first commit

.gitignore

@@ -0,0 +1,2 @@
+ansible_role_tripleo_ssl.egg-info
+.eggs

.gitreview

@@ -0,0 +1,5 @@
+[gerrit]
+host=review.gerrithub.io
+port=29418
+project=redhat-openstack/ansible-role-tripleo-ssl.git
+defaultbranch=master

README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

defaults/main.yml

@@ -0,0 +1,9 @@
+---
+# defaults file for ansible-role-tripleo-ssl
+local_working_dir: "{{ lookup('env', 'HOME') }}/.cat"
+working_dir: /home/stack
+ssl_overcloud: false
+ssl_undercloud: false
+
+hw_env:
+  ExternalVIP: 172.16.23.110

handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for ansible-role-tripleo-ssl

library/tls_tht.py

@@ -0,0 +1,129 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+
+# (c) 2016, Adriano Petrich <apetrich@redhat.com>
+#
+# This module is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This software is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this software.  If not, see <http://www.gnu.org/licenses/>.
+
+DOCUMENTATION = '''
+---
+module: tls_tht
+version_added: "1.9"
+short_description: Generate the tht templates for enabled ssl
+description:
+   - Generate the tht templates for enabled ssl
+options:
+    source_dir:
+        description:
+            - directory to copy the templates from
+        required: false
+        default: "/usr/share/openstack-tripleo-heat-templates/"
+    dest_dir:
+        description:
+            - were to copy the files to
+        required: false
+        default: ""
+    cert_filename:
+        description:
+            - the cert pem filename
+        required: false
+        default: cert.pem
+    cert_ca_filename:
+        description:
+            - the key pem filename
+        required: false
+        default: key.pem
+    key_filename:
+        description:
+            - the CA cert pem filename
+        required: false
+        default: cert.pem
+
+
+'''
+
+EXAMPLES = '''
+# Generate the tht templates for enabled ssl
+- tls_tht:
+'''
+
+import yaml
+from ansible.module_utils.basic import *  # noqa
+
+
+def _open_yaml(filename):
+    with open(filename, "r") as stream:
+        tmp_dict = yaml.load(stream)
+    return tmp_dict
+
+
+def create_enable_file(certpem, keypem, source_dir, dest_dir):
+    output_dict = _open_yaml("{}environments/enable-tls.yaml".format(source_dir))
+
+    for key in output_dict["parameter_defaults"]["EndpointMap"]:
+        if output_dict["parameter_defaults"]["EndpointMap"][key]["host"] == "CLOUDNAME":
+            output_dict["parameter_defaults"]["EndpointMap"][key]["host"] = "IP_ADDRESS"
+
+    output_dict["parameter_defaults"]["SSLCertificate"] = certpem
+    output_dict["parameter_defaults"]["SSLKey"] = keypem
+
+    output_dict["resource_registry"]["OS::TripleO::NodeTLSData"] = \
+        "{}/puppet/extraconfig/tls/tls-cert-inject.yaml".format(source_dir)
+
+    with open("{}enable-tls.yaml".format(dest_dir), "w") as stream:
+        yaml.safe_dump(output_dict, stream, default_style='|')
+
+
+def create_anchor_file(cert_ca_pem, source_dir, dest_dir):
+    output_dict = _open_yaml(
+        "{}environments/inject-trust-anchor.yaml".format(source_dir)
+    )
+
+    output_dict["parameter_defaults"]["SSLRootCertificate"] = cert_ca_pem
+
+    output_dict["resource_registry"]["OS::TripleO::NodeTLSCAData"] = \
+        "{}/puppet/extraconfig/tls/ca-inject.yaml".format(source_dir)
+
+    with open("{}inject-trust-anchor.yaml".format(dest_dir), "w") as stream:
+        yaml.safe_dump(output_dict, stream, default_style='|')
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec=dict(
+            source_dir=dict(default="/usr/share/openstack-tripleo-heat-templates/",
+                            required=False),
+            dest_dir=dict(default="", required=False),
+            cert_filename=dict(default="cert.pem", required=False),
+            cert_ca_filename=dict(default="cert.pem", required=False),
+            key_filename=dict(default="key.pem", required=False),
+        )
+    )
+
+    with open(module.params["cert_filename"], "r") as stream:
+        certpem = stream.read()
+
+    with open(module.params["cert_ca_filename"], "r") as stream:
+        cert_ca_pem = stream.read()
+
+    with open(module.params["key_filename"], "r") as stream:
+        keypem = stream.read()
+
+    create_enable_file(certpem, keypem, module.params["source_dir"], module.params["dest_dir"])
+    create_anchor_file(cert_ca_pem, module.params["source_dir"], module.params["dest_dir"])
+    module.exit_json(changed=True)
+
+
+if __name__ == '__main__':
+    main()

