Generate per-site SSL intermediate CA, fix cred/pki paths
Change-Id: I0bda0791d82142acac8c6af0e152d8d0954ef719
diff --git a/roles/compute-node-enable-maas/defaults/main.yml b/roles/compute-node-enable-maas/defaults/main.yml
index b84e46d..de6b9a3 100644
--- a/roles/compute-node-enable-maas/defaults/main.yml
+++ b/roles/compute-node-enable-maas/defaults/main.yml
@@ -1,9 +1,10 @@
---
# compute-node-enable-maas/defaults/main.yml
-cord_profile_dir: "{{ ansible_user_dir + '/cord_profile' }}"
+credentials_dir: "{{ playbook_dir }}/credentials"
+cord_profile_dir: "{{ ansible_user_dir ~ '/cord_profile' }}"
xos_admin_user: "xosadmin@opencord.org"
-xos_admin_pass: "{{ lookup('password', 'credentials/xosadmin@opencord.org chars=ascii_letters,digits') }}"
+xos_admin_pass: "{{ lookup('password', credentials_dir ~ '/xosadmin@opencord.org chars=ascii_letters,digits') }}"
xos_ui_port: 9000
diff --git a/roles/cord-profile/defaults/main.yml b/roles/cord-profile/defaults/main.yml
index 00ac764..98734ec 100644
--- a/roles/cord-profile/defaults/main.yml
+++ b/roles/cord-profile/defaults/main.yml
@@ -3,7 +3,8 @@
cord_dir: "{{ ansible_user_dir + '/cord' }}"
cord_profile_dir: "{{ ansible_user_dir + '/cord_profile' }}"
-pki_dir: "/opt/pki"
+pki_dir: "{{ playbook_dir }}/pki"
+credentials_dir: "{{ playbook_dir }}/credentials"
deploy_docker_registry: ""
deploy_docker_tag: "candidate"
@@ -77,7 +78,7 @@
# used in deployment.yaml.j2
xos_admin_user: "xosadmin@opencord.org"
-xos_admin_pass: "{{ lookup('password', 'credentials/xosadmin@opencord.org chars=ascii_letters,digits') }}"
+xos_admin_pass: "{{ lookup('password', credentials_dir ~ '/xosadmin@opencord.org chars=ascii_letters,digits') }}"
xos_admin_first: XOS
xos_admin_last: Admin
diff --git a/roles/cord-profile/tasks/main.yml b/roles/cord-profile/tasks/main.yml
index 9b39107..d33765e 100644
--- a/roles/cord-profile/tasks/main.yml
+++ b/roles/cord-profile/tasks/main.yml
@@ -16,7 +16,7 @@
owner: "{{ ansible_user_id }}"
group: "{{ ansible_user_gid }}"
-- name: Create cord_profile/profile_name with the name of the profile
+- name: Create cord_profile/profile_name, containing profile name
copy:
dest: "{{ cord_profile_dir }}/profile_name"
content: "{{ cord_profile }}"
@@ -55,14 +55,16 @@
- name: Copy cert chain and core api key and cert
copy:
- src: "{{ pki_dir }}/{{ item }}"
- dest: "{{ cord_profile_dir }}/{{ item }}"
+ src: "{{ pki_dir }}/{{ item.src }}"
+ dest: "{{ cord_profile_dir }}/{{ item.dest }}"
mode: 0600
- remote_src: True
with_items:
- - core_api_key.pem
- - core_api_cert.pem
- - im_cert_chain.pem
+ - src: "{{ site_name }}_im_ca/private/xos-core.{{ site_suffix }}_key.pem"
+ dest: "core_api_key.pem"
+ - src: "{{ site_name }}_im_ca/certs/xos-core.{{ site_suffix }}_cert_chain.pem"
+ dest: "core_api_cert.pem"
+ - src: "{{ site_name }}_im_ca/certs/im_cert_chain.pem"
+ dest: "im_cert_chain.pem"
- name: Get localhost facts (to get local uid and gid)
setup:
diff --git a/roles/create-lxd/tasks/main.yml b/roles/create-lxd/tasks/main.yml
index fd3ace2..1b1dd7a 100644
--- a/roles/create-lxd/tasks/main.yml
+++ b/roles/create-lxd/tasks/main.yml
@@ -24,9 +24,10 @@
default_release: trusty-backports
# For lxd_profile, has to be run as normal user
-- name: Get user's SSH public key into lxd_ssh_pubkey to create LXD profile
- set_fact:
- lxd_ssh_pubkey: "{{ lookup('file', '{{ ansible_user_dir }}/.ssh/id_rsa.pub') }}"
