diff options
| -rw-r--r-- | manifests/profile/base/certmonger_user.pp | 77 | ||||
| -rw-r--r-- | spec/classes/tripleo_certmonger_ca_local.rb | 46 | ||||
| -rw-r--r-- | spec/classes/tripleo_certmonger_httpd.rb | 63 |
3 files changed, 186 insertions, 0 deletions
diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp new file mode 100644 index 0000000..586c7e4 --- /dev/null +++ b/manifests/profile/base/certmonger_user.pp @@ -0,0 +1,77 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == class: tripleo::profile::base::certmonger_user +# +# Profile that ensures that the relevant certmonger certificates have been +# requested. The certificates come from the hiera set by the specific profiles +# and come in a pre-defined format. +# For a service that has several certificates (one per network name): +# apache_certificates_specs: +# httpd-internal_api: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "HTTP/<overcloud controller fqdn>" +# For a service that uses a single certificate: +# mysql_certificates_specs: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "mysql/<overcloud controller fqdn>" +# +# === Parameters +# +# [*apache_certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Defaults to hiera('apache_certificate_specs', {}). +# +# [*haproxy_certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Defaults to hiera('tripleo::profile::base::haproxy::certificate_specs', {}). +# +# [*mysql_certificate_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Defaults to hiera('tripleo::profile::base::database::mysql::certificate_specs', {}). +# +# [*rabbitmq_certificate_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Defaults to hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}). +# +class tripleo::profile::base::certmonger_user ( + $apache_certificates_specs = hiera('apache_certificates_specs', {}), + $haproxy_certificates_specs = hiera('tripleo::profile::base::haproxy::certificates_specs', {}), + $mysql_certificate_specs = hiera('tripleo::profile::base::database::mysql::certificate_specs', {}), + $rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}), +) { + unless empty($apache_certificates_specs) { + ensure_resources('tripleo::certmonger::httpd', $apache_certificates_specs) + } + unless empty($haproxy_certificates_specs) { + ensure_resources('tripleo::certmonger::haproxy', $haproxy_certificates_specs) + # The haproxy fronends (or listen resources) depend on the certificate + # existing and need to be refreshed if it changed. + Tripleo::Certmonger::Haproxy<||> ~> Haproxy::Listen<||> + } + unless empty($mysql_certificate_specs) { + ensure_resource('class', 'tripleo::certmonger::mysql', $mysql_certificate_specs) + } + unless empty($rabbitmq_certificate_specs) { + ensure_resource('class', 'tripleo::certmonger::rabbitmq', $rabbitmq_certificate_specs) + } +} diff --git a/spec/classes/tripleo_certmonger_ca_local.rb b/spec/classes/tripleo_certmonger_ca_local.rb new file mode 100644 index 0000000..7ee9383 --- /dev/null +++ b/spec/classes/tripleo_certmonger_ca_local.rb @@ -0,0 +1,46 @@ +# +# Copyright (C) 2017 Red Hat Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# Unit tests for tripleo +# + +require 'spec_helper' + +describe 'tripleo::certmonger::ca::local' do + + shared_examples_for 'tripleo::certmonger::ca::local' do + let :params do + { + :ca_pem => '/etc/pki/ca-trust/source/anchors/cm-local-ca.pem', + } + end + + it 'should extract CA cert' do + is_expected.to contain_exec('extract-and-trust-ca').with( + :creates => params[:ca_pem], + ) + end + end + + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) do + facts.merge({}) + end + + it_behaves_like 'tripleo::certmonger::ca::local' + end + end +end diff --git a/spec/classes/tripleo_certmonger_httpd.rb b/spec/classes/tripleo_certmonger_httpd.rb new file mode 100644 index 0000000..da5ce94 --- /dev/null +++ b/spec/classes/tripleo_certmonger_httpd.rb @@ -0,0 +1,63 @@ +# +# Copyright (C) 2017 Red Hat Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# Unit tests for tripleo +# + +require 'spec_helper' + +describe 'tripleo::certmonger::httpd' do + + shared_examples_for 'tripleo::certmonger::httpd' do + let :params do + { + :name => 'httpd-cert', + :hostname => 'localhost', + :service_certificate => '/etc/pki/cert.crt', + :service_key => '/etc/pki/key.pem', + } + end + + it 'should include the base for using certmonger' do + is_expected.to contain_class('certmonger') + end + + it 'should include the httpd parameters' do + is_expected.to contain_class('apache::params') + end + + it 'should request a certificate' do + is_expected.to contain_certmonger_certificate('httpd-cert').with( + :ensure => 'present', + :certfile => '/etc/pki/cert.crt', + :keyfile => '/etc/pki/key.pem', + :hostname => 'localhost', + :dnsname => 'localhost', + :ca => 'local', + :wait => true, + ) + end + end + + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) do + facts.merge({}) + end + + it_behaves_like 'tripleo::certmonger::httpd' + end + end +end |