Remove puppet-certmonger related puppet-files
Implements: blueprint ansible-certmonger Depends-On: https://review.opendev.org/771832 Depends-On: https://review.opendev.org/c/openstack/tripleo-common/+/786053 Change-Id: I5305bce78e9bbf382b00e3f3b5803b983a059db7
This commit is contained in:
Grzegorz Grasza
parent
e3ebbb1143
commit
48832c961c
@ -33,10 +33,6 @@ mod 'fdio',
|
|||||||
:git => 'https://git.fd.io/puppet-fdio',
|
:git => 'https://git.fd.io/puppet-fdio',
|
||||||
:ref => 'master'
|
:ref => 'master'
|
||||||
|
|
||||||
mod 'certmonger',
|
|
||||||
:git => 'https://github.com/saltedsignal/puppet-certmonger',
|
|
||||||
:ref => 'v2.6.0'
|
|
||||||
|
|
||||||
mod 'ptp',
|
mod 'ptp',
|
||||||
:git => 'https://github.com/redhat-nfvpe/ptp',
|
:git => 'https://github.com/redhat-nfvpe/ptp',
|
||||||
:ref => 'master'
|
:ref => 'master'
|
||||||
|
|||||||
@ -1,10 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# Get mgr systemd unit
|
|
||||||
mgr_unit=$(systemctl list-units | awk '/ceph-mgr/ {print $1}')
|
|
||||||
|
|
||||||
# Restart the mgr systemd unit
|
|
||||||
if [ -n "$mgr_unit" ]; then
|
|
||||||
systemctl restart "$mgr_unit"
|
|
||||||
fi
|
|
||||||
|
|
||||||
@ -1,25 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli podman)
|
|
||||||
|
|
||||||
# cinder uses etcd, so its containers also need to be refreshed
|
|
||||||
container_names=$($container_cli ps --format="{{.Names}}" | grep -E 'cinder|etcd')
|
|
||||||
|
|
||||||
service_crt="$(hiera -c /etc/puppet/hiera.yaml tripleo::profile::base::etcd::certificate_specs.service_certificate)"
|
|
||||||
service_key="$(hiera -c /etc/puppet/hiera.yaml tripleo::profile::base::etcd::certificate_specs.service_key)"
|
|
||||||
|
|
||||||
kolla_dir="/var/lib/kolla/config_files/src-tls"
|
|
||||||
|
|
||||||
# For each container, check whether the cert and key files need to be updated.
|
|
||||||
# The check is necessary because the original THT design directly bind mounted
|
|
||||||
# the files to their final location, and did not copy them in via $kolla_dir.
|
|
||||||
# Regardless of whether the container is directly using the files, or a copy,
|
|
||||||
# there's no need to trigger a reload because the cert is not cached.
|
|
||||||
|
|
||||||
for container_name in ${container_names[*]}; do
|
|
||||||
$container_cli exec -u root "$container_name" bash -c "
|
|
||||||
[[ -f ${kolla_dir}/${service_crt} ]] && cp ${kolla_dir}/${service_crt} $service_crt;
|
|
||||||
[[ -f ${kolla_dir}/${service_key} ]] && cp ${kolla_dir}/${service_key} $service_key;
|
|
||||||
true
|
|
||||||
"
|
|
||||||
done
|
|
||||||
@ -1,9 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# Get grafana systemd unit
|
|
||||||
grafana_unit=$(systemctl list-unit-files | awk '/grafana/ {print $1}')
|
|
||||||
|
|
||||||
# Restart the grafana systemd unit
|
|
||||||
if [ -z "$grafana_unit" ]; then
|
|
||||||
systemctl restart "$grafana_unit"
|
|
||||||
fi
|
|
||||||
@ -1,54 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# This script is meant to reload HAProxy when certmonger triggers a certificate
|
|
||||||
# renewal. It'll concatenate the needed certificates for the PEM file that
|
|
||||||
# HAProxy reads.
|
|
||||||
|
|
||||||
die() { echo "$*" 1>&2 ; exit 1; }
|
|
||||||
|
|
||||||
[[ $# -eq 2 ]] || die "Invalid number of arguments"
|
|
||||||
[[ $1 == @(reload|restart) ]] || die "First argument must be one of 'reload' or 'restart'."
|
|
||||||
|
|
||||||
|
|
||||||
ACTION=$1
|
|
||||||
NETWORK=$2
|
|
||||||
|
|
||||||
certmonger_ca=$(hiera -c /etc/puppet/hiera.yaml certmonger_ca)
|
|
||||||
container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli podman)
|
|
||||||
service_certificate="$(hiera -c /etc/puppet/hiera.yaml tripleo::certmonger::haproxy_dirs::certificate_dir)/overcloud-haproxy-$NETWORK.crt"
|
|
||||||
service_key="$(hiera -c /etc/puppet/hiera.yaml tripleo::certmonger::haproxy_dirs::key_dir)/overcloud-haproxy-$NETWORK.key"
|
|
||||||
ca_path=""
|
|
||||||
|
|
||||||
if [ "$certmonger_ca" == "local" ]; then
|
|
||||||
ca_path="/etc/pki/ca-trust/source/anchors/cm-local-ca.pem"
|
|
||||||
elif [ "$certmonger_ca" == "IPA" ]; then
|
|
||||||
ca_path="/etc/ipa/ca.crt"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$NETWORK" != "external" ]; then
|
|
||||||
service_pem="$(hiera -c /etc/puppet/hiera.yaml tripleo::certmonger::haproxy_dirs::certificate_dir)/overcloud-haproxy-$NETWORK.pem"
|
|
||||||
else
|
|
||||||
service_pem="$(hiera -c /etc/puppet/hiera.yaml tripleo::haproxy::service_certificate)"
|
|
||||||
fi
|
|
||||||
|
|
||||||
cat "$service_certificate" "$ca_path" "$service_key" > "$service_pem"
|
|
||||||
|
|
||||||
haproxy_container_name=$($container_cli ps --format="{{.Names}}" | grep -w -E 'haproxy(-bundle-.*-[0-9]+)?')
|
|
||||||
|
|
||||||
if [ "$ACTION" == "reload" ]; then
|
|
||||||
# Refresh the cert at the mount-point
|
|
||||||
$container_cli cp $service_pem "$haproxy_container_name:/var/lib/kolla/config_files/src-tls/$service_pem"
|
|
||||||
|
|
||||||
# Copy the new cert from the mount-point to the real path
|
|
||||||
$container_cli exec "$haproxy_container_name" cp "/var/lib/kolla/config_files/src-tls$service_pem" "$service_pem"
|
|
||||||
|
|
||||||
# Set appropriate permissions
|
|
||||||
$container_cli exec "$haproxy_container_name" chown haproxy:haproxy "$service_pem"
|
|
||||||
|
|
||||||
# Trigger a reload for HAProxy to read the new certificates
|
|
||||||
$container_cli kill --signal HUP "$haproxy_container_name"
|
|
||||||
elif [ "$ACTION" == "restart" ]; then
|
|
||||||
# Copying the certificate and permissions will be handled by kolla's start
|
|
||||||
# script.
|
|
||||||
$container_cli restart "$haproxy_container_name"
|
|
||||||
fi
|
|
||||||
@ -1,20 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli podman)
|
|
||||||
container_name=$($container_cli ps --format="{{.Names}}" | grep memcached)
|
|
||||||
|
|
||||||
service_certificate="$(hiera -c /etc/puppet/hiera.yaml tripleo::profile::base::memcached::certificate_specs.service_certificate)"
|
|
||||||
service_key="$(hiera -c /etc/puppet/hiera.yaml tripleo::profile::base::memcached::certificate_specs.service_key)"
|
|
||||||
|
|
||||||
# Copy the new cert and key from the mount-point to the real path
|
|
||||||
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_certificate" "$service_certificate"
|
|
||||||
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_key" "$service_key"
|
|
||||||
|
|
||||||
# Set appropriate permissions
|
|
||||||
$container_cli exec "$container_name" chown memcached:memcached "$service_certificate"
|
|
||||||
$container_cli exec "$container_name" chown memcached:memcached "$service_key"
|
|
||||||
|
|
||||||
# Send refresh_certs command to memcached
|
|
||||||
memcached_ip="$(hiera -c /etc/puppet/hiera.yaml memcached::listen.0 127.0.0.1)"
|
|
||||||
memcached_port="$(hiera -c /etc/puppet/hiera.yaml memcached::tcp_port 11211)"
|
|
||||||
echo refresh_certs | openssl s_client -connect $memcached_ip:$memcached_port
|
|
||||||
@ -1,24 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
|
|
||||||
container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli podman)
|
|
||||||
|
|
||||||
container_name=$($container_cli ps --format="{{.Names}}" | grep metrics_qdr)
|
|
||||||
|
|
||||||
service_certificate="$(hiera -c /etc/puppet/hiera.yaml tripleo::metrics::qdr::service_certificate)"
|
|
||||||
|
|
||||||
service_key="$(hiera -c /etc/puppet/hiera.yaml tripleo::metrics::qdr::service_key)"
|
|
||||||
|
|
||||||
# Copy the new cert from the mount-point to the real path
|
|
||||||
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_certificate" "$service_certificate"
|
|
||||||
|
|
||||||
# Copy the new key from the mount-point to the real path
|
|
||||||
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_key" "$service_key"
|
|
||||||
|
|
||||||
# Set appropriate permissions
|
|
||||||
$container_cli exec "$container_name" chown qdrouterd:qdrouterd "$service_certificate"
|
|
||||||
|
|
||||||
$container_cli exec "$container_name" chown qdrouterd:qdrouterd "$service_key"
|
|
||||||
|
|
||||||
# Trigger a container restart to read the new certificates
|
|
||||||
$container_cli restart $container_name
|
|
||||||
@ -1,21 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
|
|
||||||
container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli podman)
|
|
||||||
|
|
||||||
container_name=$($container_cli ps --format="{{.Names}}" | grep neutron_dhcp)
|
|
||||||
|
|
||||||
# The certificate is also installed on the computes, but neutron_dhcp is only
|
|
||||||
# present on the controllers, so we exit if the container could not be found.
|
|
||||||
[[ -z $container_name ]] && exit 0
|
|
||||||
|
|
||||||
service_crt="$(hiera -c /etc/puppet/hiera.yaml neutron::agents::dhcp::ovsdb_agent_ssl_cert_file)"
|
|
||||||
service_key="$(hiera -c /etc/puppet/hiera.yaml neutron::agents::dhcp::ovsdb_agent_ssl_key_file)"
|
|
||||||
|
|
||||||
# Copy the new cert from the mount-point to the real path
|
|
||||||
$container_cli exec -u root "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_crt" "$service_crt"
|
|
||||||
|
|
||||||
# Copy the new key from the mount-point to the real path
|
|
||||||
$container_cli exec -u root "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_key" "$service_key"
|
|
||||||
|
|
||||||
# No need to trigger a reload for neutron dhcpd since the cert is not cached
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
|
|
||||||
container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli podman)
|
|
||||||
|
|
||||||
container_name=$($container_cli ps --format="{{.Names}}" | grep nova_vnc_proxy)
|
|
||||||
|
|
||||||
service_crt="$(hiera -c /etc/puppet/hiera.yaml nova::cert)"
|
|
||||||
service_key="$(hiera -c /etc/puppet/hiera.yaml nova::key)"
|
|
||||||
|
|
||||||
# Copy the new cert from the mount-point to the real path
|
|
||||||
$container_cli exec -u root "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_crt" "$service_crt"
|
|
||||||
|
|
||||||
# Copy the new key from the mount-point to the real path
|
|
||||||
$container_cli exec -u root "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_key" "$service_key"
|
|
||||||
|
|
||||||
# No need to trigger a reload for novnc proxy since the cert is not cached
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
|
|
||||||
container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli podman)
|
|
||||||
|
|
||||||
container_name=$($container_cli ps --format="{{.Names}}" | grep -w -E 'rabbitmq(-bundle-.*-[0-9]+)?')
|
|
||||||
|
|
||||||
service_pem="$(hiera -c /etc/puppet/hiera.yaml tripleo::rabbitmq::service_certificate)"
|
|
||||||
|
|
||||||
# Copy the new cert from the mount-point to the real path
|
|
||||||
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_pem" "$service_pem"
|
|
||||||
|
|
||||||
# Set appropriate permissions
|
|
||||||
$container_cli exec "$container_name" chown rabbitmq:rabbitmq "$service_pem"
|
|
||||||
|
|
||||||
# Trigger a pem cache clear in RabbitMQ to read the new certificates
|
|
||||||
$container_cli exec $container_name rabbitmqctl eval "ssl:clear_pem_cache()."
