Generate per-site SSL intermediate CA, fix cred/pki paths
Change-Id: I0bda0791d82142acac8c6af0e152d8d0954ef719
diff --git a/roles/pki-install/tasks/main.yml b/roles/pki-install/tasks/main.yml
index a49d88d..77c8806 100644
--- a/roles/pki-install/tasks/main.yml
+++ b/roles/pki-install/tasks/main.yml
@@ -1,46 +1,15 @@
---
# pki-install/tasks/main.yml
-- name: Copy CA certificates to head node
- become: yes
+- name: Copy CA certificates
copy:
src: "{{ pki_dir }}/{{ item.src }}"
dest: "/usr/local/share/ca-certificates/{{ item.dest }}"
with_items:
- src: "root_ca/certs/ca_cert.pem"
dest: "cord_root_ca.crt"
- - src: "intermediate_ca/certs/im_cert.pem"
+ - src: "{{ site_name }}_im_ca/certs/im_cert.pem"
dest: "cord_intermediate_ca.crt"
notify:
- - Run update-ca-certificates on head node
+ - update-ca-certificates
-- name: Ensure PKI directory
- become: yes
- file:
- path: "{{ pki_dir }}"
- state: directory
-
-- name: Copy certs needed by XOS
- become: yes
- copy:
- src: "{{ pki_dir }}/{{ item.src }}"
- dest: "{{ pki_dir }}/{{ item.dest }}"
- with_items:
- - src: "intermediate_ca/certs/im_cert_chain.pem"
- dest: "im_cert_chain.pem"
- - src: "intermediate_ca/private/xos-core.{{ site_suffix }}_key.pem"
- dest: "core_api_key.pem"
- - src: "intermediate_ca/certs/xos-core.{{ site_suffix }}_cert_chain.pem"
- dest: "core_api_cert.pem"
-
-- name: Copy certs needed by OpenStack
- become: yes
- when: use_openstack
- copy:
- src: "{{ pki_dir }}/{{ item.src }}"
- dest: "{{ pki_dir }}/{{ item.dest }}"
- with_items:
- - src: "intermediate_ca/private/keystone.{{ site_suffix }}_key.pem"
- dest: "keystone.{{ site_suffix }}_key.pem"
- - src: "intermediate_ca/certs/keystone.{{ site_suffix }}_cert.pem"
- dest: "keystone.{{ site_suffix }}_cert.pem"