aboutsummaryrefslogtreecommitdiffstats
path: root/puppet/extraconfig/tls
diff options
context:
space:
mode:
Diffstat (limited to 'puppet/extraconfig/tls')
-rw-r--r--puppet/extraconfig/tls/ca-inject.yaml2
-rw-r--r--puppet/extraconfig/tls/freeipa-enroll.yaml23
-rw-r--r--puppet/extraconfig/tls/tls-cert-inject.yaml2
3 files changed, 19 insertions, 8 deletions
diff --git a/puppet/extraconfig/tls/ca-inject.yaml b/puppet/extraconfig/tls/ca-inject.yaml
index f955034d..04b5ccf6 100644
--- a/puppet/extraconfig/tls/ca-inject.yaml
+++ b/puppet/extraconfig/tls/ca-inject.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2015-04-30
+heat_template_version: ocata
description: >
This is a template which will inject the trusted anchor.
diff --git a/puppet/extraconfig/tls/freeipa-enroll.yaml b/puppet/extraconfig/tls/freeipa-enroll.yaml
index 44be7c65..7ce15069 100644
--- a/puppet/extraconfig/tls/freeipa-enroll.yaml
+++ b/puppet/extraconfig/tls/freeipa-enroll.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2015-10-15
+heat_template_version: ocata
description: Enroll nodes to FreeIPA
@@ -13,10 +13,12 @@ parameters:
type: string
FreeIPAOTP:
+ default: ''
description: 'OTP that will be used for FreeIPA enrollment'
type: string
hidden: true
FreeIPAServer:
+ default: ''
description: 'FreeIPA server DNS name'
type: string
FreeIPAIPAddress:
@@ -36,18 +38,27 @@ resources:
- name: ipa_ip
config: |
#!/bin/sh
- sed -i "/${ipa_server}/d" /etc/hosts
- # Optionally add the FreeIPA server IP to /etc/hosts
- if [ -n "${ipa_ip}" ]; then
- echo "${ipa_ip} ${ipa_server}" >> /etc/hosts
+ # If no IPA server was given as a parameter, it will be assumed from
+ # DNS.
+ if [ -n "${ipa_server}" ]; then
+ sed -i "/${ipa_server}/d" /etc/hosts
+ # Optionally add the FreeIPA server IP to /etc/hosts
+ if [ -n "${ipa_ip}" ]; then
+ echo "${ipa_ip} ${ipa_server}" >> /etc/hosts
+ fi
fi
# Set the node's domain if needed
if [ ! $(hostname -f | grep "${ipa_domain}$") ]; then
hostnamectl set-hostname "$(hostname).${ipa_domain}"
fi
yum install -y ipa-client
- # Enroll. If there is already keytab, we have already done this.
+ # Enroll. If there is already keytab, we have already done this. If
+ # this node hasn't enrolled and the OTP is missing, fail.
if [ ! -f /etc/krb5.keytab ]; then
+ if [ -z "${otp}" ]; then
+ echo "OTP is missing"
+ exit 1
+ fi
ipa-client-install --server ${ipa_server} -w ${otp} \
--domain=${ipa_domain} -U
fi
diff --git a/puppet/extraconfig/tls/tls-cert-inject.yaml b/puppet/extraconfig/tls/tls-cert-inject.yaml
index 49d84574..2a61afc0 100644
--- a/puppet/extraconfig/tls/tls-cert-inject.yaml
+++ b/puppet/extraconfig/tls/tls-cert-inject.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2015-04-30
+heat_template_version: ocata
description: >
This is a template which will build the TLS Certificates necessary