|
|
||||||
@ -1,14 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
|
|
||||||
container_cli=$(hiera -c /etc/puppet/hiera.yaml container_cli podman)
|
|
||||||
|
|
||||||
container_name=$($container_cli ps --format="{{.Names}}" | grep redis_tls_proxy)
|
|
||||||
|
|
||||||
service_pem="$(hiera -c /etc/puppet/hiera.yaml tripleo::redis::service_certificate)"
|
|
||||||
|
|
||||||
# Copy the new cert from the mount-point to the real path
|
|
||||||
$container_cli exec "$container_name" cp "/var/lib/kolla/config_files/src-tls$service_pem" "$service_pem"
|
|
||||||
|
|
||||||
# Trigger a reload for stunnel to read the new certificates
|
|
||||||
pkill -o -HUP stunnel
|
|
||||||
@ -1,9 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# Get ceph rgw systemd unit
|
|
||||||
rgw_unit=$(systemctl list-unit-files | awk '/radosgw/ {print $1}')
|
|
||||||
|
|
||||||
# Restart the rgw systemd unit
|
|
||||||
if [ -n "$rgw_unit" ]; then
|
|
||||||
systemctl restart "$rgw_unit"
|
|
||||||
fi
|
|
||||||
@ -1,74 +0,0 @@
|
|||||||
#!/usr/bin/python
|
|
||||||
try:
|
|
||||||
import ConfigParser as configparser
|
|
||||||
except ImportError:
|
|
||||||
import configparser
|
|
||||||
import os
|
|
||||||
import sys
|
|
||||||
import subprocess
|
|
||||||
|
|
||||||
CM_SUBMIT_STATUS_ISSUED = 0
|
|
||||||
CM_SUBMIT_STATUS_UNCONFIGURED = 4
|
|
||||||
|
|
||||||
def main():
|
|
||||||
if len(sys.argv) < 3:
|
|
||||||
return CM_SUBMIT_STATUS_UNCONFIGURED
|
|
||||||
sub_ca = sys.argv[1]
|
|
||||||
wrapped_command = sys.argv[2:]
|
|
||||||
|
|
||||||
operation = os.environ.get('CERTMONGER_OPERATION')
|
|
||||||
os.environ['CERTMONGER_CA_NICKNAME'] = 'IPA'
|
|
||||||
|
|
||||||
if operation == 'FETCH-ROOTS' and sub_ca.lower() != 'ipa':
|
|
||||||
config = configparser.ConfigParser()
|
|
||||||
try:
|
|
||||||
with open('/etc/ipa/default.conf') as fp:
|
|
||||||
config.readfp(fp)
|
|
||||||
except:
|
|
||||||
return CM_SUBMIT_STATUS_UNCONFIGURED
|
|
||||||
host = config.get('global', 'host')
|
|
||||||
realm = config.get('global', 'realm')
|
|
||||||
if host is None or realm is None:
|
|
||||||
return CM_SUBMIT_STATUS_UNCONFIGURED
|
|
||||||
principal = 'host/{}@{}'.format(host, realm)
|
|
||||||
os.environ['KRB5CCNAME'] = '/tmp/krb5cc_cm_ipa_subca_wrapper'
|
|
||||||
try:
|
|
||||||
subprocess.check_call([
|
|
||||||
'/usr/bin/kinit', '-k', principal
|
|
||||||
])
|
|
||||||
except:
|
|
||||||
return CM_SUBMIT_STATUS_UNCONFIGURED
|
|
||||||
|
|
||||||
try:
|
|
||||||
data = subprocess.check_output([
|
|
||||||
'/usr/bin/ipa', 'ca-show', sub_ca
|
|
||||||
])
|
|
||||||
except:
|
|
||||||
return CM_SUBMIT_STATUS_ISSUED
|
|
||||||
|
|
||||||
config = {}
|
|
||||||
for line in data.split('\n'):
|
|
||||||
line = line.strip()
|
|
||||||
try:
|
|
||||||
key, value = line.split(': ')
|
|
||||||
except:
|
|
||||||
continue
|
|
||||||
config[key] = value
|
|
||||||
|
|
||||||
if config.get('Name').lower() != sub_ca.lower():
|
|
||||||
return CM_SUBMIT_STATUS_ISSUED
|
|
||||||
|
|
||||||
print(realm, sub_ca, 'CA')
|
|
||||||
print('-----BEGIN CERTIFICATE-----')
|
|
||||||
certificate = config['Certificate']
|
|
||||||
for i in range((len(certificate)/64) + 1):
|
|
||||||
print(certificate[i*64:(i+1)*64])
|
|
||||||
print('-----END CERTIFICATE-----')
|
|
||||||
sys.stdout.flush()
|
|
||||||
else:
|
|
||||||
os.environ['CERTMONGER_CA_ISSUER'] = sub_ca
|
|
||||||
|
|
||||||
os.execl(wrapped_command[0], *wrapped_command)
|
|
||||||
|
|
||||||
if __name__ == '__main__':
|
|
||||||
main()
|
|
||||||
@ -1,55 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# : = Class: tripleo::certmonger::apache_dirs
|
|
||||||
#
|
|
||||||
# Creates the necessary directories for apache's certificates and keys in the
|
|
||||||
# assigned locations if specified. It also assigns the correct SELinux tags.
|
|
||||||
#
|
|
||||||
# === Parameters:
|
|
||||||
#
|
|
||||||
# [*certificate_dir*]
|
|
||||||
# (Optional) Directory where apache's certificates will be stored. If left
|
|
||||||
# unspecified, it won't be created.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_dir*]
|
|
||||||
# (Optional) Directory where apache's keys will be stored.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::apache_dirs(
|
|
||||||
$certificate_dir = undef,
|
|
||||||
$key_dir = undef,
|
|
||||||
){
|
|
||||||
|
|
||||||
if $certificate_dir {
|
|
||||||
file { $certificate_dir :
|
|
||||||
ensure => 'directory',
|
|
||||||
selrole => 'object_r',
|
|
||||||
seltype => 'cert_t',
|
|
||||||
seluser => 'system_u',
|
|
||||||
}
|
|
||||||
File[$certificate_dir] ~> Certmonger_certificate<| tag == 'apache-cert' |>
|
|
||||||
}
|
|
||||||
|
|
||||||
if $key_dir {
|
|
||||||
file { $key_dir :
|
|
||||||
ensure => 'directory',
|
|
||||||
selrole => 'object_r',
|
|
||||||
seltype => 'cert_t',
|
|
||||||
seluser => 'system_u',
|
|
||||||
}
|
|
||||||
File[$key_dir] ~> Certmonger_certificate<| tag == 'apache-cert' |>
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,165 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == class: tripleo::certmonger::ca::crl
|
|
||||||
#
|
|
||||||
# Class that downloads the appropriate CRL file from the CA. This can
|
|
||||||
# furtherly be used by services in order for proper certificate revocation to
|
|
||||||
# come into effect. The class also sets up a cron job that will refresh the CRL
|
|
||||||
# once a week. Also, processing of the CRL file might be needed. e.g. most CAs
|
|
||||||
# use DER format to distribute the CRLs, while services such as HAProxy expect
|
|
||||||
# the CRL to be in PEM format.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*crl_dest*]
|
|
||||||
# (Optional) The file where the CRL file will be stored.
|
|
||||||
# Defaults to '/etc/pki/CA/crl/overcloud-crl.pem'
|
|
||||||
#
|
|
||||||
# [*crl_source*]
|
|
||||||
# (Optional) The URI where the CRL file will be fetched from.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*process*]
|
|
||||||
# (Optional) Whether the CRL needs processing before being used. This means
|
|
||||||
# transforming from DER to PEM format or viceversa. This is because most CRLs
|
|
||||||
# by default come in DER format, so most likely it needs to be transformed.
|
|
||||||
# Defaults to true
|
|
||||||
#
|
|
||||||
# [*crl_preprocessed*]
|
|
||||||
# (Optional) The pre-processed CRL file which will be transformed.
|
|
||||||
# Defaults to '/etc/pki/CA/crl/overcloud-crl.bin'
|
|
||||||
#
|
|
||||||
# [*crl_preprocessed_format*]
|
|
||||||
# (Optional) The pre-processed CRL file's format which will be transformed.
|
|
||||||
# Defaults to 'DER'
|
|
||||||
#
|
|
||||||
# [*minute*]
|
|
||||||
# (optional) Defaults to '0'.
|
|
||||||
#
|
|
||||||
# [*hour*]
|
|
||||||
# (optional) Defaults to '*/2'.
|
|
||||||
#
|
|
||||||
# [*monthday*]
|
|
||||||
# (optional) Defaults to '*'.
|
|
||||||
#
|
|
||||||
# [*month*]
|
|
||||||
# (optional) Defaults to '*'.
|
|
||||||
#
|
|
||||||
# [*weekday*]
|
|
||||||
# (optional) Defaults to '6'.
|
|
||||||
#
|
|
||||||
# [*maxdelay*]
|
|
||||||
# (optional) Seconds. Defaults to 0. Should be a positive integer.
|
|
||||||
# Induces a random delay before running the cronjob to avoid running all
|
|
||||||
# cron jobs at the same time on all hosts this job is configured.
|
|
||||||
#
|
|
||||||
# [*reload_cmds*]
|
|
||||||
# (Optional) list of commands to be executed after fetching the CRL list in
|
|
||||||
# the cron job. This will usually be a list of reload commands issued to
|
|
||||||
# services that use the CRL.
|
|
||||||
# Defaults to []
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::ca::crl (
|
|
||||||
$crl_dest = '/etc/pki/CA/crl/overcloud-crl.pem',
|
|
||||||
$crl_source = undef,
|
|
||||||
$process = true,
|
|
||||||
$crl_preprocessed = '/etc/pki/CA/crl/overcloud-crl.bin',
|
|
||||||
$crl_preprocessed_format = 'DER',
|
|
||||||
$minute = '0',
|
|
||||||
$hour = '*/2',
|
|
||||||
$monthday = '*',
|
|
||||||
$month = '*',
|
|
||||||
$weekday = '*',
|
|
||||||
$maxdelay = 0,
|
|
||||||
$reload_cmds = [],
|
|
||||||
) {
|
|
||||||
if $process {
|
|
||||||
$fetched_crl = $crl_preprocessed
|
|
||||||
} else {
|
|
||||||
$fetched_crl = $crl_dest
|
|
||||||
}
|
|
||||||
|
|
||||||
$esc_fetched_crl = shell_escape($fetched_crl)
|
|
||||||
$esc_crl_src = shell_escape($crl_source)
|
|
||||||
|
|
||||||
if $crl_source {
|
|
||||||
$ensure = 'present'
