diff options
Diffstat (limited to 'manifests/certmonger')
| -rw-r--r-- | manifests/certmonger/haproxy.pp | 20 | ||||
| -rw-r--r-- | manifests/certmonger/mysql.pp | 84 |
2 files changed, 102 insertions, 2 deletions
diff --git a/manifests/certmonger/haproxy.pp b/manifests/certmonger/haproxy.pp index 504acf3..3b8fd09 100644 --- a/manifests/certmonger/haproxy.pp +++ b/manifests/certmonger/haproxy.pp @@ -36,6 +36,10 @@ # The post-save-command that certmonger will use once it renews the # certificate. # +# [*certmonger_ca*] +# (Optional) The CA that certmonger will use to generate the certificates. +# Defaults to hiera('certmonger_ca', 'local'). +# # [*principal*] # The haproxy service principal that is set for HAProxy in kerberos. # @@ -45,7 +49,8 @@ define tripleo::certmonger::haproxy ( $service_key, $hostname, $postsave_cmd, - $principal = undef, + $certmonger_ca = hiera('certmonger_ca', 'local'), + $principal = undef, ){ include ::haproxy::params certmonger_certificate { "${title}-cert": @@ -69,10 +74,21 @@ define tripleo::certmonger::haproxy ( order => '01', require => Certmonger_certificate["${title}-cert"], } + + if $certmonger_ca == 'local' { + $ca_pem = getparam(Class['tripleo::certmonger::ca::local'], 'ca_pem') + concat::fragment { "${title}-ca-fragment": + target => $service_pem, + source => $ca_pem, + order => '10', + require => Class['tripleo::certmonger::ca::local'], + } + } + concat::fragment { "${title}-key-fragment": target => $service_pem, source => $service_key, - order => 10, + order => 20, require => Certmonger_certificate["${title}-cert"], } } diff --git a/manifests/certmonger/mysql.pp b/manifests/certmonger/mysql.pp new file mode 100644 index 0000000..62aff9a --- /dev/null +++ b/manifests/certmonger/mysql.pp @@ -0,0 +1,84 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::certmonger::mysql +# +# Request a certificate for the MySQL/Mariadb service and do the necessary setup. +# +# === Parameters +# +# [*hostname*] +# The hostname of the node. this will be set in the CN of the certificate. +# +# [*service_certificate*] +# The path to the certificate that will be used for TLS in this service. +# +# [*service_key*] +# The path to the key that will be used for TLS in this service. +# +# [*certmonger_ca*] +# (Optional) The CA that certmonger will use to generate the certificates. +# Defaults to hiera('certmonger_ca', 'local'). +# +# [*mysql_network*] +# (Optional) The network name where the mysql endpoint is listening on. +# This is set by t-h-t. +# Defaults to hiera('mysql_network', undef) +# +# [*principal*] +# (Optional) The haproxy service principal that is set for MySQL in kerberos. +# Defaults to undef +# +class tripleo::certmonger::mysql ( + $hostname, + $service_certificate, + $service_key, + $certmonger_ca = hiera('certmonger_ca', 'local'), + $mysql_network = hiera('mysql_network', undef), + $principal = undef, +) { + include ::certmonger + include ::mysql::params + + if !$mysql_network { + fail('mysql_network is not set in the hieradata.') + } + + $postsave_cmd = "systemctl reload ${::mysql::params::service_name}" + certmonger_certificate { 'mysql' : + ensure => 'present', + certfile => $service_certificate, + keyfile => $service_key, + hostname => $hostname, + dnsname => $hostname, + principal => $principal, + postsave_cmd => $postsave_cmd, + ca => $certmonger_ca, + wait => true, + require => Class['::certmonger'], + } + file { $service_certificate : + owner => 'mysql', + group => 'mysql', + require => Certmonger_certificate['mysql'], + } + file { $service_key : + owner => 'mysql', + group => 'mysql', + require => Certmonger_certificate['mysql'], + } + + File[$service_certificate] ~> Service<| title == $::mysql::params::service_name |> + File[$service_key] ~> Service<| title == $::mysql::params::service_name |> +} |