meta/main.yml

@@ -0,0 +1,171 @@
+galaxy_info:
+  author: your name
+  description: 
+  company: your company (optional)
+  
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+  
+  # Some suggested licenses:
+  # - BSD (default)
+  # - MIT
+  # - GPLv2
+  # - GPLv3
+  # - Apache
+  # - CC-BY
+  license: license (GPLv2, CC-BY, etc)
+  
+  min_ansible_version: 1.2
+
+  # Optionally specify the branch Galaxy will use when accessing the GitHub
+  # repo for this role. During role install, if no tags are available,
+  # Galaxy will use this branch. During import Galaxy will access files on
+  # this branch. If travis integration is cofigured, only notification for this
+  # branch will be accepted. Otherwise, in all cases, the repo's default branch
+  # (usually master) will be used.
+  #github_branch:
+  
+  #
+  # Below are all platforms currently available. Just uncomment
+  # the ones that apply to your role. If you don't see your
+  # platform on this list, let us know and we'll get it added!
+  #
+  #platforms:
+  #- name: EL
+  #  versions:
+  #  - all
+  #  - 5
+  #  - 6
+  #  - 7
+  #- name: GenericUNIX
+  #  versions:
+  #  - all
+  #  - any
+  #- name: Solaris
+  #  versions:
+  #  - all
+  #  - 10
+  #  - 11.0
+  #  - 11.1
+  #  - 11.2
+  #  - 11.3
+  #- name: Fedora
+  #  versions:
+  #  - all
+  #  - 16
+  #  - 17
+  #  - 18
+  #  - 19
+  #  - 20
+  #  - 21
+  #  - 22
+  #  - 23
+  #- name: opensuse
+  #  versions:
+  #  - all
+  #  - 12.1
+  #  - 12.2
+  #  - 12.3
+  #  - 13.1
+  #  - 13.2
+  #- name: IOS
+  #  versions:
+  #  - all
+  #  - any
+  #- name: SmartOS
+  #  versions:
+  #  - all
+  #  - any
+  #- name: eos
+  #  versions:
+  #  - all
+  #  - Any
+  #- name: Windows
+  #  versions:
+  #  - all
+  #  - 2012R2
+  #- name: Amazon
+  #  versions:
+  #  - all
+  #  - 2013.03
+  #  - 2013.09
+  #- name: GenericBSD
+  #  versions:
+  #  - all
+  #  - any
+  #- name: Junos
+  #  versions:
+  #  - all
+  #  - any
+  #- name: FreeBSD
+  #  versions:
+  #  - all
+  #  - 10.0
+  #  - 10.1
+  #  - 10.2
+  #  - 8.0
+  #  - 8.1
+  #  - 8.2
+  #  - 8.3
+  #  - 8.4
+  #  - 9.0
+  #  - 9.1
+  #  - 9.1
+  #  - 9.2
+  #  - 9.3
+  #- name: Ubuntu
+  #  versions:
+  #  - all
+  #  - lucid
+  #  - maverick
+  #  - natty
+  #  - oneiric
+  #  - precise
+  #  - quantal
+  #  - raring
+  #  - saucy
+  #  - trusty
+  #  - utopic
+  #  - vivid
+  #  - wily
+  #  - xenial
+  #- name: SLES
+  #  versions:
+  #  - all
+  #  - 10SP3
+  #  - 10SP4
+  #  - 11
+  #  - 11SP1
+  #  - 11SP2
+  #  - 11SP3
+  #- name: GenericLinux
+  #  versions:
+  #  - all
+  #  - any
+  #- name: NXOS
+  #  versions:
+  #  - all
+  #  - any
+  #- name: Debian
+  #  versions:
+  #  - all
+  #  - etch
+  #  - jessie
+  #  - lenny
+  #  - squeeze
+  #  - wheezy
+  
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is
+    # a keyword that describes and categorizes the role.
+    # Users find roles by searching for tags. Be sure to
+    # remove the '[]' above if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of
+    # alphanumeric characters. Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line.
+  # Be sure to remove the '[]' above if you add dependencies
+  # to this list.

