From de98a36b353a5ca6eb5acc290dd941e4b222a110 Mon Sep 17 00:00:00 2001 From: Ade Lee Date: Tue, 28 Jul 2020 15:13:39 -0400 Subject: [PATCH] Add tripleo_update_trusted_cas role This role is used to add certificates to the system ca trust store. This role is needed so that we can add certificates to the trust store early in host_prep as part of a fix for BZ 1840886 Change-Id: I23d6cb01a804ea94d19ee99f2aabf10aec914e8a --- .../roles/role-tripleo_update_trusted_cas.rst | 6 + .../defaults/main.yml | 19 +++ .../tripleo_update_trusted_cas/meta/main.yml | 42 +++++++ .../molecule/default/Dockerfile | 37 ++++++ .../molecule/default/converge.yml | 113 ++++++++++++++++++ .../molecule/default/molecule.yml | 60 ++++++++++ .../molecule/default/prepare.yml | 21 ++++ .../tripleo_update_trusted_cas/tasks/main.yml | 41 +++++++ zuul.d/molecule.yaml | 11 ++ 9 files changed, 350 insertions(+) create mode 100644 doc/source/roles/role-tripleo_update_trusted_cas.rst create mode 100644 tripleo_ansible/roles/tripleo_update_trusted_cas/defaults/main.yml create mode 100644 tripleo_ansible/roles/tripleo_update_trusted_cas/meta/main.yml create mode 100644 tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/Dockerfile create mode 100644 tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/converge.yml create mode 100644 tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/molecule.yml create mode 100644 tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/prepare.yml create mode 100644 tripleo_ansible/roles/tripleo_update_trusted_cas/tasks/main.yml diff --git a/doc/source/roles/role-tripleo_update_trusted_cas.rst b/doc/source/roles/role-tripleo_update_trusted_cas.rst new file mode 100644 index 000000000..58ee6bf6a --- /dev/null +++ b/doc/source/roles/role-tripleo_update_trusted_cas.rst @@ -0,0 +1,6 @@ +================================= +Role - tripleo_update_trusted_cas +================================= + +.. ansibleautoplugin:: + :role: tripleo_ansible/roles/tripleo_update_trusted_cas diff --git a/tripleo_ansible/roles/tripleo_update_trusted_cas/defaults/main.yml b/tripleo_ansible/roles/tripleo_update_trusted_cas/defaults/main.yml new file mode 100644 index 000000000..0c75e8e00 --- /dev/null +++ b/tripleo_ansible/roles/tripleo_update_trusted_cas/defaults/main.yml @@ -0,0 +1,19 @@ +--- +# Copyright 2020 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +# All variables intended for modification should be placed in this file. + +tripleo_update_trusted_cas_ca_map: {} diff --git a/tripleo_ansible/roles/tripleo_update_trusted_cas/meta/main.yml b/tripleo_ansible/roles/tripleo_update_trusted_cas/meta/main.yml new file mode 100644 index 000000000..f0ef99489 --- /dev/null +++ b/tripleo_ansible/roles/tripleo_update_trusted_cas/meta/main.yml @@ -0,0 +1,42 @@ +--- +# Copyright 2020 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + + +galaxy_info: + author: OpenStack + description: TripleO OpenStack Role -- tripleo_update_trusted_cas + company: Red Hat + license: Apache-2.0 + min_ansible_version: 2.7 + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + platforms: + - name: CentOS + versions: + - 7 + - 8 + + galaxy_tags: + - tripleo + + +# List your role dependencies here, one per line. Be sure to remove the '[]' above, +# if you add dependencies to this list. +dependencies: [] diff --git a/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/Dockerfile b/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/Dockerfile new file mode 100644 index 000000000..8fc73a838 --- /dev/null +++ b/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/Dockerfile @@ -0,0 +1,37 @@ +# Molecule managed +# Copyright 2020 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + + +{% if item.registry is defined %} +FROM {{ item.registry.url }}/{{ item.image }} +{% else %} +FROM {{ item.image }} +{% endif %} + +RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \ + elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install sudo python*-devel python*-dnf bash {{ item.pkg_extras | default('') }} && dnf clean all; \ + elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl python-setuptools bash {{ item.pkg_extras | default('') }} && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \ + elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml {{ item.pkg_extras | default('') }} && zypper clean -a; \ + elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates {{ item.pkg_extras | default('') }}; \ + elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates {{ item.pkg_extras | default('') }} && xbps-remove -O; fi + +{% for pkg in item.easy_install | default([]) %} +# install pip for centos where there is no python-pip rpm in default repos +RUN easy_install {{ pkg }} +{% endfor %} + + +CMD ["sh", "-c", "while true; do sleep 10000; done"] diff --git a/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/converge.yml b/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/converge.yml new file mode 100644 index 000000000..47df5bd00 --- /dev/null +++ b/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/converge.yml @@ -0,0 +1,113 @@ +--- +# Copyright 2020 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + + +- name: Converge + hosts: all + vars: + tripleo_update_trusted_cas_ca_map: + ca1: + content: | + -----BEGIN CERTIFICATE----- + MIIDkTCCAnmgAwIBAgIUbRyjH5xf0yGj7larMhEDIrvOgo4wDQYJKoZIhvcNAQEL + BQAwWDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5DMRAwDgYDVQQHDAdSYWxlaWdo + MRQwEgYDVQQKDAtleGFtcGxlLmNvbTEUMBIGA1UEAwwLZXhhbXBsZS5jb20wHhcN + MjAwNzI4MTYxNDM0WhcNMjUwNzI3MTYxNDM0WjBYMQswCQYDVQQGEwJVUzELMAkG + A1UECAwCTkMxEDAOBgNVBAcMB1JhbGVpZ2gxFDASBgNVBAoMC2V4YW1wbGUuY29t + MRQwEgYDVQQDDAtleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC + AQoCggEBAOqk0OJOAa64bjF0k4MFJNZrzEsv1/UBReUF3c7NiYLayy5uk9DJghOH + Ic2Nphyafd4EvcoMkoBUe802iOW5zKjIgza/hVtcC6PPWbhkBdGpx832idjrXnWj + EBSbBZLY3Usikp3va9+7mCLcjnBQZ6ngSiqGnSpWhqvtm4eEIi9+CbmfBtWiBBK+ + w1glCQY/FZdGcJ0W0XgHLI06muSMujENMjSHiODqCx7QA/aNnW0RiYTENtS1yRdd + 8CIGGEf3HkvFFfwrZH6Qj4KW+0GXPkI6VzJCDsVL1YRuayTZl9rn9uGZDOdcljgb + RwbxHQTM3qGvNz2ErhG7PXs0lj/36AECAwEAAaNTMFEwHQYDVR0OBBYEFD8ANnVk + DhcDFLcj0uC3lCG9PMIkMB8GA1UdIwQYMBaAFD8ANnVkDhcDFLcj0uC3lCG9PMIk + MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAGsrBZO/vU57lzXh + rFqH8LLPdR8E7amcDj9KZXVLPZlU5DHeyFVbCQ4qq1/p9uCFiJ+VfNKbB1BQW6ds + kK+v7aUmloFS2Yy2cp73CdgXnktglLLxcfp9nCezK+eBsdtAgD0tOSw68rm4Bavd + 2sGwTmOHNLllcOaH0yIL6lFWPeNNnEN4/YrKoe12z/aTLcJsMjn4kB3G/CHSZWIf + T0W5eurx1BCXJmSZb3SBuAB0s3K0m2aggZvzLKtYT0f4vnmjeJ4rw0KPGF7bRmxE + tU0ysc4zecSShj3KcwzV5mV6ZhS3TVq4nHgK8m3vv49aGT8ZCLqGFLxKssqg5NFR + A9Z4Owk= + -----END CERTIFICATE----- + ca2: + content: | + -----BEGIN CERTIFICATE----- + MIIDoTCCAomgAwIBAgIUVk/ek5wON2pd8PYSsULNSVag09MwDQYJKoZIhvcNAQEL + BQAwYDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRYwFAYDVQQHDA1TYW4gRnJh + bmNpc2NvMRUwEwYDVQQKDAxleGFtcGxlMi5jb20xFTATBgNVBAMMDGV4YW1wbGUy + LmNvbTAeFw0yMDA3MjgxNjE3NDNaFw0yNTA3MjcxNjE3NDNaMGAxCzAJBgNVBAYT + AlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEVMBMGA1UE + CgwMZXhhbXBsZTIuY29tMRUwEwYDVQQDDAxleGFtcGxlMi5jb20wggEiMA0GCSqG + SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDqpNDiTgGuuG4xdJODBSTWa8xLL9f1AUXl + Bd3OzYmC2ssubpPQyYIThyHNjaYcmn3eBL3KDJKAVHvNNojlucyoyIM2v4VbXAuj + z1m4ZAXRqcfN9onY6151oxAUmwWS2N1LIpKd72vfu5gi3I5wUGep4Eoqhp0qVoar + 7ZuHhCIvfgm5nwbVogQSvsNYJQkGPxWXRnCdFtF4ByyNOprkjLoxDTI0h4jg6gse + 0AP2jZ1tEYmExDbUtckXXfAiBhhH9x5LxRX8K2R+kI+ClvtBlz5COlcyQg7FS9WE + bmsk2Zfa5/bhmQznXJY4G0cG8R0EzN6hrzc9hK4Ruz17NJY/9+gBAgMBAAGjUzBR + MB0GA1UdDgQWBBQ/ADZ1ZA4XAxS3I9Lgt5QhvTzCJDAfBgNVHSMEGDAWgBQ/ADZ1 + ZA4XAxS3I9Lgt5QhvTzCJDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUA + A4IBAQBZJF7ryuUD03wxwb4NMyR4AVG0C64/HFDLb+z+6Y6nEWhqFrrDVzVfjF34 + vSf7jTx7tckSf0zfRoqnn0q+gqsb0ELenHpmZrMNf6E1GNJIYBsitpV2JB9PPhAi + 8aJAyO9Vbe58+kNgGp/3HV5VZgau65HmJjT/a4PJGj6hu/u5dfFo5CdQ3lXyv4sA + VobNkc0Wwwlr1M1a6zDZKoY/hErGsj4py/k59TKQvmL1EVNAovb/lk8GomgI9+Sv + 7gnsmyBykIQR1jOU/WadcZgdHw6/jdaksDHvwXH1Ome8JcSgV/E9yP+cf4Es/jku + 5fLS6gSAaX1GrrRxqvXNhjvAqb/b + -----END CERTIFICATE----- + ca3: + content: | + -----BEGIN CERTIFICATE----- + MIIDlzCCAn+gAwIBAgIUQYteZnUZo35iDToskO1lP/FVNDAwDQYJKoZIhvcNAQEL + BQAwWzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5ZMREwDwYDVQQHDAhOZXcgWW9y + azEVMBMGA1UECgwMZXhhbXBsZTMuY29tMRUwEwYDVQQDDAxleGFtcGxlMy5jb20w + HhcNMjAwNzI4MTYyMDMwWhcNMjUwNzI3MTYyMDMwWjBbMQswCQYDVQQGEwJVUzEL + MAkGA1UECAwCTlkxETAPBgNVBAcMCE5ldyBZb3JrMRUwEwYDVQQKDAxleGFtcGxl + My5jb20xFTATBgNVBAMMDGV4YW1wbGUzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD + ggEPADCCAQoCggEBAOqk0OJOAa64bjF0k4MFJNZrzEsv1/UBReUF3c7NiYLayy5u + k9DJghOHIc2Nphyafd4EvcoMkoBUe802iOW5zKjIgza/hVtcC6PPWbhkBdGpx832 + idjrXnWjEBSbBZLY3Usikp3va9+7mCLcjnBQZ6ngSiqGnSpWhqvtm4eEIi9+Cbmf + BtWiBBK+w1glCQY/FZdGcJ0W0XgHLI06muSMujENMjSHiODqCx7QA/aNnW0RiYTE + NtS1yRdd8CIGGEf3HkvFFfwrZH6Qj4KW+0GXPkI6VzJCDsVL1YRuayTZl9rn9uGZ + DOdcljgbRwbxHQTM3qGvNz2ErhG7PXs0lj/36AECAwEAAaNTMFEwHQYDVR0OBBYE + FD8ANnVkDhcDFLcj0uC3lCG9PMIkMB8GA1UdIwQYMBaAFD8ANnVkDhcDFLcj0uC3 + lCG9PMIkMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAJSL5k5q + V+wfsPhp5kQX4V/aEH0O02Ka8f9HvGcohT/PqFltSIY2LNJvoksgIBFja/UhDtUB + cqmK3v+l4C/vIy6S6ouajtRYQ7VmGLxgOg3btPtfPjrFFYH9AwSqwb4w70rCt7EF + CTv2yt6Arjp08BauwqwIQmlhBcmjsNa4/1v0kWlAmT4YOi6iXFN1lqBu4gZw4XDI + 4UWJIKkcJIYwXV+wU9WRAu9cNtJyAtanoPXVdsk/zwlmp4rgUOg4ttaY1SekIdC1 + z2HOmlkvCVkyuJaHvAwWmUGxMTudLlqQACSHAhprn+r2sKMoCC49j1p1XXR7YVPc + c6FIoPXPEidXLGw= + -----END CERTIFICATE----- + tasks: + - import_role: + name: "tripleo_update_trusted_cas" + + - name: check if anchor file created + stat: + path: "/etc/pki/ca-trust/source/anchors/{{item}}.pem" + register: stat_ca + failed_when: not stat_ca.stat.exists + loop: ['ca1', 'ca2', 'ca3'] + + - name: check if contents in extracted pem + lineinfile: + name: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem + line: "# {{item}}" + state: present + check_mode: true + register: conf + failed_when: (conf is changed) or (conf is failed) + loop: ['example.com', 'example2.com', 'example3.com'] diff --git a/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/molecule.yml b/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/molecule.yml new file mode 100644 index 000000000..0c8cb80f6 --- /dev/null +++ b/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/molecule.yml @@ -0,0 +1,60 @@ +--- +driver: + name: podman + +log: true + +platforms: + - name: centos7 + hostname: centos7 + image: centos:7 + dockerfile: Dockerfile + pkg_extras: python-setuptools cronie rsyslog + easy_install: + - pip + environment: &env + http_proxy: "{{ lookup('env', 'http_proxy') }}" + https_proxy: "{{ lookup('env', 'https_proxy') }}" + command: /sbin/init + capabilities: + - ALL + volumes: + - /etc/ci/mirror_info.sh:/etc/ci/mirror_info.sh:ro + privileged: true + ulimits: &ulimit + - host + + - name: centos8 + hostname: centos8 + image: centos:8 + dockerfile: Dockerfile + pkg_extras: python*-setuptools cronie rsyslog + environment: + http_proxy: "{{ lookup('env', 'http_proxy') }}" + https_proxy: "{{ lookup('env', 'https_proxy') }}" + command: /sbin/init + capabilities: + - ALL + volumes: + - /etc/ci/mirror_info.sh:/etc/ci/mirror_info.sh:ro + privileged: true + ulimits: *ulimit + +provisioner: + name: ansible + log: true + env: + ANSIBLE_STDOUT_CALLBACK: yaml + +scenario: + test_sequence: + - destroy + - create + - prepare + - converge + - check + - verify + - destroy + +verifier: + name: testinfra diff --git a/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/prepare.yml b/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/prepare.yml new file mode 100644 index 000000000..27e23e495 --- /dev/null +++ b/tripleo_ansible/roles/tripleo_update_trusted_cas/molecule/default/prepare.yml @@ -0,0 +1,21 @@ +--- +# Copyright 2020 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + + +- name: Prepare + hosts: all + roles: + - role: test_deps diff --git a/tripleo_ansible/roles/tripleo_update_trusted_cas/tasks/main.yml b/tripleo_ansible/roles/tripleo_update_trusted_cas/tasks/main.yml new file mode 100644 index 000000000..2e121f9f7 --- /dev/null +++ b/tripleo_ansible/roles/tripleo_update_trusted_cas/tasks/main.yml @@ -0,0 +1,41 @@ +--- +# Copyright 2020 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# tripleo_update_trusted_cas will add a set of certifcates in PEM format +# to the trusted CA store. These are provided in a ca map, which has +# the format: +# +# tripleo_update_trusted_cas_ca_map: +# first-ca-name: +# content: | +# The content of the CA cert goes here +# second-ca-name: +# content: | +# The content of the CA cert goes here +# etc. + +- name: Add ca files + become: true + copy: + dest: "/etc/pki/ca-trust/source/anchors/{{ item.key }}.pem" + content: "{{ item.value.content }}" + mode: "0644" + owner: "root" + loop: "{{ tripleo_update_trusted_cas_ca_map | dict2items }}" + +- name: Update trust + become: true + command: /usr/bin/update-ca-trust extract diff --git a/zuul.d/molecule.yaml b/zuul.d/molecule.yaml index 2c29d65d4..6b168a8f5 100644 --- a/zuul.d/molecule.yaml +++ b/zuul.d/molecule.yaml @@ -55,6 +55,7 @@ - tripleo-ansible-centos-8-molecule-tripleo_validations_package - tripleo-ansible-centos-8-molecule-tuned - tripleo-ansible-centos-8-role-addition + - tripleo-ansible-centos-8-molecule-tripleo_update_trusted_cas gate: jobs: - tripleo-ansible-centos-8-molecule-aide @@ -108,6 +109,8 @@ - tripleo-ansible-centos-8-molecule-tripleo_validations_package - tripleo-ansible-centos-8-molecule-tuned - tripleo-ansible-centos-8-role-addition + - tripleo-ansible-centos-8-molecule-tripleo_update_trusted_cas + name: tripleo-ansible-molecule-jobs periodic-weekly: jobs: @@ -542,3 +545,11 @@ timeout: 1800 vars: tox_envlist: role-addition + +- job: + files: + - ^tripleo_ansible/roles/tripleo_update_trusted_cas/.* + name: tripleo-ansible-centos-8-molecule-tripleo_update_trusted_cas + parent: tripleo-ansible-centos-8-base + vars: + tox_envlist: mol-tripleo_update_trusted_cas