6fa7a0974a
This gets a TLS certificate for the overcloud when necessary:
* If no incoming cert/key is provided and we don't expect the
overcloud's certmonger instances to request the certificates,
we request one to the undercloud's certmonger local CA.
* If a certificate was provided, we verify if it's user-provided
or if it was autogenerated.
- If it was user-provided we pass through that certificate
- If it was autogenerated, we request or resubmit the request
if it's needed.
* We also accept the EnableTLS flag, which the deployer can
explicitly turn off if they decide not to use TLS.
Depends-On: Ic70dd323b33596eaa3fc18bdc69a7c011ccd7fa1
Change-Id: I3d3cad0eb1396e7bee146794b29badad302efdf3
49 lines
1.8 KiB
Bash
Executable File
49 lines
1.8 KiB
Bash
Executable File
#!/bin/bash
|
|
set -x
|
|
# Currently action is unused, but it will be.
|
|
action=$1
|
|
overcloud_container_name=$2
|
|
|
|
if [[ "$action" == 'request' || "$action" == 'resubmit' ]]; then
|
|
overcloud_fqdn=$3
|
|
|
|
OVERCLOUD_CERT_PATH="/etc/pki/tls/certs/overcloud-${overcloud_container_name}-cert.pem"
|
|
OVERCLOUD_KEY_PATH="/etc/pki/tls/private/overcloud-${overcloud_container_name}-key.pem"
|
|
|
|
# This validates that overcloud_fqdn is actually an FQDN
|
|
if [[ ! $(echo "$overcloud_fqdn" | grep -P '(?=^.{1,254}$)(^(?>(?!\d+\.)[a-zA-Z0-9_\-]{1,63}\.?)+(?:[a-zA-Z]{2,})$)') ]]
|
|
then
|
|
exit 1
|
|
fi
|
|
|
|
# Skip request if the request already exists
|
|
/usr/bin/getcert list -c local -i "overcloud-${overcloud_container_name}-cert" > /dev/null
|
|
request_exists=$?
|
|
if [[ $request_exists != 0 || "$action" == 'resubmit' ]];
|
|
then
|
|
if [[ "$action" == "request" ]]; then
|
|
/usr/bin/getcert request -c local \
|
|
-I "overcloud-${overcloud_container_name}-cert" \
|
|
-f $OVERCLOUD_CERT_PATH \
|
|
-k $OVERCLOUD_KEY_PATH \
|
|
-N "CN=${overcloud_fqdn}" \
|
|
-D "$overcloud_fqdn" \
|
|
-C "/usr/bin/chown mistral:mistral $OVERCLOUD_CERT_PATH $OVERCLOUD_KEY_PATH" \
|
|
-w -v
|
|
else
|
|
/usr/bin/getcert resubmit -c local \
|
|
-i "overcloud-${overcloud_container_name}-cert" \
|
|
-f $OVERCLOUD_CERT_PATH \
|
|
-N "CN=${overcloud_fqdn}" \
|
|
-D "$overcloud_fqdn" \
|
|
-C "/usr/bin/chown mistral:mistral $OVERCLOUD_CERT_PATH $OVERCLOUD_KEY_PATH" \
|
|
-w -v
|
|
fi
|
|
fi
|
|
elif [[ "$action" == 'query' ]]; then
|
|
/usr/bin/getcert list -c local -i "overcloud-${overcloud_container_name}-cert"
|
|
else
|
|
echo "Unkown action $action"
|
|
exit 1
|
|
fi
|