6fa7a0974a
This gets a TLS certificate for the overcloud when necessary:
* If no incoming cert/key is provided and we don't expect the
overcloud's certmonger instances to request the certificates,
we request one to the undercloud's certmonger local CA.
* If a certificate was provided, we verify if it's user-provided
or if it was autogenerated.
- If it was user-provided we pass through that certificate
- If it was autogenerated, we request or resubmit the request
if it's needed.
* We also accept the EnableTLS flag, which the deployer can
explicitly turn off if they decide not to use TLS.
Depends-On: Ic70dd323b33596eaa3fc18bdc69a7c011ccd7fa1
Change-Id: I3d3cad0eb1396e7bee146794b29badad302efdf3
14 lines
1.0 KiB
Plaintext
14 lines
1.0 KiB
Plaintext
Defaults!/usr/bin/run-validation !requiretty
|
|
Defaults:validations !requiretty
|
|
Defaults:mistral !requiretty
|
|
mistral ALL = (validations) NOPASSWD:SETENV: /usr/bin/run-validation
|
|
mistral ALL = NOPASSWD: /usr/bin/chown -h validations\: /tmp/validations_identity_[A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_], \
|
|
!/usr/bin/chown /tmp/validations_identity_* *, !/usr/bin/chown /tmp/validations_identity_*..*
|
|
mistral ALL = NOPASSWD: /usr/bin/rm -f /tmp/validations_identity_[A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_][A-Za-z0-9_], \
|
|
!/usr/bin/rm /tmp/validations_identity_* *, !/usr/bin/rm /tmp/validations_identity_*..*
|
|
mistral ALL = NOPASSWD: /bin/nova-manage cell_v2 discover_hosts *
|
|
mistral ALL = NOPASSWD: /usr/bin/tar --ignore-failed-read -C / -cf /var/tmp/undercloud-backup-*.tar *
|
|
mistral ALL = NOPASSWD: /usr/bin/chown mistral. /var/tmp/undercloud-backup-*/filesystem-*.tar
|
|
mistral ALL = NOPASSWD: /usr/bin/tripleo-overcloud-cert *
|
|
validations ALL = NOPASSWD: ALL
|