aboutsummaryrefslogtreecommitdiffstats
path: root/puppet/services/gnocchi-base.yaml
diff options
context:
space:
mode:
authorJuan Antonio Osorio Robles <jaosorior@redhat.com>2016-12-07 12:12:25 +0200
committerJuan Antonio Osorio Robles <jaosorior@redhat.com>2016-12-09 16:07:54 +0200
commit7611f45722671bd007a8f4f5774473cadac00f76 (patch)
treec5e897c3a4aa608f768766651cfdf5261333405a /puppet/services/gnocchi-base.yaml
parent1e11997e76a0d4dfba7909ad242882ef91967b4e (diff)
Add FreeIPA enrollment template
This is based on previous work [1] and it's what I've been using to test the TLS-everywhere work. This introduces a template that will run on every node to enroll them to FreeIPA and acquire a ticket (authenticate) in order to be able to request certificates. Enrollment is done via the ipa-client-install command and it does the following: * Get FreeIPA's CA certificate and trust it. * Authenticate to FreeIPA using an OTP and get a kerberos keytab. * Set up several configurations that are needed for FreeIPA (sssd, kerberos, certmonger) The keytab is then used to authenticate and get an actual TGT (Ticket-Granting-Ticket) from Kerberos The previous implementation used a PreConfig hook, however, here it was modified to use NodeTLSCAData. This has the advantage that it runs on every node as opposed to the PreConfig hook where we had to specify the role type so it's a usability improvement. And, on the other hand, this does set up necessary things for the usage of FreeIPA as a CA, such as getting the certificate and enrolling to the CA. [1] https://github.com/JAORMX/freeipa-tripleo-incubator bp tls-via-certmonger Change-Id: Iac94b3b047dca1bcabd464ea8eed6f1220c844f1
Diffstat (limited to 'puppet/services/gnocchi-base.yaml')
0 files changed, 0 insertions, 0 deletions