init.sls 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107
  1. #
  2. # SSL Certificates
  3. #
  4. openssl:
  5. pkg.installed:
  6. - name: openssl
  7. ssl-cert:
  8. pkg.installed
  9. update_ca_certificates:
  10. cmd.wait:
  11. - name: /usr/sbin/update-ca-certificates
  12. - watch: []
  13. # Install FFHO internal CA into Debian CA certificate mangling mechanism so
  14. # libraries (read: openssl) can use the CA cert when validating internal
  15. # service certificates. By installing the cert into the local ca-certificates
  16. # directory and calling update-ca-certificates two symlinks will be installed
  17. # into /etc/ssl/certs which will both point to the crt file:
  18. # * ffho-cacert.pem
  19. # * <cn-hash>.pem
  20. # The latter is use by openssl for validation.
  21. /usr/local/share/ca-certificates/ffho-cacert.crt:
  22. file.managed:
  23. - source: salt://certs/ffho-cacert.pem
  24. - user: root
  25. - group: root
  26. - mode: 644
  27. - watch_in:
  28. - cmd: update_ca_certificates
  29. /usr/local/share/ca-certificates/StartSSL_Class1_CA.crt:
  30. file.managed:
  31. - source: salt://certs/StartSSL_Class1_CA.pem
  32. - user: root
  33. - group: root
  34. - mode: 644
  35. - watch_in:
  36. - cmd: update_ca_certificates
  37. /usr/local/share/ca-certificates/StartSSL_Class2_CA.crt:
  38. file.managed:
  39. - source: salt://certs/StartSSL_Class2_CA.pem
  40. - user: root
  41. - group: root
  42. - mode: 644
  43. - watch_in:
  44. - cmd: update_ca_certificates
  45. {% set certs = {} %}
  46. # Are there any certificates defined or referenced in the node pillar?
  47. {% set node_config = salt['pillar.get']('nodes:' ~ grains['id']) %}
  48. {% for cn, cert_config in node_config.get ('certs', {}).items () %}
  49. {% set pillar_name = None %}
  50. {# "cert" and "privkey" provided in node config? #}
  51. {% if 'cert' in cert_config and 'privkey' in cert_config %}
  52. {% set pillar_name = 'nodes:' ~ grains['id'] ~ ':certs:' ~ cn %}
  53. {# <cn> only referenced in node config and cert/privkey stored in "cert" pillar? #}
  54. {% elif cert_config.get ('install', False) == True %}
  55. {% set pillar_name = 'cert:' ~ cn %}
  56. {% endif %}
  57. {% if pillar_name != None %}
  58. {% do certs.update ({ cn : pillar_name }) %}
  59. {% endif %}
  60. {% endfor %}
  61. # Are there any cert defined or referenced for this node or roles of this node?
  62. {% set node_roles = node_config.get ('roles', []) %}
  63. {% for cn, cert_config in salt['pillar.get']('cert', {}).items () %}
  64. {% for role in cert_config.get ('apply', {}).get ('roles', []) %}
  65. {% if role in node_roles %}
  66. {% do certs.update ({ cn : 'cert:' ~ cn }) %}
  67. {% endif %}
  68. {% endfor %}
  69. {% endfor %}
  70. # Install found certificates
  71. {% for cn, pillar_name in certs.items () %}
  72. /etc/ssl/certs/{{ cn }}.cert.pem:
  73. file.managed:
  74. {% if salt['pillar.get'](pillar_name ~ ':cert') == "file" %}
  75. - source: salt://certs/certs/{{ cn }}.cert.pem
  76. {% else %}
  77. - contents_pillar: {{ pillar_name }}:cert
  78. {% endif %}
  79. - user: root
  80. - group: root
  81. - mode: 644
  82. /etc/ssl/private/{{ cn }}.key.pem:
  83. file.managed:
  84. - contents_pillar: {{ pillar_name }}:privkey
  85. - user: root
  86. - group: ssl-cert
  87. - mode: 440
  88. - require:
  89. - pkg: ssl-cert
  90. {% endfor %}