+- name: slurp user's SSH public key on remote machine to create LXD profile
+ slurp:
+ src: "{{ ansible_user_dir }}/.ssh/id_rsa.pub"
+ register: slurped_pubkey
- name: Create openstack LXD profile
become: yes
@@ -37,7 +38,7 @@
user.user-data: |
#cloud-config
ssh_authorized_keys:
- - "{{ lxd_ssh_pubkey }}"
+ - "{{ slurped_pubkey['content'] | b64decode }}"
description: 'OpenStack services on CORD'
devices:
eth0:
diff --git a/roles/create-lxd/templates/ansible_hosts.j2 b/roles/create-lxd/templates/ansible_hosts.j2
index e2e58de..21f5c8a 100644
--- a/roles/create-lxd/templates/ansible_hosts.j2
+++ b/roles/create-lxd/templates/ansible_hosts.j2
@@ -3,20 +3,27 @@
# VMs will go away shortly in favor of containers
[vms]
+{% if head_vm_list is defined -%}
{% for vm in head_vm_list -%}
{{ vm.name }}
{% endfor -%}
+{% endif -%}
[containers]
+{% if head_lxd_list is defined -%}
{% for lxd in head_lxd_list -%}
{{ lxd.name }}
{% endfor -%}
+{% endif -%}
[services:children]
vms
containers
[docker]
+{% if head_vm_list is defined -%}
{% for vm in head_vm_list | selectattr('docker_path', 'defined') -%}
{{ vm.name }}
{% endfor -%}
+{% endif -%}
+
diff --git a/roles/juju-setup/defaults/main.yml b/roles/juju-setup/defaults/main.yml
index 840f49d..3024e0e 100644
--- a/roles/juju-setup/defaults/main.yml
+++ b/roles/juju-setup/defaults/main.yml
@@ -1,12 +1,10 @@
---
# juju-setup/defaults/main.yml
-juju_config_name: opencloud
-
# note: juju_config_path and charm_versions are also set in
# `juju-compute-setup/defaults/main.yml`. Keep these in sync.
juju_config_path: /usr/local/src/juju_config.yml
charm_versions: {}
-pki_dir: "/opt/pki"
+pki_dir: "{{ playbook_dir }}/pki"
diff --git a/roles/juju-setup/tasks/main.yml b/roles/juju-setup/tasks/main.yml
index 159bd1b..d1607b8 100644
--- a/roles/juju-setup/tasks/main.yml
+++ b/roles/juju-setup/tasks/main.yml
@@ -28,7 +28,7 @@
- name: Copy over juju-config.yml for configuring Juju services
become: yes
template:
- src={{ juju_config_name }}_juju_config.yml.j2
+ src=juju_config.yml.j2
dest={{ juju_config_path }}
# check that containers are ready to be accessed, juju add-machine may error
diff --git a/roles/juju-setup/templates/cord_juju_config.yml.j2 b/roles/juju-setup/templates/juju_config.yml.j2
similarity index 74%
rename from roles/juju-setup/templates/cord_juju_config.yml.j2
rename to roles/juju-setup/templates/juju_config.yml.j2
index e640289..bf157ea 100644
--- a/roles/juju-setup/templates/cord_juju_config.yml.j2
+++ b/roles/juju-setup/templates/juju_config.yml.j2
@@ -11,40 +11,40 @@
ha-mcastport: 5402
keystone:
+ openstack-origin: "cloud:trusty-kilo"
admin-password: "{{ keystone_admin_password }}"
os-public-hostname: "keystone.{{ site_suffix }}"
ha-mcastport: 5403
- openstack-origin: "cloud:trusty-kilo"
use-https: "yes"
- ssl_key: {{ lookup('file', '{{ pki_dir }}/keystone.{{ site_suffix }}_key.pem') | b64encode }}
- ssl_cert: {{ lookup('file', '{{ pki_dir }}/keystone.{{ site_suffix }}_cert.pem') | b64encode }}
- ssl_ca: {{ lookup('file', '{{ pki_dir }}/im_cert_chain.pem') | b64encode }}
+ ssl_key: {{ lookup('file', '{{ pki_dir }}/{{ site_name }}_im_ca/private/keystone.{{ site_suffix }}_key.pem') | b64encode }}
+ ssl_cert: {{ lookup('file', '{{ pki_dir }}/{{ site_name }}_im_ca/certs/keystone.{{ site_suffix }}_cert.pem') | b64encode }}
+ ssl_ca: {{ lookup('file', '{{ pki_dir }}//{{ site_name }}_im_ca/certs/im_cert_chain.pem') | b64encode }}