|
|
||||||
# LP(1787878): We need to use an explicit command instead of the file
|
|
||||||
# resource, because puppet won't use query parameters when handling
|
|
||||||
# redirects.
|
|
||||||
# If FreeIPA is being installed in a similar time as the overcloud, the tries
|
|
||||||
# and time in between tries gives it a chance to generate the CRL.
|
|
||||||
exec {'tripleo-ca-crl':
|
|
||||||
command => "curl -Ls --connect-timeout 120 -o ${esc_fetched_crl} ${esc_crl_src}",
|
|
||||||
path => '/usr/bin/',
|
|
||||||
creates => $fetched_crl,
|
|
||||||
tries => 5,
|
|
||||||
try_sleep => 5,
|
|
||||||
} ~> file {'tripleo-ca-crl-file':
|
|
||||||
group => 'root',
|
|
||||||
mode => '0644',
|
|
||||||
owner => 'root',
|
|
||||||
path => $fetched_crl,
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
$ensure = 'absent'
|
|
||||||
}
|
|
||||||
|
|
||||||
if $maxdelay == 0 {
|
|
||||||
$sleep = ''
|
|
||||||
} else {
|
|
||||||
$sleep = "sleep `expr \${RANDOM} \\% ${maxdelay}`; "
|
|
||||||
}
|
|
||||||
|
|
||||||
if $process and $ensure == 'present' {
|
|
||||||
$crl_dest_format = $crl_preprocessed_format ? {
|
|
||||||
'PEM' => 'DER',
|
|
||||||
'DER' => 'PEM'
|
|
||||||
}
|
|
||||||
# transform CRL from DER to PEM or viceversa
|
|
||||||
$process_cmd = "openssl crl -in ${crl_preprocessed} -inform ${crl_preprocessed_format} -outform ${crl_dest_format} -out ${crl_dest}"
|
|
||||||
exec { 'tripleo-ca-crl-process-command' :
|
|
||||||
command => $process_cmd,
|
|
||||||
path => '/usr/bin',
|
|
||||||
refreshonly => true,
|
|
||||||
subscribe => [
|
|
||||||
Exec['tripleo-ca-crl'],
|
|
||||||
File['tripleo-ca-crl-file']
|
|
||||||
]
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
$process_cmd = []
|
|
||||||
}
|
|
||||||
|
|
||||||
if $ensure == 'present' {
|
|
||||||
# Fetch CRL in cron job and notify needed services
|
|
||||||
$cmd_list = concat(["${sleep}curl -g -s -L -o ${fetched_crl} ${crl_source}"], $process_cmd, $reload_cmds)
|
|
||||||
$cron_cmd = join($cmd_list, ' && ')
|
|
||||||
} else {
|
|
||||||
$cron_cmd = absent
|
|
||||||
}
|
|
||||||
|
|
||||||
cron { 'tripleo-refresh-crl-file':
|
|
||||||
ensure => $ensure,
|
|
||||||
command => $cron_cmd,
|
|
||||||
environment => 'PATH=/usr/bin:/bin SHELL=/bin/sh',
|
|
||||||
user => 'root',
|
|
||||||
minute => $minute,
|
|
||||||
hour => $hour,
|
|
||||||
monthday => $monthday,
|
|
||||||
month => $month,
|
|
||||||
weekday => $weekday,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,65 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::ca::libvirt_vnc
|
|
||||||
#
|
|
||||||
# Sets the necessary file that will be used libvirt vnc servers and
|
|
||||||
# clients.
|
|
||||||
#
|
|
||||||
# === Parameters:
|
|
||||||
#
|
|
||||||
# [*origin_ca_pem*]
|
|
||||||
# (Optional) Path to the CA certificate that libvirt vnc will use. This is not
|
|
||||||
# assumed automatically or uses the system CA bundle as is the case of other
|
|
||||||
# services because a limitation with the file sizes in GNU TLS, which libvirt
|
|
||||||
# uses as a TLS backend.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA name that certmonger will use to generate VNC certificates.
|
|
||||||
# If this is not local or IPA then is assumed to be an IPA sub-CA and will be
|
|
||||||
# added to the certmonger CA list.
|
|
||||||
# Defaults to hiera('certmonger_ca_vnc', 'local').
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::ca::libvirt_vnc(
|
|
||||||
$origin_ca_pem = undef,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca_vnc', 'local'),
|
|
||||||
){
|
|
||||||
if $origin_ca_pem {
|
|
||||||
$ensure_file = 'link'
|
|
||||||
} else {
|
|
||||||
$ensure_file = 'absent'
|
|
||||||
}
|
|
||||||
file { '/etc/pki/libvirt-vnc/ca-cert.pem':
|
|
||||||
ensure => $ensure_file,
|
|
||||||
mode => '0644',
|
|
||||||
target => $origin_ca_pem,
|
|
||||||
}
|
|
||||||
|
|
||||||
if ! ($certmonger_ca in [ 'local', 'IPA', 'ipa' ]) {
|
|
||||||
$wrapper_path = '/usr/libexec/certmonger/cm_ipa_subca_wrapper'
|
|
||||||
$ipa_helper_path = '/usr/libexec/certmonger/ipa-submit'
|
|
||||||
file { $wrapper_path:
|
|
||||||
source => 'puppet:///modules/tripleo/cm_ipa_subca_wrapper.py',
|
|
||||||
mode => '0755',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
}
|
|
||||||
-> exec { "Add ${certmonger_ca} IPA subCA to certmonger":
|
|
||||||
command => "getcert add-ca -c ${certmonger_ca} -e '${wrapper_path} ${certmonger_ca} ${ipa_helper_path}'",
|
|
||||||
path => ['/usr/bin', '/bin'],
|
|
||||||
unless => "getcert list-cas -c ${certmonger_ca} | grep '${wrapper_path} ${certmonger_ca}'",
|
|
||||||
notify => Service['certmonger']
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,45 +0,0 @@
|
|||||||
# Copyright 2016 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::ca::local
|
|
||||||
#
|
|
||||||
# Does the necessary action to extract and trust certmonger's local CA.
|
|
||||||
#
|
|
||||||
# === Parameters:
|
|
||||||
#
|
|
||||||
# [*ca_pem*]
|
|
||||||
# (optional) PEM file that will contain the local CA certificate.
|
|
||||||
# Defaults to '/etc/pki/ca-trust/source/anchors/cm-local-ca.pem'
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::ca::local(
|
|
||||||
$ca_pem = '/etc/pki/ca-trust/source/anchors/cm-local-ca.pem',
|
|
||||||
){
|
|
||||||
$ca_pkcs12 = '/var/lib/certmonger/local/creds'
|
|
||||||
$extract_cmd = "openssl pkcs12 -in ${ca_pkcs12} -out ${ca_pem} -nokeys -nodes -passin pass:''"
|
|
||||||
$trust_ca_cmd = 'update-ca-trust extract'
|
|
||||||
|
|
||||||
file { "${ca_pem}":
|
|
||||||
ensure => present,
|
|
||||||
mode => '0644',
|
|
||||||
owner => 'root',
|
|
||||||
}
|
|
||||||
exec { 'extract-and-trust-ca':
|
|
||||||
command => "${extract_cmd} && ${trust_ca_cmd}",
|
|
||||||
path => '/usr/bin',
|
|
||||||
tries => 5,
|
|
||||||
try_sleep => 1,
|
|
||||||
notify => File[$ca_pem]
|
|
||||||
}
|
|
||||||
Service['certmonger'] ~> Exec<| title == 'extract-and-trust-ca' |>
|
|
||||||
}
|
|
||||||
@ -1,65 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::ca::qemu
|
|
||||||
#
|
|
||||||
# Sets the necessary file that will be used by qemu servers and
|
|
||||||
# clients.
|
|
||||||
#
|
|
||||||
# === Parameters:
|
|
||||||
#
|
|
||||||
# [*origin_ca_pem*]
|
|
||||||
# (Optional) Path to the CA certificate that qemu will use. This is not
|
|
||||||
# assumed automatically or uses the system CA bundle as is the case of other
|
|
||||||
# services because a limitation with the file sizes in GNU TLS, which qemu
|
|
||||||
# uses as a TLS backend.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA name that certmonger will use to generate qemu certificates.
|
|
||||||
# If this is not local or IPA then is assumed to be an IPA sub-CA and will be
|
|
||||||
# added to the certmonger CA list.
|
|
||||||
# Defaults to hiera('certmonger_ca_qemu', 'local').
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::ca::qemu(
|
|
||||||
$origin_ca_pem = undef,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca_qemu', 'local'),
|
|
||||||
){
|
|
||||||
if $origin_ca_pem {
|
|
||||||
$ensure_file = 'link'
|
|
||||||
} else {
|
|
||||||
$ensure_file = 'absent'
|
|
||||||
}
|
|
||||||
file { '/etc/pki/qemu/ca-cert.pem':
|
|
||||||
ensure => $ensure_file,
|
|
||||||
mode => '0644',
|
|
||||||
target => $origin_ca_pem,
|
|
||||||
}
|
|
||||||
|
|
||||||
if ! ($certmonger_ca in [ 'local', 'IPA', 'ipa' ]) {
|
|
||||||
$wrapper_path = '/usr/libexec/certmonger/cm_ipa_subca_wrapper'
|
|
||||||
$ipa_helper_path = '/usr/libexec/certmonger/ipa-submit'
|
|
||||||
file { $wrapper_path:
|
|
||||||
source => 'puppet:///modules/tripleo/cm_ipa_subca_wrapper.py',
|
|
||||||
mode => '0755',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
}
|
|
||||||
-> exec { "Add ${certmonger_ca} IPA subCA to certmonger":
|
|
||||||
command => "getcert add-ca -c ${certmonger_ca} -e '${wrapper_path} ${certmonger_ca} ${ipa_helper_path}'",
|
|
||||||
path => ['/usr/bin', '/bin'],
|
|
||||||
unless => "getcert list-cas -c ${certmonger_ca} | grep '${wrapper_path} ${certmonger_ca}'",
|
|
||||||
notify => Service['certmonger']
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,87 +0,0 @@
|
|||||||
# Copyright 2019 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::ceph_dashboard
|
|
||||||
#
|
|
||||||
# Request a certificate for Ceph Dashboard and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The service principal that is set for the service in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::ceph_dashboard (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
|
|
||||||
ensure_resource('file', '/usr/bin/certmonger-dashboard-refresh.sh', {
|
|
||||||
source => 'puppet:///modules/tripleo/certmonger-dashboard-refresh.sh',
|
|
||||||
mode => '0700',
|
|
||||||
seltype => 'bin_t',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
})
|
|
||||||
|
|
||||||
certmonger_certificate { 'ceph_dashboard' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['ceph_dashboard'],
|
|
||||||
owner => 472,
|
|
||||||
group => 472,
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['ceph_dashboard'],
|
|
||||||
owner => 472,
|
|
||||||
group => 472,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,87 +0,0 @@
|
|||||||
# Copyright 2019 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::ceph_grafana
|
|
||||||
#
|
|
||||||
# Request a certificate for Ceph Grafana and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The service principal that is set for the service in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::ceph_grafana (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
|
|
||||||
ensure_resource('file', '/usr/bin/certmonger-grafana-refresh.sh', {
|
|
||||||
source => 'puppet:///modules/tripleo/certmonger-grafana-refresh.sh',
|
|
||||||
mode => '0700',
|
|
||||||
seltype => 'bin_t',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
})
|
|
||||||
|
|
||||||
certmonger_certificate { 'ceph_grafana' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['ceph_grafana'],
|
|
||||||
owner => 472,
|
|
||||||
group => 472,
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['ceph_grafana'],
|
|
||||||
owner => 472,
|
|
||||||
group => 472,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,123 +0,0 @@
|
|||||||
# Copyright 2020 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::ceph_rgw
|
|
||||||
#
|
|
||||||
# Request a certificate for Ceph RGW and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_pem*]
|
|
||||||
# The file in PEM format that the HAProxy service will use as a certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The service principal that is set for the service in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::ceph_rgw (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$service_pem,
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
|
|
||||||
ensure_resource('file', '/usr/bin/certmonger-rgw-refresh.sh', {
|
|
||||||
source => 'puppet:///modules/tripleo/certmonger-rgw-refresh.sh',
|
|
||||||
mode => '0700',
|
|
||||||
seltype => 'bin_t',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
})
|
|
||||||
|
|
||||||
certmonger_certificate { 'ceph_rgw' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
concat { $service_pem :
|
|
||||||
ensure => present,
|
|
||||||
mode => '0640',
|
|
||||||
owner => 472,
|
|
||||||
group => 472,
|
|
||||||
tag => 'ceph-rgw-cert',
|
|
||||||
}
|
|
||||||
|
|
||||||
concat::fragment { "${title}-cert-fragment":
|
|
||||||
target => $service_pem,
|
|
||||||
source => $service_certificate,
|
|
||||||
order => '01',
|
|
||||||
tag => 'ceph_rgw-cert',
|
|
||||||
require => Concat["${service_pem}"]
|
|
||||||
}
|
|
||||||
|
|
||||||
if $certmonger_ca == 'local' {
|
|
||||||
$ca_pem = getparam(Class['tripleo::certmonger::ca::local'], 'ca_pem')
|
|
||||||
concat::fragment { "${title}-ca-fragment":
|
|
||||||
target => $service_pem,
|
|
||||||
source => $ca_pem,
|
|
||||||
order => '10',
|
|
||||||
tag => 'ceph_rgw-cert',
|
|
||||||
require => [ Class['tripleo::certmonger::ca::local'], Concat::Fragment["${title}-cert-fragment"] ]
|
|
||||||
}
|
|
||||||
} elsif $certmonger_ca == 'IPA' {
|
|
||||||
concat::fragment { "${title}-ca-fragment":
|
|
||||||
target => $service_pem,
|
|
||||||
source => '/etc/ipa/ca.crt',
|
|
||||||
order => '10',
|
|
||||||
tag => 'ceph_rgw-cert',
|
|
||||||
require => Concat::Fragment["${title}-cert-fragment"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
concat::fragment { "${title}-key-fragment":
|
|
||||||
target => $service_pem,
|
|
||||||
source => $service_key,
|
|
||||||
order => 20,
|
|
||||||
tag => 'ceph_rgw-cert',
|
|
||||||
require => Concat::Fragment["${title}-ca-fragment"],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,92 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::etcd
|
|
||||||
#
|
|
||||||
# Request a certificate for the etcd service and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*dnsnames*]
|
|
||||||
# (Optional) The DNS names that will be added for the SubjectAltNames entry
|
|
||||||
# in the certificate.
|
|
||||||
# Defaults to $hostname
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The haproxy service principal that is set for etcd in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::etcd (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$dnsnames = $hostname,
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
ensure_resource('file', '/usr/bin/certmonger-etcd-refresh.sh', {
|
|
||||||
source => 'puppet:///modules/tripleo/certmonger-etcd-refresh.sh',
|
|
||||||
mode => '0700',
|
|
||||||
seltype => 'bin_t',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
})
|
|
||||||
|
|
||||||
certmonger_certificate { 'etcd' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $dnsnames,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
key_size => $key_size,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['etcd'],
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['etcd'],
|
|
||||||
}
|
|
||||||
|
|
||||||
File[$service_certificate] ~> Service<| title == 'etcd' |>
|
|
||||||
File[$service_key] ~> Service<| title == 'etcd' |>
|
|
||||||
}
|
|
||||||
@ -1,159 +0,0 @@
|
|||||||
# Copyright 2016 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Resource: tripleo::certmonger::haproxy
|
|
||||||
#
|
|
||||||
# Request a certificate for the HAProxy service and does the necessary logic to
|
|
||||||
# get it into a format that the service understands.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*service_pem*]
|
|
||||||
# The file in PEM format that the HAProxy service will use as a certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The certificate file that certmonger will be tracking.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The key file that certmonger will use for the certificate.
