summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJuan Antonio Osorio Robles <jaosorior@redhat.com>2017-08-02 10:19:48 +0300
committerJuan Antonio Osorio Robles <jaosorior@redhat.com>2017-08-02 11:13:00 +0300
commita9695bd47038776ee4e38c584b593551c1f64250 (patch)
tree02560c6c22da0afefa2f4121b40ffec83a284e2b
parentee2a53afb1ad8f45be7d3986f5de2b6731048c65 (diff)
Ensure directory exists for certificates for haproxy
We used to rely on a standard directory for the certificates and keys that are requested by certmonger. However, given the approach we plan to take for containers that's described in the blueprint, we need to use service-specific directories for the certs/keys, since we plan to bind-mount these into the containers, and we don't want to bind mount any keys/certs from other services. Thus, we start by creating this directories if they don't exist in the filesystem and adding the proper selinux labels. bp tls-via-certmonger-containers Change-Id: Iba3adb9464a755e67c6f87d1233b3affa8be565a
-rw-r--r--manifests/certmonger/haproxy.pp5
-rw-r--r--manifests/certmonger/haproxy_dirs.pp55
-rw-r--r--manifests/profile/base/certmonger_user.pp1
3 files changed, 61 insertions, 0 deletions
diff --git a/manifests/certmonger/haproxy.pp b/manifests/certmonger/haproxy.pp
index a5d1bf8..3def337 100644
--- a/manifests/certmonger/haproxy.pp
+++ b/manifests/certmonger/haproxy.pp
@@ -84,6 +84,7 @@ define tripleo::certmonger::haproxy (
postsave_cmd => $postsave_cmd,
principal => $principal,
wait => true,
+ tag => 'haproxy-cert',
require => Class['::certmonger'],
}
concat { $service_pem :
@@ -91,12 +92,14 @@ define tripleo::certmonger::haproxy (
mode => '0640',
owner => 'haproxy',
group => 'haproxy',
+ tag => 'haproxy-cert',
require => Package[$::haproxy::params::package_name],
}
concat::fragment { "${title}-cert-fragment":
target => $service_pem,
source => $service_certificate,
order => '01',
+ tag => 'haproxy-cert',
require => Certmonger_certificate["${title}-cert"],
}
@@ -106,6 +109,7 @@ define tripleo::certmonger::haproxy (
target => $service_pem,
source => $ca_pem,
order => '10',
+ tag => 'haproxy-cert',
require => Class['tripleo::certmonger::ca::local'],
}
}
@@ -114,6 +118,7 @@ define tripleo::certmonger::haproxy (
target => $service_pem,
source => $service_key,
order => 20,
+ tag => 'haproxy-cert',
require => Certmonger_certificate["${title}-cert"],
}
}
diff --git a/manifests/certmonger/haproxy_dirs.pp b/manifests/certmonger/haproxy_dirs.pp
new file mode 100644
index 0000000..86058c3
--- /dev/null
+++ b/manifests/certmonger/haproxy_dirs.pp
@@ -0,0 +1,55 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the haproxy License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.haproxy.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# : = Class: tripleo::certmonger::haproxy_dirs
+#
+# Creates the necessary directories for haproxy's certificates and keys in the
+# assigned locations if specified. It also assigns the correct SELinux tags.
+#
+# === Parameters:
+#
+# [*certificate_dir*]
+# (Optional) Directory where haproxy's certificates will be stored. If left
+# unspecified, it won't be created.
+# Defaults to undef
+#
+# [*key_dir*]
+# (Optional) Directory where haproxy's keys will be stored.
+# Defaults to undef
+#
+class tripleo::certmonger::haproxy_dirs(
+ $certificate_dir = undef,
+ $key_dir = undef,
+){
+
+ if $certificate_dir {
+ file { $certificate_dir :
+ ensure => 'directory',
+ selrole => 'object_r',
+ seltype => 'cert_t',
+ seluser => 'system_u',
+ }
+ File[$certificate_dir] ~> Certmonger_certificate<| tag == 'haproxy-cert' |>
+ }
+
+ if $key_dir {
+ file { $key_dir :
+ ensure => 'directory',
+ selrole => 'object_r',
+ seltype => 'cert_t',
+ seluser => 'system_u',
+ }
+ File[$key_dir] ~> Certmonger_certificate<| tag == 'haproxy-cert' |>
+ }
+}
diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp
index 7a6559e..231a1d0 100644
--- a/manifests/profile/base/certmonger_user.pp
+++ b/manifests/profile/base/certmonger_user.pp
@@ -98,6 +98,7 @@ class tripleo::profile::base::certmonger_user (
ensure_resources('tripleo::certmonger::libvirt', $libvirt_certificates_specs)
}
unless empty($haproxy_certificates_specs) {
+ include ::tripleo::certmonger::haproxy_dirs
ensure_resources('tripleo::certmonger::haproxy', $haproxy_certificates_specs)
# The haproxy fronends (or listen resources) depend on the certificate
# existing and need to be refreshed if it changed.