmq_pki_setup_host }}" pki_dir: "{{ rabbitmq_pki_dir }}" pki_create_ca: "{{ rabbitmq_pki_create_ca }}" pki_regen_ca: "{{ rabbitmq_pki_regen_ca }}" pki_authorities: "{{ rabbitmq_pki_authorities }}" pki_install_ca: "{{ rabbitmq_pki_install_ca }}" - pki_create_certificates: "{{ rabbitmq_user_ssl_cert is not defined and rabbitmq_user_ssl_key is not defined }}" + pki_create_certificates: "{{ rabbitmq_user_ssl_cert | length == 0 and rabbitmq_user_ssl_key | length == 0 }}" pki_regen_cert: "{{ rabbitmq_pki_regen_cert }}" pki_certificates: "{{ rabbitmq_pki_certificates }}" pki_install_certificates: "{{ rabbitmq_pki_install_certificates }}" diff --git a/templates/rabbitmq.conf.j2 b/templates/rabbitmq.conf.j2 index ab010e2a..061ce687 100644 --- a/templates/rabbitmq.conf.j2 +++ b/templates/rabbitmq.conf.j2 @@ -26,7 +26,7 @@ listeners.{{ _opt }}.{{ loop.index }} = {{ _key }}:{{ _value }} ssl_options.certfile = {{ rabbitmq_ssl_cert }} ssl_options.keyfile = {{ rabbitmq_ssl_key }} -{% if rabbitmq_user_ssl_ca_cert is defined -%} +{% if rabbitmq_user_ssl_ca_cert | length > 0 -%} ssl_options.cacertfile = {{ rabbitmq_ssl_ca_cert }} {% endif %} ssl_options.honor_cipher_order = true @@ -59,7 +59,7 @@ management.ssl.ip = {{ rabbitmq_management_bind_address }} management.ssl.port = {{ rabbitmq_management_bind_tls_port }} management.ssl.certfile = {{ rabbitmq_ssl_cert }} management.ssl.keyfile = {{ rabbitmq_ssl_key }} -{% if rabbitmq_user_ssl_ca_cert is defined -%} +{% if rabbitmq_user_ssl_ca_cert | length > 0 -%} management.ssl.cacertfile = {{ rabbitmq_ssl_ca_cert }} {% endif %} management.ssl.honor_cipher_order = true