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname that certmonger will use as the common name for the
|
|
||||||
# certificate.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*dnsnames*]
|
|
||||||
# (Optional) The DNS names that will be added for the SubjectAltNames entry
|
|
||||||
# in the certificate. If left unset, the value will be set to the $hostname.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# The haproxy service principal that is set for HAProxy in kerberos.
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# The post-save-command that certmonger will use once it renews the
|
|
||||||
# certificate.
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
define tripleo::certmonger::haproxy (
|
|
||||||
$service_pem,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$hostname,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$dnsnames = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
){
|
|
||||||
include certmonger
|
|
||||||
include haproxy::params
|
|
||||||
if $certmonger_ca == 'local' {
|
|
||||||
if defined(Class['::haproxy']) {
|
|
||||||
Class['::tripleo::certmonger::ca::local'] ~> Class['::haproxy']
|
|
||||||
}
|
|
||||||
$principal_real = undef
|
|
||||||
} else {
|
|
||||||
$principal_real = $principal
|
|
||||||
}
|
|
||||||
|
|
||||||
# If we have HAProxy in the resource catalog, we can use the haproxy user
|
|
||||||
# and group.
|
|
||||||
if defined(Class['::haproxy']) {
|
|
||||||
$cert_user = 'haproxy'
|
|
||||||
$cert_group = 'haproxy'
|
|
||||||
# If it's not in the resource catalog, it means that we're running in
|
|
||||||
# containers. So we have to rely on the container to set the appropriate
|
|
||||||
# permissions.
|
|
||||||
} else {
|
|
||||||
$cert_user = 'root'
|
|
||||||
$cert_group = 'root'
|
|
||||||
}
|
|
||||||
|
|
||||||
if $dnsnames {
|
|
||||||
$dnsnames_real = $dnsnames
|
|
||||||
} else {
|
|
||||||
$dnsnames_real = $hostname
|
|
||||||
}
|
|
||||||
|
|
||||||
ensure_resource('file', '/usr/bin/certmonger-haproxy-refresh.sh', {
|
|
||||||
source => 'puppet:///modules/tripleo/certmonger-haproxy-refresh.sh',
|
|
||||||
mode => '0700',
|
|
||||||
seltype => 'bin_t',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
})
|
|
||||||
certmonger_certificate { "${title}-cert":
|
|
||||||
ensure => 'present',
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $dnsnames_real,
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
principal => $principal_real,
|
|
||||||
key_size => $key_size,
|
|
||||||
eku => ['id-kp-clientAuth', 'id-kp-serverAuth'],
|
|
||||||
wait => true,
|
|
||||||
tag => 'haproxy-cert',
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
concat { $service_pem :
|
|
||||||
ensure => present,
|
|
||||||
mode => '0640',
|
|
||||||
owner => $cert_user,
|
|
||||||
group => $cert_group,
|
|
||||||
tag => 'haproxy-cert',
|
|
||||||
}
|
|
||||||
Package<| name == $::haproxy::params::package_name |> -> Concat[$service_pem]
|
|
||||||
|
|
||||||
concat::fragment { "${title}-cert-fragment":
|
|
||||||
target => $service_pem,
|
|
||||||
source => $service_certificate,
|
|
||||||
order => '01',
|
|
||||||
tag => 'haproxy-cert',
|
|
||||||
require => Certmonger_certificate["${title}-cert"],
|
|
||||||
}
|
|
||||||
|
|
||||||
if $certmonger_ca == 'local' {
|
|
||||||
$ca_pem = getparam(Class['tripleo::certmonger::ca::local'], 'ca_pem')
|
|
||||||
concat::fragment { "${title}-ca-fragment":
|
|
||||||
target => $service_pem,
|
|
||||||
source => $ca_pem,
|
|
||||||
order => '10',
|
|
||||||
tag => 'haproxy-cert',
|
|
||||||
require => Class['tripleo::certmonger::ca::local'],
|
|
||||||
}
|
|
||||||
} elsif $certmonger_ca == 'IPA' {
|
|
||||||
concat::fragment { "${title}-ca-fragment":
|
|
||||||
target => $service_pem,
|
|
||||||
source => '/etc/ipa/ca.crt',
|
|
||||||
order => '10',
|
|
||||||
tag => 'haproxy-cert',
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
concat::fragment { "${title}-key-fragment":
|
|
||||||
target => $service_pem,
|
|
||||||
source => $service_key,
|
|
||||||
order => 20,
|
|
||||||
tag => 'haproxy-cert',
|
|
||||||
require => Certmonger_certificate["${title}-cert"],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,55 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# : = Class: tripleo::certmonger::haproxy_dirs
|
|
||||||
#
|
|
||||||
# Creates the necessary directories for haproxy's certificates and keys in the
|
|
||||||
# assigned locations if specified. It also assigns the correct SELinux tags.
|
|
||||||
#
|
|
||||||
# === Parameters:
|
|
||||||
#
|
|
||||||
# [*certificate_dir*]
|
|
||||||
# (Optional) Directory where haproxy's certificates will be stored. If left
|
|
||||||
# unspecified, it won't be created.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_dir*]
|
|
||||||
# (Optional) Directory where haproxy's keys will be stored.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::haproxy_dirs(
|
|
||||||
$certificate_dir = undef,
|
|
||||||
$key_dir = undef,
|
|
||||||
){
|
|
||||||
|
|
||||||
if $certificate_dir {
|
|
||||||
file { $certificate_dir :
|
|
||||||
ensure => 'directory',
|
|
||||||
selrole => 'object_r',
|
|
||||||
seltype => 'cert_t',
|
|
||||||
seluser => 'system_u',
|
|
||||||
}
|
|
||||||
File[$certificate_dir] ~> Certmonger_certificate<| tag == 'haproxy-cert' |>
|
|
||||||
}
|
|
||||||
|
|
||||||
if $key_dir {
|
|
||||||
file { $key_dir :
|
|
||||||
ensure => 'directory',
|
|
||||||
selrole => 'object_r',
|
|
||||||
seltype => 'cert_t',
|
|
||||||
seluser => 'system_u',
|
|
||||||
}
|
|
||||||
File[$key_dir] ~> Certmonger_certificate<| tag == 'haproxy-cert' |>
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,86 +0,0 @@
|
|||||||
# Copyright 2016 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Resource: tripleo::certmonger::httpd
|
|
||||||
#
|
|
||||||
# Request a certificate for the httpd service and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*dnsnames*]
|
|
||||||
# (Optional) The DNS names that will be added for the SubjectAltNames entry
|
|
||||||
# in the certificate. If left unset, the value will be set to the $hostname.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# If nothing is given, it will default to: "systemctl restart ${service name}"
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# The haproxy service principal that is set for HAProxy in kerberos.
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
define tripleo::certmonger::httpd (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$dnsnames = undef,
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
include apache::params
|
|
||||||
|
|
||||||
if $dnsnames {
|
|
||||||
$dnsnames_real = $dnsnames
|
|
||||||
} else {
|
|
||||||
$dnsnames_real = $hostname
|
|
||||||
}
|
|
||||||
|
|
||||||
certmonger_certificate { $name :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $dnsnames_real,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
tag => 'apache-cert',
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
Certmonger_certificate[$name] ~> Service<| title == $::apache::params::service_name |>
|
|
||||||
}
|
|
||||||
@ -1,86 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Resource: tripleo::certmonger::libvirt
|
|
||||||
#
|
|
||||||
# Request a certificate for libvirt and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# If nothing is given, it will default to: "systemctl reload ${service name}"
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The service principal that is set for the service in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
define tripleo::certmonger::libvirt (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
include nova::params
|
|
||||||
|
|
||||||
$postsave_cmd_real = pick($postsave_cmd, "systemctl reload ${::nova::params::libvirt_service_name}")
|
|
||||||
certmonger_certificate { $name :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd_real,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
tag => 'libvirt-cert',
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
# Just register the files in puppet's resource catalog. Certmonger should
|
|
||||||
# give the right permissions.
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate[$name],
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate[$name],
|
|
||||||
}
|
|
||||||
|
|
||||||
File[$service_certificate] ~> Service<| title == $::nova::params::libvirt_service_name |>
|
|
||||||
File[$service_key] ~> Service<| title == $::nova::params::libvirt_service_name |>
|
|
||||||
}
|
|
||||||
@ -1,56 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::libvirt_dirs
|
|
||||||
#
|
|
||||||
# Creates the necessary directories for libvirt's certificates and keys in the
|
|
||||||
# assigned locations if specified. It also assigns the correct SELinux tags.
|
|
||||||
#
|
|
||||||
# === Parameters:
|
|
||||||
#
|
|
||||||
# [*certificate_dir*]
|
|
||||||
# (Optional) Directory where libvirt's certificates will be stored. If left
|
|
||||||
# unspecified, it won't be created.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_dir*]
|
|
||||||
# (Optional) Directory where libvirt's keys will be stored.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::libvirt_dirs(
|
|
||||||
$certificate_dir = undef,
|
|
||||||
$key_dir = undef,
|
|
||||||
){
|
|
||||||
|
|
||||||
if $certificate_dir {
|
|
||||||
file { $certificate_dir :
|
|
||||||
ensure => 'directory',
|
|
||||||
selrole => 'object_r',
|
|
||||||
seltype => 'cert_t',
|
|
||||||
seluser => 'system_u',
|
|
||||||
}
|
|
||||||
File[$certificate_dir] ~> Certmonger_certificate<| tag == 'libvirt-cert' |>
|
|
||||||
}
|
|
||||||
|
|
||||||
if $key_dir {
|
|
||||||
file { $key_dir :
|
|
||||||
ensure => 'directory',
|
|
||||||
selrole => 'object_r',
|
|
||||||
seltype => 'cert_t',
|
|
||||||
seluser => 'system_u',
|
|
||||||
}
|
|
||||||
File[$key_dir] ~> Certmonger_certificate<| tag == 'libvirt-cert' |>
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1,122 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Resource: tripleo::certmonger::libvirt_vnc
|
|
||||||
#
|
|
||||||
# Request a certificate for libvirt-vnc and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca_vnc', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# If nothing is given, it will default to: "systemctl reload ${service name}"
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The service principal that is set for the service in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*cacertfile*]
|
|
||||||
# (Optional) Specifies that path to write the CA cerftificate to.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*notify_service*]
|
|
||||||
# (Optional) Service to reload when certificate is created/renewed
|
|
||||||
# Defaults to $::nova::params::libvirt_service_name
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
define tripleo::certmonger::libvirt_vnc (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca_vnc', 'local'),
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$cacertfile = undef,
|
|
||||||
$notify_service = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
include nova::params
|
|
||||||
|
|
||||||
$notify_service_real = pick($notify_service, $::nova::params::libvirt_service_name)
|
|
||||||
|
|
||||||
$postsave_cmd_real = pick($postsave_cmd, "systemctl reload ${notify_service_real}")
|
|
||||||
|
|
||||||
certmonger_certificate { $name :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd_real,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
