1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
# Copyright 2017 Red Hat, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# == class: tripleo::certmonger::ca::crl
#
# Class that downloads the appropriate CRL file from the CA. This can
# furtherly be used by services in order for proper certificate revocation to
# come into effect. The class also sets up a cron job that will refresh the CRL
# once a week. Also, processing of the CRL file might be needed. e.g. most CAs
# use DER format to distribute the CRLs, while services such as HAProxy expect
# the CRL to be in PEM format.
#
# === Parameters
#
# [*crl_dest*]
# (Optional) The file where the CRL file will be stored.
# Defaults to '/etc/pki/CA/crl/overcloud-crl.pem'
#
# [*crl_source*]
# (Optional) The URI where the CRL file will be fetched from.
# Defaults to undef
#
# [*process*]
# (Optional) Whether the CRL needs processing before being used. This means
# transforming from DER to PEM format or viceversa. This is because most CRLs
# by default come in DER format, so most likely it needs to be transformed.
# Defaults to true
#
# [*crl_preprocessed*]
# (Optional) The pre-processed CRL file which will be transformed.
# Defaults to '/etc/pki/CA/crl/overcloud-crl.bin'
#
# [*crl_preprocessed_format*]
# (Optional) The pre-processed CRL file's format which will be transformed.
# Defaults to 'DER'
#
# [*minute*]
# (optional) Defaults to '0'.
#
# [*hour*]
# (optional) Defaults to '1'.
#
# [*monthday*]
# (optional) Defaults to '*'.
#
# [*month*]
# (optional) Defaults to '*'.
#
# [*weekday*]
# (optional) Defaults to '6'.
#
# [*maxdelay*]
# (optional) Seconds. Defaults to 0. Should be a positive integer.
# Induces a random delay before running the cronjob to avoid running all
# cron jobs at the same time on all hosts this job is configured.
#
# [*reload_cmds*]
# (Optional) list of commands to be executed after fetching the CRL list in
# the cron job. This will usually be a list of reload commands issued to
# services that use the CRL.
# Defaults to []
#
class tripleo::certmonger::ca::crl (
$crl_dest = '/etc/pki/CA/crl/overcloud-crl.pem',
$crl_source = undef,
$process = true,
$crl_preprocessed = '/etc/pki/CA/crl/overcloud-crl.bin',
$crl_preprocessed_format = 'DER',
$minute = '0',
$hour = '1',
$monthday = '*',
$month = '*',
$weekday = '6',
$maxdelay = 0,
$reload_cmds = [],
) {
if $crl_source {
$ensure = 'present'
} else {
$ensure = 'absent'
}
if $maxdelay == 0 {
$sleep = ''
} else {
$sleep = "sleep `expr \${RANDOM} \\% ${maxdelay}`; "
}
if $process {
$fetched_crl = $crl_preprocessed
} else {
$fetched_crl = $crl_dest
}
file { 'tripleo-ca-crl' :
ensure => $ensure,
path => $fetched_crl,
source => $crl_source,
mode => '0644',
}
if $process and $ensure == 'present' {
$crl_dest_format = $crl_preprocessed_format ? {
'PEM' => 'DER',
'DER' => 'PEM'
}
# transform CRL from DER to PEM or viceversa
$process_cmd = "openssl crl -in ${$crl_preprocessed} -inform ${crl_preprocessed_format} -outform ${crl_dest_format} -out ${crl_dest}"
exec { 'tripleo-ca-crl-process-command' :
command => $process_cmd,
path => '/usr/bin',
refreshonly => true,
subscribe => File['tripleo-ca-crl']
}
} else {
$process_cmd = []
}
if $ensure == 'present' {
# Fetch CRL in cron job and notify needed services
$cmd_list = concat(["${sleep}curl -L -o ${fetched_crl} ${crl_source}"], $process_cmd, $reload_cmds)
$cron_cmd = join($cmd_list, ' && ')
} else {
$cron_cmd = absent
}
cron { 'tripleo-refresh-crl-file':
ensure => $ensure,
command => $cron_cmd,
environment => 'PATH=/usr/bin SHELL=/bin/sh',
user => 'root',
minute => $minute,
hour => $hour,
monthday => $monthday,
month => $month,
weekday => $weekday,
}
}
|