setup.cfg

@@ -0,0 +1,38 @@
+[metadata]
+name = ansible-role-tripleo-ssl
+summary = ansible-role-tripleo-ssl - A ansible role for deploying a tripleo overcloud
+description-file =
+    README.md
+author = RDO-CI Team
+author-email = apetrich@redhat.com mbultel@redhat.com, whayutin@redhat.com
+home-page = https://github.com/redhat-openstack/ansible-role-tripleo-ssl
+classifier =
+  License :: OSI Approved :: Apache Software License
+  Development Status :: 4 - Beta
+  Intended Audience :: Developers
+  Intended Audience :: System Administrators
+  Intended Audience :: Information Technology
+  Topic :: Utilities
+
+[global]
+setup-hooks =
+    pbr.hooks.setup_hook
+
+[files]
+data_files =
+    ansible-library = ../ansible-role-tripleo-ssl/library/*
+    usr/local/share/ansible-role-tripleo-ssl/defaults = ../ansible-role-tripleo-ssl/defaults/*
+    usr/local/share/ansible-role-tripleo-ssl/handlers = ../ansible-role-tripleo-ssl/handlers/*
+    usr/local/share/ansible-role-tripleo-ssl/meta = ../ansible-role-tripleo-ssl/meta/*
+    usr/local/share/ansible-role-tripleo-ssl/tasks = ../ansible-role-tripleo-ssl/tasks/*
+    usr/local/share/ansible-role-tripleo-ssl/templates = ../ansible-role-tripleo-ssl/templates/*
+    usr/local/share/ansible-role-tripleo-ssl/files = ../ansible-role-tripleo-ssl/files/*
+    usr/local/share/ansible-role-tripleo-ssl/tests = ../ansible-role-tripleo-ssl/tests/*
+    usr/local/share/ansible-role-tripleo-ssl/vars = ../ansible-role-tripleo-ssl/vars/*
+
+[wheel]
+universal = 1
+
+[pbr]
+skip_authors = True
+skip_changelog = True

setup.py

@@ -0,0 +1,19 @@
+#   Copyright Red Hat, Inc. All Rights Reserved.
+#
+#   Licensed under the Apache License, Version 2.0 (the "License"); you may
+#   not use this file except in compliance with the License. You may obtain
+#   a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#   WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#   License for the specific language governing permissions and limitations
+#   under the License.
+
+import setuptools
+
+setuptools.setup(
+    setup_requires=['pbr'],
+    pbr=True)

tasks/main.yml

@@ -0,0 +1,33 @@
+---
+# tasks file for ansible-role-tripleo-ssl
+- name: Ensure rpm requirements for ssl are installed
+  yum: name={{ item }} state=latest
+  with_items:
+    - openssl
+  when: ssl_overcloud or ssl_undercloud
+
+- name: Ensure tripleo heat template rpm requirements for ssl are installed
+  yum: name={{ item }} state=latest
+  with_items:
+    - openstack-tripleo-heat-templates
+  when: ssl_overcloud
+
+- name: create self-signed SSL cert
+  command: openssl req -x509 -nodes -newkey rsa:2048 -subj "/CN={{ hw_env.ExternalVIP }}" -days 3650 -keyout overcloud-privkey.pem -out overcloud-cacert.pem -extensions v3_ca
+  when: ssl_overcloud
+
+- name: fetch template from single remote host
+  tls_tht:
+      source_dir: "/usr/share/openstack-tripleo-heat-templates/"
+      dest_dir: "{{ working_dir }}/"
+      cert_filename: "overcloud-cacert.pem"
+      cert_ca_filename: "overcloud-cacert.pem"
+      key_filename: "overcloud-privkey.pem"
+  when: ssl_overcloud
+
+- name: copy the self-signed SSL cert
+  shell: >
+      cp overcloud-cacert.pem /etc/pki/ca-trust/source/anchors/;
+      update-ca-trust extract;
+  sudo: true
+  when: ssl_overcloud

tests/inventory

@@ -0,0 +1 @@
+localhost

tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - ansible-role-tripleo-ssl

vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for ansible-role-tripleo-ssl