cacertfile => $cacertfile,
|
|
||||||
wait => true,
|
|
||||||
tag => 'libvirt-cert',
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
if $cacertfile {
|
|
||||||
# Sometimes certmonger returns before creating the cacert file. This has
|
|
||||||
# been reported in: https://bugzilla.redhat.com/show_bug.cgi?id=1759281
|
|
||||||
# Until this is fixed, add this workaround.
|
|
||||||
exec { $cacertfile :
|
|
||||||
require => Certmonger_certificate[$name],
|
|
||||||
command => "test -f ${cacertfile}",
|
|
||||||
unless => "test -f ${cacertfile}",
|
|
||||||
tries => 60,
|
|
||||||
try_sleep => 1,
|
|
||||||
timeout => 60,
|
|
||||||
path => '/usr/bin:/bin',
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $cacertfile :
|
|
||||||
require => Exec[$cacertfile],
|
|
||||||
mode => '0644'
|
|
||||||
}
|
|
||||||
~> Service<| title == $notify_service_real |>
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate[$name],
|
|
||||||
mode => '0644'
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate[$name],
|
|
||||||
group => 'qemu',
|
|
||||||
mode => '0640'
|
|
||||||
}
|
|
||||||
|
|
||||||
File[$service_certificate] ~> Service<| title == $notify_service_real |>
|
|
||||||
File[$service_key] ~> Service<| title == $notify_service_real |>
|
|
||||||
}
|
|
||||||
@ -1,56 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::libvirt_vnc_dirs
|
|
||||||
#
|
|
||||||
# Creates the necessary directories for libvirt vnc certificates and keys in the
|
|
||||||
# assigned locations if specified. It also assigns the correct SELinux tags.
|
|
||||||
#
|
|
||||||
# === Parameters:
|
|
||||||
#
|
|
||||||
# [*certificate_dir*]
|
|
||||||
# (Optional) Directory where libvirt-vnc's certificates will be stored. If left
|
|
||||||
# unspecified, it won't be created.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_dir*]
|
|
||||||
# (Optional) Directory where libvirt-vnc's keys will be stored.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::libvirt_vnc_dirs(
|
|
||||||
$certificate_dir = undef,
|
|
||||||
$key_dir = undef,
|
|
||||||
){
|
|
||||||
|
|
||||||
if $certificate_dir {
|
|
||||||
file { $certificate_dir :
|
|
||||||
ensure => 'directory',
|
|
||||||
selrole => 'object_r',
|
|
||||||
seltype => 'cert_t',
|
|
||||||
seluser => 'system_u',
|
|
||||||
}
|
|
||||||
File[$certificate_dir] ~> Certmonger_certificate<| tag == 'libvirt-vnc-cert' |>
|
|
||||||
}
|
|
||||||
|
|
||||||
if $key_dir {
|
|
||||||
file { $key_dir :
|
|
||||||
ensure => 'directory',
|
|
||||||
selrole => 'object_r',
|
|
||||||
seltype => 'cert_t',
|
|
||||||
seluser => 'system_u',
|
|
||||||
}
|
|
||||||
File[$key_dir] ~> Certmonger_certificate<| tag == 'libvirt-vnc-cert' |>
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1,85 +0,0 @@
|
|||||||
# Copyright 2020 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::memcached
|
|
||||||
#
|
|
||||||
# Request a certificate for Memcached and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# If nothing is given, it will default to: "systemctl restart ${service name}"
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The service principal that is set for the service in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::memcached (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$postsave_cmd = '/usr/bin/certmonger-memcached-refresh.sh',
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
ensure_resource('file', '/usr/bin/certmonger-memcached-refresh.sh', {
|
|
||||||
source => 'puppet:///modules/tripleo/certmonger-memcached-refresh.sh',
|
|
||||||
mode => '0700',
|
|
||||||
seltype => 'bin_t',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
})
|
|
||||||
|
|
||||||
certmonger_certificate { 'memcached' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['memcached'],
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['memcached'],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,89 +0,0 @@
|
|||||||
# Copyright 2016 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::metrics_qdr
|
|
||||||
#
|
|
||||||
# Request a certificate for the MetricsQdr service and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# If nothing is given, it will default to: "systemctl restart ${service name}"
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The haproxy service principal that is set for metrics_qdr in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::metrics_qdr (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
include qdr::params
|
|
||||||
|
|
||||||
ensure_resource('file', '/usr/bin/certmonger-metrics-qdr-refresh.sh', {
|
|
||||||
source => 'puppet:///modules/tripleo/certmonger-metrics-qdr-refresh.sh',
|
|
||||||
mode => '0700',
|
|
||||||
seltype => 'bin_t',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
})
|
|
||||||
|
|
||||||
certmonger_certificate { 'metrics_qdr' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['metrics_qdr'],
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['metrics_qdr'],
|
|
||||||
}
|
|
||||||
|
|
||||||
File[$service_certificate] ~> Service<| title == $::qdr::params::service_name |>
|
|
||||||
File[$service_key] ~> Service<| title == $::qdr::params::service_name |>
|
|
||||||
}
|
|
||||||
@ -1,78 +0,0 @@
|
|||||||
# Copyright 2016 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::mysql
|
|
||||||
#
|
|
||||||
# Request a certificate for the MySQL/Mariadb service and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*dnsnames*]
|
|
||||||
# (Optional) The DNS names that will be added for the SubjectAltNames entry
|
|
||||||
# in the certificate. If left unset, the value will be set to the $hostname.
|
|
||||||
# This parameter can take both a string or an array of strings.
|
|
||||||
# Defaults to $hostname
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# If nothing is given, it will default to: "systemctl restart ${service name}"
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The haproxy service principal that is set for MySQL in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::mysql (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$dnsnames = $hostname,
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
certmonger_certificate { 'mysql' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $dnsnames,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,84 +0,0 @@
|
|||||||
# Copyright 2018 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::neutron
|
|
||||||
#
|
|
||||||
# Request a certificate for the Neutron service and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The haproxy service principal that is set for neutron in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::neutron (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
ensure_resource('file', '/usr/bin/certmonger-neutron-dhcpd-refresh.sh', {
|
|
||||||
source => 'puppet:///modules/tripleo/certmonger-neutron-dhcpd-refresh.sh',
|
|
||||||
mode => '0700',
|
|
||||||
seltype => 'bin_t',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
})
|
|
||||||
|
|
||||||
certmonger_certificate { 'neutron' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['neutron']
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['neutron']
|
|
||||||
}
|
|
||||||
|
|
||||||
Certmonger_certificate['neutron'] ~> Service<| tag == 'neutron-service' |>
|
|
||||||
}
|
|
||||||
@ -1,76 +0,0 @@
|
|||||||
# Copyright 2019 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::neutron_ovn
|
|
||||||
#
|
|
||||||
# Request a certificate for the ovn_controller service and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The haproxy service principal that is set for neutron in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::neutron_ovn (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
certmonger_certificate { 'neutron_ovn' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['neutron_ovn']
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['neutron_ovn']
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1,97 +0,0 @@
|
|||||||
# Copyright 2018 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::novnc_proxy
|
|
||||||
#
|
|
||||||
# Request a certificate for novnc_proxy and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The service principal that is set for the service in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*notify_service*]
|
|
||||||
# (Optional) Service to reload when certificate is created/renewed
|
|
||||||
# Defaults to $::nova::params::libvirt_service_name
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::novnc_proxy (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$notify_service = undef,
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
$principal = undef,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
include nova::params
|
|
||||||
|
|
||||||
$notify_service_real = pick($notify_service, $::nova::params::vncproxy_service_name)
|
|
||||||
|
|
||||||
ensure_resource('file', '/usr/bin/certmonger-novnc-proxy-refresh.sh', {
|
|
||||||
source => 'puppet:///modules/tripleo/certmonger-novnc-proxy-refresh.sh',
|
|
||||||
mode => '0700',
|
|
||||||
seltype => 'bin_t',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
})
|
|
||||||
|
|
||||||
certmonger_certificate { 'novnc-proxy' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
tag => 'novnc-proxy',
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['novnc-proxy'],
|
|
||||||
mode => '0644'
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['novnc-proxy'],
|
|
||||||
mode => '0640'
|
|
||||||
}
|
|
||||||
|
|
||||||
File[$service_certificate] ~> Service<| title == $notify_service_real |>
|
|
||||||
File[$service_key] ~> Service<| title == $notify_service_real |>
|
|
||||||
}
|
|
||||||
@ -1,80 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::openvswitch
|
|
||||||
#
|
|
||||||
# Request a certificate for the openvswitch service and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# Defaults to "systemctl reload openvswitch"
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The haproxy service principal that is set for openvswitch in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::openvswitch (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$postsave_cmd = 'systemctl reload openvswitch',
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
certmonger_certificate { 'openvswitch' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
file { $service_certificate :
|
|
||||||
owner => 'openvswitch',
|
|
||||||
group => 'hugetlbfs',
|
|
||||||
require => Certmonger_certificate['openvswitch'],
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
owner => 'openvswitch',
|
|
||||||
group => 'hugetlbfs',
|
|
||||||
require => Certmonger_certificate['openvswitch'],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,76 +0,0 @@
|
|||||||
# Copyright 2019 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::ovn_controller
|
|
||||||
#
|
|
||||||
# Request a certificate for the ovn_controller service and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The haproxy service principal that is set for neutron in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::ovn_controller (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
certmonger_certificate { 'ovn_controller' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['ovn_controller']
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['ovn_controller']
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1,75 +0,0 @@
|
|||||||
# Copyright 2019 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::ovn_sbdb
|
|
||||||
#
|
|
||||||
# Request a certificate for the ovn_sbdb service and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The haproxy service principal that is set for neutron in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::ovn_dbs (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
certmonger_certificate { 'ovn_dbs' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['ovn_dbs']
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['ovn_dbs']
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,76 +0,0 @@
|
|||||||
# Copyright 2019 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::ovn_metadata
|
|
||||||
#
|
|
||||||
# Request a certificate for the ovn_controller service and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The haproxy service principal that is set for neutron in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::ovn_metadata (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
certmonger_certificate { 'ovn_metadata' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['ovn_metadata']
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['ovn_metadata']
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1,76 +0,0 @@
|
|||||||
# Copyright 2020 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::ovn_octavia
|
|
||||||
#
|
|
||||||
# Request a certificate for the ovn_controller service and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The haproxy service principal that is set for neutron in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::ovn_octavia (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
certmonger_certificate { 'ovn_octavia' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['ovn_octavia']
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['ovn_octavia']
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1,108 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Resource: tripleo::certmonger::qemu
|
|
||||||
#
|
|
||||||
# Request a certificate for quemu and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The service principal that is set for the service in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*cacertfile*]
|
|
||||||
# (Optional) Specifies that path to write the CA cerftificate to.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
define tripleo::certmonger::qemu (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca_qemu', 'local'),
|
|
||||||
$cacertfile = undef,
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
include nova::params
|
|
||||||
|
|
||||||
certmonger_certificate { $name :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
cacertfile => $cacertfile,
|
|
||||||
wait => true,
|
|
||||||
tag => 'qemu-cert',
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
if $cacertfile {
|
|
||||||
# Sometimes certmonger returns before creating the cacert file. This has
|
|
||||||
# been reported in: https://bugzilla.redhat.com/show_bug.cgi?id=1759281
|
|
||||||
# Until this is fixed, add this workaround.
|
|
||||||
exec { $cacertfile :
|
|
||||||
require => Certmonger_certificate[$name],
|
|
||||||
command => "test -f ${cacertfile}",
|
|
||||||
unless => "test -f ${cacertfile}",
|
|
||||||
tries => 60,
|
|
||||||
try_sleep => 1,
|
|
||||||
timeout => 60,
|
|
||||||
path => '/usr/bin:/bin',
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $cacertfile :
|
|
||||||
require => Exec[$cacertfile],
|
|
||||||
mode => '0644'
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate[$name],
|
|
||||||
mode => '0644'
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate[$name],
|
|
||||||
group => 'qemu',
|
|
||||||
mode => '0640'
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,41 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::qemu_dirs