mongodb: {}
nagios: {}
neutron-api:
+ openstack-origin: "cloud:trusty-kilo"
neutron-plugin: onosvtn
onos-vtn-ip: onos-cord
onos-vtn-port: 8182
neutron-security-groups: "True"
- openstack-origin: "cloud:trusty-kilo"
overlay-network-type: vxlan
neutron-openvswitch: {}
nova-cloud-controller:
+ openstack-origin: "cloud:trusty-kilo"
config-flags: "force_config_drive=always"
console-access-protocol: novnc
network-manager: Neutron
- openstack-origin: "cloud:trusty-kilo"
nova-compute:
+ openstack-origin: "cloud:trusty-kilo"
virt-type: kvm
config-flags: "firewall_driver=nova.virt.firewall.NoopFirewallDriver"
disable-neutron-security-groups: "True"
- openstack-origin: "cloud:trusty-kilo"
nrpe: {}
@@ -54,7 +54,7 @@
openstack-origin: "cloud:trusty-kilo"
percona-cluster:
- max-connections: 20000
+ max-connections: 20000
rabbitmq-server:
ssl: "on"
diff --git a/roles/juju-setup/templates/opencloud_juju_config.yml.j2 b/roles/juju-setup/templates/opencloud_juju_config.yml.j2
deleted file mode 100644
index b0d3e88..0000000
--- a/roles/juju-setup/templates/opencloud_juju_config.yml.j2
+++ /dev/null
@@ -1,59 +0,0 @@
----
-# juju configuration file for OpenCloud deployments
-
-ceilometer: {}
-
-ceilometer-agent: {}
-
-glance:
- openstack-origin: "cloud:trusty-kilo"
-
-keystone:
- admin-password: "{{ keystone_admin_password }}"
- os-public-hostname: "keystone.{{ site_suffix }}"
- use-https: "yes"
- openstack-origin: "cloud:trusty-kilo"
- ssl_key: {{ lookup('file', '{{ pki_dir }}/keystone.{{ site_suffix }}_key.pem') | b64encode }}
- ssl_cert: {{ lookup('file', '{{ pki_dir }}/keystone.{{ site_suffix }}_cert_chain.pem') | b64encode }}
- ssl_ca: {{ lookup('file', '{{ pki_dir }}/im_cert_chain.pem') | b64encode }}
-
-mongodb: {}
-
-neutron-api:
- flat-network-providers: "*"
- openstack-origin: "cloud:trusty-kilo"
- vlan-ranges: "physnet1:1000:2000 nat"
-
-neutron-gateway:
- bridge-mappings: "physnet1:br-data nat:br-nat"
- flat-network-providers: "*"
- instance-mtu: "1400"
- openstack-origin: "cloud:trusty-kilo"
- vlan-ranges: "physnet1:1000:2000 nat"
-
-neutron-openvswitch:
- bridge-mappings: "physnet1:br-data nat:br-nat"
- disable-security-groups: "True"
- flat-network-providers: "*"
- vlan-ranges: "physnet1:1000:2000 nat"
-
-nova-cloud-controller:
- console-access-protocol: "novnc"
- network-manager: "Neutron"
- openstack-origin: "cloud:trusty-kilo"
-
-nova-compute:
- virt-type: kvm
- config-flags: "firewall_driver=nova.virt.firewall.NoopFirewallDriver"
- openstack-origin: "cloud:trusty-kilo"
-
-ntp:
- source: "0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org 2.ubuntu.pool.ntp.org 3.ubuntu.pool.ntp.org"
-
-openstack-dashboard:
- openstack-origin: "cloud:trusty-kilo"
-
-percona-cluster: {}
-
-rabbitmq-server:
- ssl: "on"
diff --git a/roles/pki-cert/defaults/main.yml b/roles/pki-cert/defaults/main.yml
index 4d55149..6c3de79 100644
--- a/roles/pki-cert/defaults/main.yml
+++ b/roles/pki-cert/defaults/main.yml
@@ -1,9 +1,12 @@
---
# pki-cert/defaults/main.yml
+pki_dir: "{{ playbook_dir }}/pki"
+
+# client/server cert parameters
cert_size: 2048
cert_digest: "sha256"
-cert_days: 180
+cert_days: 365
# lists of certificates to create
server_certs: []
diff --git a/roles/pki-cert/tasks/main.yml b/roles/pki-cert/tasks/main.yml
index b7cbdd3..c62f522 100644
--- a/roles/pki-cert/tasks/main.yml
+++ b/roles/pki-cert/tasks/main.yml
@@ -4,33 +4,33 @@
- name: Generate server private key (no pw)
