Add tls support

This adds TLS support for zookeeper

Change-Id: I08c847d1d47a2ebd81f089befbef9a54ea1f6d4c
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
This commit is contained in:
Paul Belanger 2021-03-02 13:44:17 -05:00
parent 16e05cc668
commit eacff93232
5 changed files with 75 additions and 0 deletions

View File

@ -40,6 +40,20 @@ zookeeper_file_zoo_conf_group: zookeeper
zookeeper_file_zoo_conf_mode: 0644 zookeeper_file_zoo_conf_mode: 0644
zookeeper_file_zoo_conf_owner: zookeeper zookeeper_file_zoo_conf_owner: zookeeper
zookeeper_file_ssl_truststore_content:
zookeeper_file_ssl_truststore_dest: /etc/zookeeper/ca/certs/cacert.pem
zookeeper_file_ssl_truststore_group: "{{ zookeeper_user_group }}"
zookeeper_file_ssl_truststore_mode: 0644
zookeeper_file_ssl_truststore_owner: "{{ zookeeper_user_name }}"
zookeeper_file_ssl_truststore_src: etc/zookeeper/ca/certs/cacert.pem
zookeeper_file_ssl_keystore_content:
zookeeper_file_ssl_keystore_dest: /etc/zookeeper/ca/keystores/server.pem
zookeeper_file_ssl_keystore_group: "{{ zookeeper_user_group }}"
zookeeper_file_ssl_keystore_mode: 0600
zookeeper_file_ssl_keystore_owner: "{{ zookeeper_user_name }}"
zookeeper_file_ssl_keystore_src: etc/zookeeper/ca/keystores/server.pem
# tasks/install.yaml # tasks/install.yaml
zookeeper_package_state: present zookeeper_package_state: present

View File

@ -42,6 +42,9 @@
with_items: with_items:
- /etc/zookeeper - /etc/zookeeper
- /etc/zookeeper/conf - /etc/zookeeper/conf
- /etc/zookeeper/ca
- /etc/zookeeper/ca/certs
- /etc/zookeeper/ca/keystores
- /var/log/zookeeper - /var/log/zookeeper
- name: Install zookeeper log4j.properties - name: Install zookeeper log4j.properties
@ -54,6 +57,26 @@
src: "{{ zookeeper_file_log4j_properties_src }}" src: "{{ zookeeper_file_log4j_properties_src }}"
register: zookeeper_file_log4j_properties register: zookeeper_file_log4j_properties
- name: Install zookeeper ssl truststore configuration
become: true
template:
dest: "{{ zookeeper_file_ssl_truststore_dest }}"
group: "{{ zookeeper_file_ssl_truststore_group }}"
mode: "{{ zookeeper_file_ssl_truststore_mode }}"
owner: "{{ zookeeper_file_ssl_truststore_owner }}"
src: "{{ zookeeper_file_ssl_truststore_src }}"
register: zookeeper_file_ssl_truststore
- name: Install zookeeper ssl keystore configuration
become: true
template:
dest: "{{ zookeeper_file_ssl_keystore_dest }}"
group: "{{ zookeeper_file_ssl_keystore_group }}"
mode: "{{ zookeeper_file_ssl_keystore_mode }}"
owner: "{{ zookeeper_file_ssl_keystore_owner }}"
src: "{{ zookeeper_file_ssl_keystore_src }}"
register: zookeeper_file_ssl_keystore
- name: Install zookeeper myid - name: Install zookeeper myid
become: yes become: yes
template: template:

View File

@ -0,0 +1,4 @@
# This file is generated by Ansible
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
#
{{ zookeeper_file_ssl_truststore_content }}

View File

@ -0,0 +1,4 @@
# This file is generated by Ansible
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
#
{{ zookeeper_file_ssl_keystore_content }}

View File

@ -23,8 +23,38 @@
- name: Assert results are registered. - name: Assert results are registered.
assert: assert:
that: that:
- zookeeper_file_ssl_keystore
- zookeeper_file_ssl_truststore
- zookeeper_service_zookeeper - zookeeper_service_zookeeper
- name: Register /etc/zookeeper/ca/certs/cacert.pem
stat:
path: /etc/zookeeper/ca/certs/cacert.pem
register: _zookeeper_file_ssl_truststore_stat
- name: Assert _zookeeper_file_ssl_truststore_stat tests.
assert:
that:
- _zookeeper_file_ssl_truststore_stat.stat.exists
- _zookeeper_file_ssl_truststore_stat.stat.isreg
- _zookeeper_file_ssl_truststore_stat.stat.pw_name == 'zookeeper'
- _zookeeper_file_ssl_truststore_stat.stat.gr_name == 'zookeeper'
- _zookeeper_file_ssl_truststore_stat.stat.mode == '0644'
- name: Register /etc/zookeeper/ca/keystores/server.pem
stat:
path: /etc/zookeeper/ca/keystores/server.pem
register: _zookeeper_file_ssl_keystore_stat
- name: Assert _zookeeper_file_ssl_keystore_stat tests.
assert:
that:
- _zookeeper_file_ssl_keystore_stat.stat.exists
- _zookeeper_file_ssl_keystore_stat.stat.isreg
- _zookeeper_file_ssl_keystore_stat.stat.pw_name == 'zookeeper'
- _zookeeper_file_ssl_keystore_stat.stat.gr_name == 'zookeeper'
- _zookeeper_file_ssl_keystore_stat.stat.mode == '0600'
- name: Ensure zookeeper is running. - name: Ensure zookeeper is running.
become: yes become: yes
shell: /usr/sbin/service zookeeper status shell: /usr/sbin/service zookeeper status