|
|
||||||
#
|
|
||||||
# Creates the necessary directories for qemu certificates and keys in the
|
|
||||||
# assigned locations if specified. It also assigns the correct SELinux tags.
|
|
||||||
#
|
|
||||||
# === Parameters:
|
|
||||||
#
|
|
||||||
# [*certificate_dir*]
|
|
||||||
# (Optional) Directory where qemu server certificates will be stored. If left
|
|
||||||
# unspecified, it won't be created.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::qemu_dirs(
|
|
||||||
$certificate_dir = undef,
|
|
||||||
){
|
|
||||||
|
|
||||||
if $certificate_dir {
|
|
||||||
file { $certificate_dir :
|
|
||||||
ensure => 'directory',
|
|
||||||
selrole => 'object_r',
|
|
||||||
seltype => 'cert_t',
|
|
||||||
seluser => 'system_u',
|
|
||||||
}
|
|
||||||
File[$certificate_dir] ~> Certmonger_certificate<| tag == 'qemu-server-cert' |>
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1,42 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::qemu_nbd_dirs
|
|
||||||
#
|
|
||||||
# Creates the necessary directories for qemu nbd client certificates and keys
|
|
||||||
# in the assigned locations if specified. It also assigns the correct SELinux
|
|
||||||
# tags.
|
|
||||||
#
|
|
||||||
# === Parameters:
|
|
||||||
#
|
|
||||||
# [*certificate_dir*]
|
|
||||||
# (Optional) Directory where qemu-nbd's client certificates will be stored.
|
|
||||||
# If left unspecified, it won't be created.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::qemu_nbd_dirs(
|
|
||||||
$certificate_dir = undef,
|
|
||||||
){
|
|
||||||
|
|
||||||
if $certificate_dir {
|
|
||||||
file { $certificate_dir :
|
|
||||||
ensure => 'directory',
|
|
||||||
selrole => 'object_r',
|
|
||||||
seltype => 'cert_t',
|
|
||||||
seluser => 'system_u',
|
|
||||||
}
|
|
||||||
File[$certificate_dir] ~> Certmonger_certificate<| tag == 'qemu-cert' |>
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1,84 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::rabbitmq
|
|
||||||
#
|
|
||||||
# Request a certificate for RabbitMQ and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The service principal that is set for the service in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::rabbitmq (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
ensure_resource('file', '/usr/bin/certmonger-rabbitmq-refresh.sh', {
|
|
||||||
source => 'puppet:///modules/tripleo/certmonger-rabbitmq-refresh.sh',
|
|
||||||
mode => '0700',
|
|
||||||
seltype => 'bin_t',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
})
|
|
||||||
|
|
||||||
certmonger_certificate { 'rabbitmq' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $hostname,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['rabbitmq'],
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['rabbitmq'],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,91 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# == Class: tripleo::certmonger::redis
|
|
||||||
#
|
|
||||||
# Request a certificate for Redis and do the necessary setup.
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*hostname*]
|
|
||||||
# The hostname of the node. this will be set in the CN of the certificate.
|
|
||||||
#
|
|
||||||
# [*service_certificate*]
|
|
||||||
# The path to the certificate that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*service_key*]
|
|
||||||
# The path to the key that will be used for TLS in this service.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# [*dnsnames*]
|
|
||||||
# (Optional) The DNS names that will be added for the SubjectAltNames entry
|
|
||||||
# in the certificate. If left unset, the value will be set to the $hostname.
|
|
||||||
# This parameter can take both a string or an array of strings.
|
|
||||||
# Defaults to $hostname
|
|
||||||
#
|
|
||||||
# [*postsave_cmd*]
|
|
||||||
# (Optional) Specifies the command to execute after requesting a certificate.
|
|
||||||
# Defaults to undef.
|
|
||||||
#
|
|
||||||
# [*principal*]
|
|
||||||
# (Optional) The service principal that is set for the service in kerberos.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*key_size*]
|
|
||||||
# (Optional) Specifies the private key size used when creating the certificate.
|
|
||||||
# Defaults to 2048bits.
|
|
||||||
#
|
|
||||||
class tripleo::certmonger::redis (
|
|
||||||
$hostname,
|
|
||||||
$service_certificate,
|
|
||||||
$service_key,
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$dnsnames = $hostname,
|
|
||||||
$postsave_cmd = undef,
|
|
||||||
$principal = undef,
|
|
||||||
$key_size = 2048,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
ensure_resource('file', '/usr/bin/certmonger-redis-refresh.sh', {
|
|
||||||
source => 'puppet:///modules/tripleo/certmonger-redis-refresh.sh',
|
|
||||||
mode => '0700',
|
|
||||||
seltype => 'bin_t',
|
|
||||||
notify => Service['certmonger']
|
|
||||||
})
|
|
||||||
|
|
||||||
certmonger_certificate { 'redis' :
|
|
||||||
ensure => 'present',
|
|
||||||
certfile => $service_certificate,
|
|
||||||
keyfile => $service_key,
|
|
||||||
hostname => $hostname,
|
|
||||||
dnsname => $dnsnames,
|
|
||||||
principal => $principal,
|
|
||||||
postsave_cmd => $postsave_cmd,
|
|
||||||
ca => $certmonger_ca,
|
|
||||||
key_size => $key_size,
|
|
||||||
wait => true,
|
|
||||||
require => Class['::certmonger'],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $service_certificate :
|
|
||||||
require => Certmonger_certificate['redis'],
|
|
||||||
}
|
|
||||||
file { $service_key :
|
|
||||||
require => Certmonger_certificate['redis'],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,322 +0,0 @@
|
|||||||
# Copyright 2017 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# [*certmonger_ca*]
|
|
||||||
# (Optional) The CA that certmonger will use to generate the certificates.
|
|
||||||
# Defaults to hiera('certmonger_ca', 'local').
|
|
||||||
#
|
|
||||||
# == class: tripleo::profile::base::certmonger_user
|
|
||||||
#
|
|
||||||
# Profile that ensures that the relevant certmonger certificates have been
|
|
||||||
# requested. The certificates come from the hiera set by the specific profiles
|
|
||||||
# and come in a pre-defined format.
|
|
||||||
# For a service that has several certificates (one per network name):
|
|
||||||
# apache_certificates_specs:
|
|
||||||
# httpd-internal_api:
|
|
||||||
# hostname: <overcloud controller fqdn>
|
|
||||||
# service_certificate: <service certificate path>
|
|
||||||
# service_key: <service key path>
|
|
||||||
# principal: "HTTP/<overcloud controller fqdn>"
|
|
||||||
# For a service that uses a single certificate:
|
|
||||||
# mysql_certificates_specs:
|
|
||||||
# hostname: <overcloud controller fqdn>
|
|
||||||
# service_certificate: <service certificate path>
|
|
||||||
# service_key: <service key path>
|
|
||||||
# principal: "mysql/<overcloud controller fqdn>"
|
|
||||||
#
|
|
||||||
# === Parameters
|
|
||||||
#
|
|
||||||
# [*step*]
|
|
||||||
# (Optional) The current step in deployment. See tripleo-heat-templates
|
|
||||||
# for more details.
|
|
||||||
# Defaults to hiera('step')
|
|
||||||
#
|
|
||||||
# [*apache_certificates_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('apache_certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*haproxy_certificates_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('tripleo::profile::base::haproxy::certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*libvirt_certificates_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('libvirt_certificates_specs', {}).
|
|
||||||
#
|
|
||||||
# [*libvirt_postsave_cmd*]
|
|
||||||
# (Optional) If set, it overrides the default way to restart libvirt when the
|
|
||||||
# certificate is renewed.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*libvirt_vnc_certificates_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('libvirt_vnc_certificates_specs', {}).
|
|
||||||
#
|
|
||||||
# [*libvirt_vnc_postsave_cmd*]
|
|
||||||
# (Optional) If set, it overrides the default way to restart services when the
|
|
||||||
# certificate is renewed.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*qemu_certificates_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('qemu_certificates_specs', {}).
|
|
||||||
#
|
|
||||||
# [*qemu_postsave_cmd*]
|
|
||||||
# (Optional) If set, it overrides the default way to restart services when the
|
|
||||||
# certificate is renewed.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*qdr_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger fot the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('tripleo::profile::base::metrics::qdr::certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*mysql_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('tripleo::profile::base::database::mysql::certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*memcached_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('tripleo::profile::base::memcached::certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*rabbitmq_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*redis_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('redis_certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*ceph_grafana_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('ceph_grafana_certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*ceph_dashboard_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('ceph_dashboard_certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*ceph_rgw_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('ceph_rgw_certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*etcd_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('tripleo::profile::base::etcd::certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*neutron_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('tripleo::profile::base::neutron::certificate_specs', {}).
|
|
||||||
#
|
|
||||||
# [*novnc_proxy_certificates_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('novnc_proxy_certificates_specs',{})
|
|
||||||
#
|
|
||||||
# [*novnc_proxy_postsave_cmd*]
|
|
||||||
# (Optional) If set, it overrides the default way to restart novnc proxy when the
|
|
||||||
# certificate is renewed.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*ovn_dbs_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('ovn_dbs_certificate_specs', {})
|
|
||||||
#
|
|
||||||
# [*ovn_controller_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('ovn_controller_certificate_specs', {})
|
|
||||||
#
|
|
||||||
# [*ovn_metadata_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('ovn_metadata_certificate_specs', {})
|
|
||||||
#
|
|
||||||
# [*neutron_ovn_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('neutron_ovn_certificate_specs', {})
|
|
||||||
#
|
|
||||||
# [*ovn_octavia_certificate_specs*]
|
|
||||||
# (Optional) The specifications to give to certmonger for the certificate(s)
|
|
||||||
# it will create.
|
|
||||||
# Defaults to hiera('ovn_octavia_certificate_specs', {})
|
|
||||||
#
|
|
||||||
# === Deprecated
|
|
||||||
#
|
|
||||||
# [*haproxy_postsave_cmd*]
|
|
||||||
# (Optional) If set, it overrides the default way to restart haproxy when the
|
|
||||||
# certificate is renewed.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
# [*apache_postsave_cmd*]
|
|
||||||
# (Optional) If set, it overrides the default way to restart apache when the
|
|
||||||
# certificate is renewed.
|
|
||||||
# Defaults to undef
|
|
||||||
#
|
|
||||||
class tripleo::profile::base::certmonger_user (
|
|
||||||
$step = Integer(hiera('step')),
|
|
||||||
$certmonger_ca = hiera('certmonger_ca', 'local'),
|
|
||||||
$apache_certificates_specs = hiera('apache_certificates_specs', {}),
|
|
||||||
$haproxy_certificates_specs = hiera('tripleo::profile::base::haproxy::certificates_specs', {}),
|
|
||||||
$libvirt_certificates_specs = hiera('libvirt_certificates_specs', {}),
|
|
||||||
$libvirt_postsave_cmd = undef,
|
|
||||||
$libvirt_vnc_certificates_specs = hiera('libvirt_vnc_certificates_specs', {}),
|
|
||||||
$libvirt_vnc_postsave_cmd = undef,
|
|
||||||
$qemu_certificates_specs = hiera('qemu_certificates_specs', {}),
|
|
||||||
$qemu_postsave_cmd = undef,
|
|
||||||
$qdr_certificate_specs = hiera('tripleo::profile::base::metrics::qdr::certificate_specs', {}),
|
|
||||||
$mysql_certificate_specs = hiera('tripleo::profile::base::database::mysql::certificate_specs', {}),
|
|
||||||
$memcached_certificate_specs = hiera('tripleo::profile::base::memcached::certificate_specs', {}),
|
|
||||||
$rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}),
|
|
||||||
$redis_certificate_specs = hiera('redis_certificate_specs', {}),
|
|
||||||
$etcd_certificate_specs = hiera('tripleo::profile::base::etcd::certificate_specs', {}),
|
|
||||||
$neutron_certificate_specs = hiera('tripleo::profile::base::neutron::certificate_specs', {}),
|
|
||||||
$novnc_proxy_certificates_specs = hiera('novnc_proxy_certificates_specs',{}),
|
|
||||||
$ceph_grafana_certificate_specs = hiera('ceph_grafana_certificate_specs', {}),
|
|
||||||
$ceph_dashboard_certificate_specs = hiera('ceph_dashboard_certificate_specs', {}),
|
|
||||||
$ceph_rgw_certificate_specs = hiera('ceph_rgw_certificate_specs', {}),
|
|
||||||
$ovn_dbs_certificate_specs = hiera('ovn_dbs_certificate_specs', {}),
|
|
||||||
$ovn_controller_certificate_specs = hiera('ovn_controller_certificate_specs', {}),