command: >
openssl genrsa
- -out {{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem
+ -out {{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem
args:
- creates: "{{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem"
+ creates: "{{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem"
with_items: "{{ server_certs }}"
- name: Generate server CSR
command: >
- openssl req -config {{ pki_dir }}/intermediate_ca/openssl.cnf
- -key {{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem
+ openssl req -config {{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf
+ -key {{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem
-new -sha256 -subj "{{ item.subj }}"
- -out {{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem
+ -out {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem
args:
- creates: "{{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem"
+ creates: "{{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem"
environment:
KEY_ALTNAMES: "{{ item.altnames | join(', ') }}"
with_items: "{{ server_certs }}"
- name: Sign server cert
command: >
- openssl ca -config {{ pki_dir }}/intermediate_ca/openssl.cnf -batch
- -passin file:{{ pki_dir }}/intermediate_ca/private/ca_im_phrase
+ openssl ca -config {{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf -batch
+ -passin file:{{ pki_dir }}/{{ site_name }}_im_ca/private/ca_im_phrase
-extensions server_cert
-days {{ cert_days }} -md {{ cert_digest }}
- -in {{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem
- -out {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+ -in {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem
+ -out {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
args:
- creates: "{{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem"
+ creates: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem"
environment:
KEY_ALTNAMES: "{{ item.altnames | join(', ') }}"
with_items: "{{ server_certs }}"
@@ -38,8 +38,8 @@
- name: Verify cert against root + im chain
command: >
openssl verify -purpose sslserver
- -CAfile {{ pki_dir }}/intermediate_ca/certs/im_cert_chain.pem
- {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+ -CAfile {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert_chain.pem
+ {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
with_items: "{{ server_certs }}"
tags:
- skip_ansible_lint # diagnostic command
@@ -52,14 +52,14 @@
- name: Get the intermediate cert into im_cert var
command: >
- openssl x509 -in {{ pki_dir }}/intermediate_ca/certs/im_cert.pem
+ openssl x509 -in {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert.pem
register: im_cert
tags:
- skip_ansible_lint # concat of files
- name: Get the certs into server_certs var
command: >
- openssl x509 -in {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+ openssl x509 -in {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
with_items: "{{ server_certs }}"
tags:
- skip_ansible_lint # concat of files
@@ -67,40 +67,40 @@
- name: Create chained server certs
copy:
- dest: "{{ pki_dir }}/intermediate_ca/certs/{{ item.item.cn }}_cert_chain.pem"
+ dest: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.item.cn }}_cert_chain.pem"
content: "{{ item.stdout }}\n{{ im_cert.stdout }}"
with_items: "{{ server_certs_raw.results }}"
- name: Generate client private key (no pw)
command: >
openssl genrsa
- -out {{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem
+ -out {{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem
args:
- creates: "{{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem"
+ creates: "{{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem"
with_items: "{{ client_certs }}"
- name: Generate client CSR
command: >
- openssl req -config {{ pki_dir }}/intermediate_ca/openssl.cnf
- -key {{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem
+ openssl req -config {{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf
+ -key {{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem
-new -sha256 -subj "{{ item.subj }}"
- -out {{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem
+ -out {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem
args:
- creates: "{{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem"
+ creates: "{{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem"
environment:
KEY_ALTNAMES: "{{ item.altnames | join(', ') }}"
with_items: "{{ client_certs }}"
- name: Sign client cert
command: >
- openssl ca -config {{ pki_dir }}/intermediate_ca/openssl.cnf -batch
- -passin file:{{ pki_dir }}/intermediate_ca/private/ca_im_phrase
+ openssl ca -config {{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf -batch
+ -passin file:{{ pki_dir }}/{{ site_name }}_im_ca/private/ca_im_phrase
-extensions user_cert
-days {{ cert_days }} -md {{ cert_digest }}
- -in {{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem
- -out {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+ -in {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem
+ -out {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
args:
- creates: "{{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem"
+ creates: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem"
environment:
KEY_ALTNAMES: "{{ item.altnames | join(', ') }}"
with_items: "{{ client_certs }}"
@@ -108,8 +108,8 @@
- name: Verify cert against root + im chain
command: >
openssl verify -purpose sslclient
- -CAfile {{ pki_dir }}/intermediate_ca/certs/im_cert_chain.pem
- {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+ -CAfile {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert_chain.pem
+ {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
with_items: "{{ client_certs }}"
tags:
- skip_ansible_lint # diagnostic command
@@ -122,7 +122,7 @@
- name: Get the certs into client_certs var
command: >
- openssl x509 -in {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+ openssl x509 -in {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
with_items: "{{ client_certs }}"
tags:
- skip_ansible_lint # concat of files
@@ -130,7 +130,7 @@
- name: Create chained client cert
copy:
- dest: "{{ pki_dir }}/intermediate_ca/certs/{{ item.item.cn }}_cert_chain.pem"
+ dest: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.item.cn }}_cert_chain.pem"
content: "{{ item.stdout }}\n{{ im_cert.stdout }}"
with_items: "{{ client_certs_raw.results }}"
diff --git a/roles/pki-install/defaults/main.yml b/roles/pki-install/defaults/main.yml
index 86c15ae..3221add 100644
--- a/roles/pki-install/defaults/main.yml
+++ b/roles/pki-install/defaults/main.yml
@@ -1,4 +1,4 @@
# pki-install/defaults/main.yml
-pki_dir: "/opt/pki"
+pki_dir: "{{ playbook_dir }}/pki"
use_openstack: True
diff --git a/roles/pki-install/handlers/main.yml b/roles/pki-install/handlers/main.yml
index 70b0e2c..4b5cc54 100644
--- a/roles/pki-install/handlers/main.yml
