puppet-octavia/manifests/certificates.pp

207 lines
6.9 KiB
Puppet

# == Class: octavia::certificates
#
# Configure the octavia certificates for TLS authentication
#
# === Parameters
#
# [*cert_generator*]
# (Optional) Certificate generator to use.
# Defaults to $::os_service_default
#
# [*cert_manager*]
# (Optional) Certificate manager to use.
# Defaults to $::os_service_default
#
# [*region_name*]
# (Optional) Region name to use when connecting to cert manager.
# Defaults to $::os_service_default
#
# [*endpoint_type*]
# (Optional) Endpoint type to use when connecting to cert manager.
# Defaults to $::os_service_default
#
# [*ca_certificate*]
# (Optional) Path to the CA certificate for Octavia
# Defaults to $::os_service_default
#
# [*ca_private_key*]
# (Optional) Path for private key used to sign certificates
# Defaults to $::os_service_default
#
# [*server_certs_key_passphrase*]
# (Optional) Passphrase for encrypting Amphora Certificates and Private Keys.
# Must be exactly 32 characters.
# Defaults to 'insecure-key-do-not-use-this-key'
#
# [*ca_private_key_passphrase*]
# (Optional) CA password used to sign certificates
# Defaults to $::os_service_default
#
# [*client_ca*]
# (Optional) Path to the client CA certificate.
# This option is not needed unless you want to separate the
# ca_certificate/server_ca and the client_ca.
# Defaults to undef
#
# [*client_cert*]
# (Optional) Path for client certificate used to connect to amphorae.
# Defaults to $::os_service_default
#
# [*ca_certificate_data*]
# (Optional) CA certificate for Octavia
# Defaults to undef
#
# [*ca_private_key_data*]
# (Optional) CA private key for signing certificates
# Defaults to undef
#
# [*client_ca_data*]
# (Optional) Client CA certificate.
# You must specify the client_ca parameter where to place this CA
# if you give the data here.
# Defaults to undef
#
# [*client_cert_data*]
# (Optional) Client certificate used for connecting to amphorae
# Defaults to undef
#
# [*file_permission_owner*]
# (Optional) User account for file owner.
# Defaults to 'octavia'
#
# [*file_permission_group*]
# (Optional) User group for file permissions
# Defaults to 'octavia'
#
class octavia::certificates (
$cert_generator = $::os_service_default,
$cert_manager = $::os_service_default,
$region_name = $::os_service_default,
$endpoint_type = $::os_service_default,
$ca_certificate = $::os_service_default,
$ca_private_key = $::os_service_default,
$server_certs_key_passphrase = 'insecure-key-do-not-use-this-key',
$ca_private_key_passphrase = $::os_service_default,
$client_ca = undef,
$client_cert = $::os_service_default,
$ca_certificate_data = undef,
$ca_private_key_data = undef,
$client_ca_data = undef,
$client_cert_data = undef,
$file_permission_owner = 'octavia',
$file_permission_group = 'octavia'
) {
include octavia::deps
$client_ca_real = pick($client_ca, $ca_certificate)
octavia_config {
'certificates/cert_generator' : value => $cert_generator;
'certificates/cert_manager' : value => $cert_manager;
'certificates/region_name' : value => $region_name;
'certificates/endpoint_type' : value => $endpoint_type;
'certificates/ca_certificate' : value => $ca_certificate;
'certificates/ca_private_key' : value => $ca_private_key;
'certificates/server_certs_key_passphrase' : value => $server_certs_key_passphrase;
'certificates/ca_private_key_passphrase' : value => $ca_private_key_passphrase;
'controller_worker/client_ca' : value => $client_ca_real;
'haproxy_amphora/client_cert' : value => $client_cert;
'haproxy_amphora/server_ca' : value => $ca_certificate;
}
if !$server_certs_key_passphrase {
fail('server_certs_key_passphrase is required for Octavia. Please provide a 32 characters passphrase.')
}
if length($server_certs_key_passphrase)!=32 {
fail("The passphrase '${server_certs_key_passphrase}' is invalid for server_certs_key_passphrase. Please provide a 32 characters
passphrase.")
}
# The file creation will create the parent directory for each file if necessary, but
# only to one level.
if $ca_certificate_data {
if is_service_default($ca_certificate) {
fail('You must provide a path for storing the CA certificate')
}
ensure_resource('file', dirname($ca_certificate), {
ensure => directory,
owner => $file_permission_owner,
group => $file_permission_group,
mode => '0755',
tag => 'octavia-certificate',
})
file { $ca_certificate:
ensure => file,
content => $ca_certificate_data,
group => $file_permission_owner,
owner => $file_permission_group,
mode => '0755',
replace => true,
show_diff => false,
tag => 'octavia-certificate',
}
}
if $ca_private_key_data {
if is_service_default($ca_private_key) {
fail('You must provide a path for storing the CA private key')
}
ensure_resource('file', dirname($ca_private_key), {
ensure => directory,
owner => $file_permission_owner,
group => $file_permission_group,
mode => '0755',
tag => 'octavia-certificate',
})
file { $ca_private_key:
ensure => file,
content => $ca_private_key_data,
group => $file_permission_owner,
owner => $file_permission_group,
mode => '0755',
replace => true,
show_diff => false,
tag => 'octavia-certificate',
}
}
if $client_ca and $client_ca_data {
ensure_resource('file', dirname($client_ca), {
ensure => directory,
owner => $file_permission_owner,
group => $file_permission_group,
mode => '0755',
tag => 'octavia-certificate',
})
file { $client_ca:
ensure => file,
content => $client_ca_data,
group => $file_permission_owner,
owner => $file_permission_group,
mode => '0755',
replace => true,
show_diff => false,
tag => 'octavia-certificate',
}
}
if $client_cert_data {
if is_service_default($client_cert) {
fail('You must provide a path for storing the client certificate')
}
ensure_resource('file', dirname($client_cert), {
ensure => directory,
owner => $file_permission_owner,
group => $file_permission_group,
mode => '0755',
tag => 'octavia-certificate',
})
file { $client_cert:
ensure => file,
content => $client_cert_data,
group => $file_permission_owner,
owner => $file_permission_group,
mode => '0755',
replace => true,
show_diff => false,
tag => 'octavia-certificate',
}
}
}