|
|
||||||
$ovn_metadata_certificate_specs = hiera('ovn_metadata_certificate_specs', {}),
|
|
||||||
$neutron_ovn_certificate_specs = hiera('neutron_ovn_certificate_specs', {}),
|
|
||||||
$ovn_octavia_certificate_specs = hiera('ovn_octavia_certificate_specs', {}),
|
|
||||||
$novnc_proxy_postsave_cmd = undef,
|
|
||||||
# Deprecated
|
|
||||||
$haproxy_postsave_cmd = undef,
|
|
||||||
$apache_postsave_cmd = undef,
|
|
||||||
) {
|
|
||||||
include certmonger
|
|
||||||
|
|
||||||
if $step == 1 {
|
|
||||||
# This is only needed for certmonger's local CA. For any other CA this
|
|
||||||
# operation (trusting the CA) should be done by the deployer.
|
|
||||||
if $certmonger_ca == 'local' {
|
|
||||||
include tripleo::certmonger::ca::local
|
|
||||||
}
|
|
||||||
|
|
||||||
# Remove haproxy_certificates_specs where hostname is empty.
|
|
||||||
# Workaround bug: https://bugs.launchpad.net/tripleo/+bug/1905604
|
|
||||||
$haproxy_certificates_specs_filtered = $haproxy_certificates_specs.filter | $specs, $keys | { ! empty($keys[hostname]) }
|
|
||||||
unless empty($haproxy_certificates_specs_filtered) {
|
|
||||||
$reload_haproxy = ['systemctl reload tripleo_haproxy']
|
|
||||||
Class['::tripleo::certmonger::ca::crl'] ~> Haproxy::Balancermember<||>
|
|
||||||
if defined(Class['::haproxy']) {
|
|
||||||
Class['::tripleo::certmonger::ca::crl'] ~> Class['::haproxy']
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
$reload_haproxy = []
|
|
||||||
}
|
|
||||||
class { 'tripleo::certmonger::ca::crl' :
|
|
||||||
reload_cmds => $reload_haproxy,
|
|
||||||
}
|
|
||||||
Certmonger_certificate<||> -> Class['::tripleo::certmonger::ca::crl']
|
|
||||||
include tripleo::certmonger::ca::libvirt_vnc
|
|
||||||
include tripleo::certmonger::ca::qemu
|
|
||||||
|
|
||||||
# Remove apache_certificates_specs where hostname is empty.
|
|
||||||
# Workaround bug: https://bugs.launchpad.net/tripleo/+bug/1811207
|
|
||||||
$apache_certificates_specs_filtered = $apache_certificates_specs.filter | $specs, $keys | { ! empty($keys[hostname]) }
|
|
||||||
unless empty($apache_certificates_specs_filtered) {
|
|
||||||
include tripleo::certmonger::apache_dirs
|
|
||||||
ensure_resources('tripleo::certmonger::httpd', $apache_certificates_specs_filtered)
|
|
||||||
}
|
|
||||||
unless empty($libvirt_certificates_specs) {
|
|
||||||
include tripleo::certmonger::libvirt_dirs
|
|
||||||
ensure_resources('tripleo::certmonger::libvirt', $libvirt_certificates_specs,
|
|
||||||
{'postsave_cmd' => $libvirt_postsave_cmd})
|
|
||||||
}
|
|
||||||
unless empty($libvirt_vnc_certificates_specs) {
|
|
||||||
include tripleo::certmonger::libvirt_vnc_dirs
|
|
||||||
ensure_resources('tripleo::certmonger::libvirt_vnc', $libvirt_vnc_certificates_specs,
|
|
||||||
{'postsave_cmd' => $libvirt_vnc_postsave_cmd})
|
|
||||||
}
|
|
||||||
unless empty($qemu_certificates_specs) {
|
|
||||||
include tripleo::certmonger::qemu_dirs
|
|
||||||
include tripleo::certmonger::qemu_nbd_dirs
|
|
||||||
ensure_resources('tripleo::certmonger::qemu', $qemu_certificates_specs,
|
|
||||||
{'postsave_cmd' => $qemu_postsave_cmd})
|
|
||||||
}
|
|
||||||
unless empty($haproxy_certificates_specs_filtered) {
|
|
||||||
include tripleo::certmonger::haproxy_dirs
|
|
||||||
ensure_resources('tripleo::certmonger::haproxy', $haproxy_certificates_specs_filtered)
|
|
||||||
# The haproxy fronends (or listen resources) depend on the certificate
|
|
||||||
# existing and need to be refreshed if it changed.
|
|
||||||
Tripleo::Certmonger::Haproxy<||> ~> Haproxy::Listen<||>
|
|
||||||
}
|
|
||||||
unless empty($qdr_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::metrics_qdr', $qdr_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($memcached_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::memcached', $memcached_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($mysql_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::mysql', $mysql_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($rabbitmq_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::rabbitmq', $rabbitmq_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($redis_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::redis', $redis_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($etcd_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::etcd', $etcd_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($neutron_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::neutron', $neutron_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($novnc_proxy_certificates_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::novnc_proxy', $novnc_proxy_certificates_specs,
|
|
||||||
{'postsave_cmd' => $novnc_proxy_postsave_cmd})
|
|
||||||
}
|
|
||||||
unless empty($ceph_grafana_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::ceph_grafana', $ceph_grafana_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($ceph_dashboard_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::ceph_dashboard', $ceph_dashboard_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($ceph_rgw_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::ceph_rgw', $ceph_rgw_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($ovn_dbs_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::ovn_dbs', $ovn_dbs_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($ovn_controller_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::ovn_controller', $ovn_controller_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($ovn_metadata_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::ovn_metadata', $ovn_metadata_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($neutron_ovn_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::neutron_ovn', $neutron_ovn_certificate_specs)
|
|
||||||
}
|
|
||||||
unless empty($ovn_octavia_certificate_specs) {
|
|
||||||
ensure_resource('class', 'tripleo::certmonger::ovn_octavia', $ovn_octavia_certificate_specs)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
deprecations:
|
||||||
|
- |
|
||||||
|
Remove support for puppet_certmonger. All certificates are now managed by
|
||||||
|
the linux-system-roles.certificate ansible role configured from each
|
||||||
|
service's heat template. ::tripleo::certmonger puppet files are removed.
|
||||||
@ -1,116 +0,0 @@
|
|||||||
#
|
|
||||||
# Copyright (C) 2017 Red Hat Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# Unit tests for tripleo
|
|
||||||
#
|
|
||||||
|
|
||||||
require 'spec_helper'
|
|
||||||
|
|
||||||
describe 'tripleo::certmonger::ca::crl' do
|
|
||||||
|
|
||||||
shared_examples_for 'tripleo::certmonger::ca::crl' do
|
|
||||||
|
|
||||||
context 'with default parameters (no crl_source)' do
|
|
||||||
it 'should ensure no CRL nor cron job are present' do
|
|
||||||
is_expected.not_to contain_exec('tripleo-ca-crl')
|
|
||||||
is_expected.to contain_cron('tripleo-refresh-crl-file').with(
|
|
||||||
:ensure => 'absent'
|
|
||||||
)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
context 'with defined CRL source' do
|
|
||||||
let :params do
|
|
||||||
{
|
|
||||||
:crl_dest => '/etc/pki/CA/crl/overcloud-crl.pem',
|
|
||||||
:crl_preprocessed => '/etc/pki/CA/crl/overcloud-crl.bin',
|
|
||||||
:crl_source => 'file://tmp/some/crl.bin',
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
let :process_cmd do
|
|
||||||
"openssl crl -in #{params[:crl_preprocessed]} -inform DER -outform PEM -out #{params[:crl_dest]}"
|
|
||||||
end
|
|
||||||
|
|
||||||
let :cron_cmd do
|
|
||||||
"curl -g -s -L -o #{params[:crl_preprocessed]} #{params[:crl_source]} && #{process_cmd}"
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should create and process CRL file' do
|
|
||||||
is_expected.to contain_exec('tripleo-ca-crl').with(
|
|
||||||
:command => "curl -Ls --connect-timeout 120 -o #{params[:crl_preprocessed]} #{params[:crl_source]}",
|
|
||||||
:tries => 5,
|
|
||||||
:try_sleep => 5
|
|
||||||
)
|
|
||||||
is_expected.to contain_file('tripleo-ca-crl-file').with(
|
|
||||||
:group => 'root',
|
|
||||||
:mode => '0644',
|
|
||||||
:owner => 'root',
|
|
||||||
:path => "#{params[:crl_preprocessed]}"
|
|
||||||
)
|
|
||||||
is_expected.to contain_exec('tripleo-ca-crl-process-command').with(
|
|
||||||
:command => process_cmd
|
|
||||||
)
|
|
||||||
is_expected.to contain_cron('tripleo-refresh-crl-file').with(
|
|
||||||
:ensure => 'present',
|
|
||||||
:command => cron_cmd
|
|
||||||
)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
context 'with defined CRL source and no processing' do
|
|
||||||
let :params do
|
|
||||||
{
|
|
||||||
:crl_dest => '/etc/pki/CA/crl/overcloud-crl.pem',
|
|
||||||
:crl_source => 'file://tmp/some/crl.pem',
|
|
||||||
:process => false
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
let :cron_cmd do
|
|
||||||
"curl -g -s -L -o #{params[:crl_dest]} #{params[:crl_source]}"
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should create and process CRL file' do
|
|
||||||
is_expected.to contain_exec('tripleo-ca-crl').with(
|
|
||||||
:command => "curl -Ls --connect-timeout 120 -o #{params[:crl_dest]} #{params[:crl_source]}",
|
|
||||||
:tries => 5,
|
|
||||||
:try_sleep => 5
|
|
||||||
)
|
|
||||||
is_expected.to contain_file('tripleo-ca-crl-file').with(
|
|
||||||
:group => 'root',
|
|
||||||
:mode => '0644',
|
|
||||||
:owner => 'root',
|
|
||||||
:path => "#{params[:crl_dest]}"
|
|
||||||
)
|
|
||||||
is_expected.to_not contain_exec('tripleo-ca-crl-process-command')
|
|
||||||
is_expected.to contain_cron('tripleo-refresh-crl-file').with(
|
|
||||||
:ensure => 'present',
|
|
||||||
:command => cron_cmd
|
|
||||||
)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
on_supported_os.each do |os, facts|
|
|
||||||
context "on #{os}" do
|
|
||||||
let(:facts) do
|
|
||||||
facts.merge({})
|
|
||||||
end
|
|
||||||
|
|
||||||
it_behaves_like 'tripleo::certmonger::ca::crl'
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
@ -1,57 +0,0 @@
|
|||||||
#
|
|
||||||
# Copyright (C) 2017 Red Hat Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# Unit tests for tripleo
|
|
||||||
#
|
|
||||||
|
|
||||||
require 'spec_helper'
|
|
||||||
|
|
||||||
describe 'tripleo::certmonger::ca::local' do
|
|
||||||
|
|
||||||
shared_examples_for 'tripleo::certmonger::ca::local' do
|
|
||||||
|
|
||||||
let :pre_condition do
|
|
||||||
"include certmonger"
|
|
||||||
end
|
|
||||||
|
|
||||||
let :params do
|
|
||||||
{
|
|
||||||
:ca_pem => '/etc/pki/ca-trust/source/anchors/cm-local-ca.pem',
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should extract CA cert' do
|
|
||||||
is_expected.to contain_exec('extract-and-trust-ca')
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'set the correct permissions for the CA certificate file' do
|
|
||||||
is_expected.to contain_file(params[:ca_pem]).with(
|
|
||||||
:ensure => 'present',
|
|
||||||
:mode => '0644',
|
|
||||||
:owner => 'root'
|
|
||||||
)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
on_supported_os.each do |os, facts|
|
|
||||||
context "on #{os}" do
|
|
||||||
let(:facts) do
|
|
||||||
facts.merge({})
|
|
||||||
end
|
|
||||||
|
|
||||||
it_behaves_like 'tripleo::certmonger::ca::local'
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
@ -1,82 +0,0 @@
|
|||||||
#
|
|
||||||
# Copyright (C) 2017 Red Hat Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# Unit tests for tripleo
|
|
||||||
#
|
|
||||||
|
|
||||||
require 'spec_helper'
|
|
||||||
|
|
||||||
describe 'tripleo::certmonger::etcd' do
|
|
||||||
|
|
||||||
shared_examples_for 'tripleo::certmonger::etcd' do