+++ b/roles/pki-install/handlers/main.yml
@@ -1,6 +1,5 @@
---
# pki-install/handlers/main.yml
-- name: Run update-ca-certificates on head node
- become: yes
+- name: update-ca-certificates
command: update-ca-certificates
diff --git a/roles/pki-install/tasks/main.yml b/roles/pki-install/tasks/main.yml
index a49d88d..77c8806 100644
--- a/roles/pki-install/tasks/main.yml
+++ b/roles/pki-install/tasks/main.yml
@@ -1,46 +1,15 @@
---
# pki-install/tasks/main.yml
-- name: Copy CA certificates to head node
- become: yes
+- name: Copy CA certificates
copy:
src: "{{ pki_dir }}/{{ item.src }}"
dest: "/usr/local/share/ca-certificates/{{ item.dest }}"
with_items:
- src: "root_ca/certs/ca_cert.pem"
dest: "cord_root_ca.crt"
- - src: "intermediate_ca/certs/im_cert.pem"
+ - src: "{{ site_name }}_im_ca/certs/im_cert.pem"
dest: "cord_intermediate_ca.crt"
notify:
- - Run update-ca-certificates on head node
+ - update-ca-certificates
-- name: Ensure PKI directory
- become: yes
- file:
- path: "{{ pki_dir }}"
- state: directory
-
-- name: Copy certs needed by XOS
- become: yes
- copy:
- src: "{{ pki_dir }}/{{ item.src }}"
- dest: "{{ pki_dir }}/{{ item.dest }}"
- with_items:
- - src: "intermediate_ca/certs/im_cert_chain.pem"
- dest: "im_cert_chain.pem"
- - src: "intermediate_ca/private/xos-core.{{ site_suffix }}_key.pem"
- dest: "core_api_key.pem"
- - src: "intermediate_ca/certs/xos-core.{{ site_suffix }}_cert_chain.pem"
- dest: "core_api_cert.pem"
-
-- name: Copy certs needed by OpenStack
- become: yes
- when: use_openstack
- copy:
- src: "{{ pki_dir }}/{{ item.src }}"
- dest: "{{ pki_dir }}/{{ item.dest }}"
- with_items:
- - src: "intermediate_ca/private/keystone.{{ site_suffix }}_key.pem"
- dest: "keystone.{{ site_suffix }}_key.pem"
- - src: "intermediate_ca/certs/keystone.{{ site_suffix }}_cert.pem"
- dest: "keystone.{{ site_suffix }}_cert.pem"
diff --git a/roles/pki-intermediate-ca/defaults/main.yml b/roles/pki-intermediate-ca/defaults/main.yml
index c8ec9c9..3a5b545 100644
--- a/roles/pki-intermediate-ca/defaults/main.yml
+++ b/roles/pki-intermediate-ca/defaults/main.yml
@@ -1,8 +1,13 @@
---
# pki-intermediate-ca/defaults/main.yml
-pki_dir: "/opt/pki"
-credentials_dir: "/opt/credentials"
+pki_dir: "{{ playbook_dir }}/pki"
+credentials_dir: "{{ playbook_dir }}/credentials"
+
+# used to name the intermediate CA
+site_name: sitename
+site_humanname: "Site HumanName"
+site_suffix: sitename.test
# crypto parameters
ca_digest: "sha256"
@@ -13,4 +18,4 @@
ca_im_phrase: "{{ lookup('password', credentials_dir ~ '/ca_im_phrase length=64') }}"
# noninteractive csr subject
-ca_im_subj: "/C=US/ST=California/L=Menlo Park/O=ON.Lab/OU=Test Deployment/CN=CORD Test Deployment Intermediate CA"
+ca_im_subj: "/C=US/ST=California/L=Menlo Park/O=ON.Lab/OU=Test Deployment/CN={{ site_humanname }} Intermediate CA"
diff --git a/roles/pki-intermediate-ca/tasks/main.yml b/roles/pki-intermediate-ca/tasks/main.yml
index fe8aeea..56a8219 100644
--- a/roles/pki-intermediate-ca/tasks/main.yml
+++ b/roles/pki-intermediate-ca/tasks/main.yml
@@ -1,5 +1,5 @@
---
-# pki-ca/tasks/main.yml
+# pki-intermediate-ca/tasks/main.yml
- name: Create PKI directory
become: yes
@@ -12,7 +12,7 @@
- name: Create intermediate CA directory
become: yes
file:
- dest: "{{ pki_dir }}/intermediate_ca"
+ dest: "{{ pki_dir }}/{{ site_name }}_im_ca"
state: directory
owner: "{{ ansible_user_id }}"
mode: 0755
