blob: 04b5ccf68dbbdf822c249942b9d194359463de6c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
heat_template_version: ocata
description: >
This is a template which will inject the trusted anchor.
parameters:
# Can be overridden via parameter_defaults in the environment
SSLRootCertificate:
description: >
The content of a CA's SSL certificate file in PEM format.
This is evaluated on the client side.
type: string
SSLRootCertificatePath:
default: '/etc/pki/ca-trust/source/anchors/ca.crt.pem'
description: >
The filepath of the root certificate as it will be stored in the nodes.
Note that the path has to be one that can be picked up by the update
trust anchor command. e.g. in RHEL it would be
/etc/pki/ca-trust/source/anchors/ca.crt.pem
type: string
UpdateTrustAnchorsCommand:
default: update-ca-trust extract
description: >
command that will be executed to update the trust anchors.
type: string
# Passed in by controller.yaml
server:
description: ID of the node to apply this config to
type: string
resources:
CAConfig:
type: OS::Heat::SoftwareConfig
properties:
group: script
inputs:
- name: cacert_path
- name: cacert_content
- name: update_anchor_command
outputs:
- name: root_cert_md5sum
config: |
#!/bin/sh
cat > ${cacert_path} << EOF
${cacert_content}
EOF
chmod 0444 ${cacert_path}
chown root:root ${cacert_path}
${update_anchor_command}
md5sum ${cacert_path} > ${heat_outputs_path}.root_cert_md5sum
CADeployment:
type: OS::Heat::SoftwareDeployment
properties:
name: CADeployment
config: {get_resource: CAConfig}
server: {get_param: server}
input_values:
cacert_path: {get_param: SSLRootCertificatePath}
cacert_content: {get_param: SSLRootCertificate}
update_anchor_command: {get_param: UpdateTrustAnchorsCommand}
outputs:
deploy_stdout:
description: Deployment reference
value: {get_attr: [CADeployment, root_cert_md5sum]}
|