|
|
||||||
let :params do
|
|
||||||
{
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:service_certificate => '/etc/pki/cert.crt',
|
|
||||||
:service_key => '/etc/pki/key.pem',
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
context 'with defaults' do
|
|
||||||
it 'should include the base for using certmonger' do
|
|
||||||
is_expected.to contain_class('certmonger')
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should request a certificate' do
|
|
||||||
is_expected.to contain_certmonger_certificate('etcd').with(
|
|
||||||
:ensure => 'present',
|
|
||||||
:certfile => '/etc/pki/cert.crt',
|
|
||||||
:keyfile => '/etc/pki/key.pem',
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:dnsname => 'localhost',
|
|
||||||
:principal => nil,
|
|
||||||
:postsave_cmd => nil,
|
|
||||||
:ca => 'local',
|
|
||||||
:wait => true,
|
|
||||||
)
|
|
||||||
is_expected.to contain_file('/etc/pki/cert.crt')
|
|
||||||
is_expected.to contain_file('/etc/pki/key.pem')
|
|
||||||
end
|
|
||||||
end
|
|
||||||
context 'with overrides' do
|
|
||||||
before :each do
|
|
||||||
params.merge!({
|
|
||||||
:certmonger_ca => 'IPA',
|
|
||||||
:dnsnames => 'host1,127.0.0.42',
|
|
||||||
:postsave_cmd => '/usr/bin/refresh_me.sh',
|
|
||||||
:principal => 'Principal_Lewis',
|
|
||||||
})
|
|
||||||
end
|
|
||||||
it 'should request a certificate with overrides' do
|
|
||||||
is_expected.to contain_certmonger_certificate('etcd').with(
|
|
||||||
:dnsname => 'host1,127.0.0.42',
|
|
||||||
:principal => 'Principal_Lewis',
|
|
||||||
:postsave_cmd => '/usr/bin/refresh_me.sh',
|
|
||||||
:ca => 'IPA',
|
|
||||||
)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
on_supported_os.each do |os, facts|
|
|
||||||
context "on #{os}" do
|
|
||||||
let(:facts) do
|
|
||||||
facts.merge({})
|
|
||||||
end
|
|
||||||
|
|
||||||
it_behaves_like 'tripleo::certmonger::etcd'
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
@ -1,60 +0,0 @@
|
|||||||
#
|
|
||||||
# Copyright (C) 2020 Red Hat Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# Unit tests for tripleo
|
|
||||||
#
|
|
||||||
|
|
||||||
require 'spec_helper'
|
|
||||||
|
|
||||||
describe 'tripleo::certmonger::memcached' do
|
|
||||||
|
|
||||||
shared_examples_for 'tripleo::certmonger::memcached' do
|
|
||||||
let :params do
|
|
||||||
{
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:service_certificate => '/etc/pki/cert.crt',
|
|
||||||
:service_key => '/etc/pki/key.pem',
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should include the base for using certmonger' do
|
|
||||||
is_expected.to contain_class('certmonger')
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should request a certificate' do
|
|
||||||
is_expected.to contain_certmonger_certificate('memcached').with(
|
|
||||||
:ensure => 'present',
|
|
||||||
:certfile => '/etc/pki/cert.crt',
|
|
||||||
:keyfile => '/etc/pki/key.pem',
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:dnsname => 'localhost',
|
|
||||||
:ca => 'local',
|
|
||||||
:wait => true,
|
|
||||||
)
|
|
||||||
is_expected.to contain_file('/etc/pki/cert.crt')
|
|
||||||
is_expected.to contain_file('/etc/pki/key.pem')
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
on_supported_os.each do |os, facts|
|
|
||||||
context "on #{os}" do
|
|
||||||
let(:facts) do
|
|
||||||
facts.merge({})
|
|
||||||
end
|
|
||||||
|
|
||||||
it_behaves_like 'tripleo::certmonger::memcached'
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
@ -1,58 +0,0 @@
|
|||||||
#
|
|
||||||
# Copyright (C) 2017 Red Hat Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# Unit tests for tripleo
|
|
||||||
#
|
|
||||||
|
|
||||||
require 'spec_helper'
|
|
||||||
|
|
||||||
describe 'tripleo::certmonger::mysql' do
|
|
||||||
|
|
||||||
shared_examples_for 'tripleo::certmonger::mysql' do
|
|
||||||
let :params do
|
|
||||||
{
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:service_certificate => '/etc/pki/cert.crt',
|
|
||||||
:service_key => '/etc/pki/key.pem',
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should include the base for using certmonger' do
|
|
||||||
is_expected.to contain_class('certmonger')
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should request a certificate' do
|
|
||||||
is_expected.to contain_certmonger_certificate('mysql').with(
|
|
||||||
:ensure => 'present',
|
|
||||||
:certfile => '/etc/pki/cert.crt',
|
|
||||||
:keyfile => '/etc/pki/key.pem',
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:dnsname => 'localhost',
|
|
||||||
:ca => 'local',
|
|
||||||
:wait => true,
|
|
||||||
)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
on_supported_os.each do |os, facts|
|
|
||||||
context "on #{os}" do
|
|
||||||
let(:facts) do
|
|
||||||
facts.merge({})
|
|
||||||
end
|
|
||||||
|
|
||||||
it_behaves_like 'tripleo::certmonger::mysql'
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
@ -1,68 +0,0 @@
|
|||||||
#
|
|
||||||
# Copyright (C) 2017 Red Hat Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# Unit tests for tripleo
|
|
||||||
#
|
|
||||||
|
|
||||||
require 'spec_helper'
|
|
||||||
|
|
||||||
describe 'tripleo::certmonger::openvswitch' do
|
|
||||||
|
|
||||||
shared_examples_for 'tripleo::certmonger::openvswitch' do
|
|
||||||
let :params do
|
|
||||||
{
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:service_certificate => '/etc/pki/cert.crt',
|
|
||||||
:service_key => '/etc/pki/key.pem',
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should include the base for using certmonger' do
|
|
||||||
is_expected.to contain_class('certmonger')
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should request a certificate' do
|
|
||||||
is_expected.to contain_certmonger_certificate('openvswitch').with(
|
|
||||||
:ensure => 'present',
|
|
||||||
:certfile => '/etc/pki/cert.crt',
|
|
||||||
:keyfile => '/etc/pki/key.pem',
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:dnsname => 'localhost',
|
|
||||||
:ca => 'local',
|
|
||||||
:wait => true,
|
|
||||||
)
|
|
||||||
is_expected.to contain_file('/etc/pki/cert.crt').with(
|
|
||||||
:owner => 'openvswitch',
|
|
||||||
:group => 'hugetlbfs',
|
|
||||||
:require => 'Certmonger_certificate[openvswitch]'
|
|
||||||
)
|
|
||||||
is_expected.to contain_file('/etc/pki/key.pem').with(
|
|
||||||
:owner => 'openvswitch',
|
|
||||||
:group => 'hugetlbfs',
|
|
||||||
:require => 'Certmonger_certificate[openvswitch]'
|
|
||||||
)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
on_supported_os.each do |os, facts|
|
|
||||||
context "on #{os}" do
|
|
||||||
let(:facts) do
|
|
||||||
facts.merge({})
|
|
||||||
end
|
|
||||||
|
|
||||||
it_behaves_like 'tripleo::certmonger::openvswitch'
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
@ -1,60 +0,0 @@
|
|||||||
#
|
|
||||||
# Copyright (C) 2019 Red Hat Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# Unit tests for tripleo
|
|
||||||
#
|
|
||||||
|
|
||||||
require 'spec_helper'
|
|
||||||
|
|
||||||
describe 'tripleo::certmonger::ovn_dbs' do
|
|
||||||
|
|
||||||
shared_examples_for 'tripleo::certmonger::ovn_dbs' do
|
|
||||||
let :params do
|
|
||||||
{
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:service_certificate => '/etc/pki/cert.crt',
|
|
||||||
:service_key => '/etc/pki/key.pem',
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should include the base for using certmonger' do
|
|
||||||
is_expected.to contain_class('certmonger')
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should request a certificate' do
|
|
||||||
is_expected.to contain_certmonger_certificate('ovn_dbs').with(
|
|
||||||
:ensure => 'present',
|
|
||||||
:certfile => '/etc/pki/cert.crt',
|
|
||||||
:keyfile => '/etc/pki/key.pem',
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:dnsname => 'localhost',
|
|
||||||
:ca => 'local',
|
|
||||||
:wait => true,
|
|
||||||
)
|
|
||||||
is_expected.to contain_file('/etc/pki/cert.crt')
|
|
||||||
is_expected.to contain_file('/etc/pki/key.pem')
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
on_supported_os.each do |os, facts|
|
|
||||||
context "on #{os}" do
|
|
||||||
let(:facts) do
|
|
||||||
facts.merge({})
|
|
||||||
end
|
|
||||||
|
|
||||||
it_behaves_like 'tripleo::certmonger::ovn_dbs'
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
@ -1,60 +0,0 @@
|
|||||||
#
|
|
||||||
# Copyright (C) 2017 Red Hat Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# Unit tests for tripleo
|
|
||||||
#
|
|
||||||
|
|
||||||
require 'spec_helper'
|
|
||||||
|
|
||||||
describe 'tripleo::certmonger::rabbitmq' do
|
|
||||||
|
|
||||||
shared_examples_for 'tripleo::certmonger::rabbitmq' do
|
|
||||||
let :params do
|
|
||||||
{
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:service_certificate => '/etc/pki/cert.crt',
|
|
||||||
:service_key => '/etc/pki/key.pem',
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should include the base for using certmonger' do
|
|
||||||
is_expected.to contain_class('certmonger')
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should request a certificate' do
|
|
||||||
is_expected.to contain_certmonger_certificate('rabbitmq').with(
|
|
||||||
:ensure => 'present',
|
|
||||||
:certfile => '/etc/pki/cert.crt',
|
|
||||||
:keyfile => '/etc/pki/key.pem',
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:dnsname => 'localhost',
|
|
||||||
:ca => 'local',
|
|
||||||
:wait => true,
|
|
||||||
)
|
|
||||||
is_expected.to contain_file('/etc/pki/cert.crt')
|
|
||||||
is_expected.to contain_file('/etc/pki/key.pem')
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
on_supported_os.each do |os, facts|
|
|
||||||
context "on #{os}" do
|
|
||||||
let(:facts) do
|
|
||||||
facts.merge({})
|
|
||||||
end
|
|
||||||
|
|
||||||
it_behaves_like 'tripleo::certmonger::rabbitmq'
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
@ -1,65 +0,0 @@
|
|||||||
#
|
|
||||||
# Copyright (C) 2017 Red Hat Inc.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# Unit tests for tripleo
|
|
||||||
#
|
|
||||||
|
|
||||||
require 'spec_helper'
|
|
||||||
|
|
||||||
describe 'tripleo::certmonger::httpd' do
|
|
||||||
|
|
||||||
let(:title) { 'httpd-cert' }
|
|
||||||
|
|
||||||
shared_examples_for 'tripleo::certmonger::httpd' do
|
|
||||||
let :params do
|
|
||||||
{
|
|
||||||
:name => 'httpd-cert',
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:service_certificate => '/etc/pki/cert.crt',
|
|
||||||
:service_key => '/etc/pki/key.pem',
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should include the base for using certmonger' do
|
|
||||||
is_expected.to contain_class('certmonger')
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should include the httpd parameters' do
|
|
||||||
is_expected.to contain_class('apache::params')
|
|
||||||
end
|
|
||||||
|
|
||||||
it 'should request a certificate' do
|
|
||||||
is_expected.to contain_certmonger_certificate('httpd-cert').with(
|
|
||||||
:ensure => 'present',
|
|
||||||
:certfile => '/etc/pki/cert.crt',
|
|
||||||
:keyfile => '/etc/pki/key.pem',
|
|
||||||
:hostname => 'localhost',
|
|
||||||
:dnsname => 'localhost',
|
|
||||||
:ca => 'local',
|
|
||||||
:wait => true,
|
|
||||||
)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
on_supported_os.each do |os, facts|
|
|
||||||
context "on #{os}" do
|
|
||||||
let(:facts) do
|
|
||||||
facts.merge({})
|
|
||||||
end
|
|
||||||
|
|
||||||
it_behaves_like 'tripleo::certmonger::httpd'
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
Loading…
Reference in New Issue
Block a user