@@ -20,12 +20,12 @@
- name: Create intermediate CA openssl.cnf from template
template:
src: openssl_im.cnf.j2
- dest: "{{ pki_dir }}/intermediate_ca/openssl.cnf"
+ dest: "{{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf"
force: no
- name: Create subdirs for intermediate CA
file:
- dest: "{{ pki_dir }}/intermediate_ca/{{ item }}"
+ dest: "{{ pki_dir }}/{{ site_name }}_im_ca/{{ item }}"
state: directory
with_items:
- certs
@@ -35,51 +35,51 @@
- name: Create private CA directory
file:
- dest: "{{ pki_dir }}/intermediate_ca/private"
+ dest: "{{ pki_dir }}/{{ site_name }}_im_ca/private"
state: directory
mode: 0700
- name: Create serial file
copy:
- dest: "{{ pki_dir }}/intermediate_ca/serial"
+ dest: "{{ pki_dir }}/{{ site_name }}_im_ca/serial"
content: "01"
force: no
- name: Create empty index file if it doesn't exist
copy:
- dest: "{{ pki_dir }}/intermediate_ca/index.txt"
+ dest: "{{ pki_dir }}/{{ site_name }}_im_ca/index.txt"
content: ""
force: no
-- name: Save intermediate passphrase to intermediate_ca/private/ca_im_phrase
+- name: Save intermediate passphrase to sitename_im_ca/private/ca_im_phrase
copy:
- dest: "{{ pki_dir }}/intermediate_ca/private/ca_im_phrase"
+ dest: "{{ pki_dir }}/{{ site_name }}_im_ca/private/ca_im_phrase"
content: "{{ ca_im_phrase }}"
mode: 0400
- name: Generate intermediate key
command: >
openssl genrsa -aes256
- -out {{ pki_dir }}/intermediate_ca/private/im_key.pem
- -passout file:{{ pki_dir }}/intermediate_ca/private/ca_im_phrase
+ -out {{ pki_dir }}/{{ site_name }}_im_ca/private/im_key.pem
+ -passout file:{{ pki_dir }}/{{ site_name }}_im_ca/private/ca_im_phrase
{{ ca_size }}
args:
- creates: "{{ pki_dir }}/intermediate_ca/private/im_key.pem"
+ creates: "{{ pki_dir }}/{{ site_name }}_im_ca/private/im_key.pem"
- name: Set permissions on intermediate key
file:
- dest: "{{ pki_dir }}/intermediate_ca/private/im_key.pem"
+ dest: "{{ pki_dir }}/{{ site_name }}_im_ca/private/im_key.pem"
mode: 0400
- name: Create intermediate CSR
command: >
- openssl req -config {{ pki_dir }}/intermediate_ca/openssl.cnf
- -key {{ pki_dir }}/intermediate_ca/private/im_key.pem
- -passin file:{{ pki_dir }}/intermediate_ca/private/ca_im_phrase
+ openssl req -config {{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf
+ -key {{ pki_dir }}/{{ site_name }}_im_ca/private/im_key.pem
+ -passin file:{{ pki_dir }}/{{ site_name }}_im_ca/private/ca_im_phrase
-new -sha256 -subj "{{ ca_im_subj }}"
- -out {{ pki_dir }}/intermediate_ca/csr/intermediate_ca_csr.pem
+ -out {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ site_name }}_im_ca_csr.pem
args:
- creates: "{{ pki_dir }}/intermediate_ca/certs/intermediate_ca_csr.pem"
+ creates: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ site_name }}_im_ca_csr.pem"
environment:
KEY_ALTNAMES: ""
@@ -89,16 +89,16 @@
-extensions v3_intermediate_ca
-passin file:{{ pki_dir }}/root_ca/private/ca_root_phrase
-days {{ ca_im_days }} -md {{ ca_digest }}
- -in {{ pki_dir }}/intermediate_ca/csr/intermediate_ca_csr.pem
- -out {{ pki_dir }}/intermediate_ca/certs/im_cert.pem
+ -in {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ site_name }}_im_ca_csr.pem
+ -out {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert.pem
args:
- creates: "{{ pki_dir }}/intermediate_ca/certs/im_cert.pem"
+ creates: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert.pem"
- name: Verify intemediate cert
command: >
openssl verify
-CAfile {{ pki_dir }}/root_ca/certs/ca_cert.pem
- {{ pki_dir }}/intermediate_ca/certs/im_cert.pem
+ {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert.pem
register: im_verify
tags:
- skip_ansible_lint # diagnostic command
@@ -116,12 +116,13 @@
- name: Get the intermediate cert into im_cert var
command: >
- openssl x509 -in {{ pki_dir }}/intermediate_ca/certs/im_cert.pem
+ openssl x509 -in {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert.pem
register: im_cert
tags:
- skip_ansible_lint # concat of files
- name: Create intermediate cert chain
copy:
- dest: "{{ pki_dir }}/intermediate_ca/certs/im_cert_chain.pem"
+ dest: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert_chain.pem"
content: "{{ im_cert.stdout }}\n{{ ca_cert.stdout }}"
+
diff --git a/roles/pki-intermediate-ca/templates/openssl_im.cnf.j2 b/roles/pki-intermediate-ca/templates/openssl_im.cnf.j2
index 6647d83..9ae1504 100644
--- a/roles/pki-intermediate-ca/templates/openssl_im.cnf.j2
+++ b/roles/pki-intermediate-ca/templates/openssl_im.cnf.j2
@@ -4,7 +4,7 @@
default_ca = CA_default
[ CA_default ]
-dir = {{ pki_dir }}/intermediate_ca
+dir = {{ pki_dir }}/{{ site_name }}_im_ca
certs = $dir/certs
crl_dir = $dir/crl
new_certs_dir = $dir/newcerts
@@ -66,7 +66,7 @@
stateOrProvinceName_default = California
localityName_default = Menlo Park
0.organizationName_default = ON.Lab
-organizationalUnitName_default = Test Deployment
+organizationalUnitName_default = {{ site_humanname }}
emailAddress_default = privateca@opencord.org
[ v3_intermediate_ca ]
diff --git a/roles/pki-root-ca/defaults/main.yml b/roles/pki-root-ca/defaults/main.yml
index 9fc4952..6875f07 100644
--- a/roles/pki-root-ca/defaults/main.yml
+++ b/roles/pki-root-ca/defaults/main.yml
@@ -1,10 +1,10 @@
---
# pki-root-ca/defaults/main.yml
-pki_dir: "/opt/pki"
-credentials_dir: "/opt/credentials"
+pki_dir: "{{ playbook_dir }}/pki"
+credentials_dir: "{{ playbook_dir }}/credentials"
-# ca parameters
+# ca cert parameters
ca_digest: "sha256"
ca_size: 4096
ca_root_days: 3650
diff --git a/roles/ssh-pki/defaults/main.yml b/roles/ssh-pki/defaults/main.yml
index 1e8574e..c7e6125 100644
--- a/roles/ssh-pki/defaults/main.yml
+++ b/roles/ssh-pki/defaults/main.yml
@@ -1,9 +1,8 @@
---
# ssh-pki/tasks/main.yml
-pki_dir: "/opt/pki"
-ssh_pki_dir: "/opt/ssh_pki"
-credentials_dir: "/opt/credentials"
+ssh_pki_dir: "{{ playbook_dir }}/ssh_pki"
+credentials_dir: "{{ playbook_dir }}/credentials"
# password on SSH CA
ssh_ca_phrase: "{{ lookup('password', credentials_dir ~ '/ssh_ca_phrase length=64') }}"
diff --git a/roles/vtn-refresh/defaults/main.yml b/roles/vtn-refresh/defaults/main.yml
index 9243db9..07ee055 100644
--- a/roles/vtn-refresh/defaults/main.yml
+++ b/roles/vtn-refresh/defaults/main.yml
@@ -1,8 +1,10 @@
---
# vtn-refresh/defaults/main.yml
-xos_admin_user: xosadmin@opencord.org
-xos_admin_pass: "{{ lookup('password', 'credentials/xosadmin@opencord.org chars=ascii_letters,digits') }}"
+credentials_dir: "{{ playbook_dir }}/credentials"
-keystone_admin_password: "{{ lookup('password', 'credentials/cord_keystone_admin chars=ascii_letters,digits') }}"
+xos_admin_user: xosadmin@opencord.org
+xos_admin_pass: "{{ lookup('password', credentials_dir ~ '/xosadmin@opencord.org chars=ascii_letters,digits') }}"
+
+keystone_admin_password: "{{ lookup('password', credentials_dir ~ '/cord_keystone_admin chars=ascii_letters,digits') }}"