Skip to content

Commit 1c66512

Browse files
jimrightjimright
authored
Add roles and example playbook for PVC cert renewal (#189)
* Add roles and example playbook for PVC cert renewal * Add documentation for TLS roles * Fix lint issues * Remove tasks and variables used to create openssl.cnf Signed-off-by: Jim Enright <[email protected]>
1 parent cd3d8d6 commit 1c66512

File tree

18 files changed

+784
-0
lines changed

18 files changed

+784
-0
lines changed

‎playbooks/pvc_renew_certs.yml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
3+
# Copyright 2024 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
- name: Pre - Initialization of local working directories
18+
hosts: localhost
19+
connection: local
20+
tasks:
21+
- name: Create temporary build directory
22+
ansible.builtin.tempfile:
23+
state: directory
24+
prefix: pvc_tls_
25+
register: __pvc_tls_tempdir
26+
27+
- name: Create a directory for csrs and signed certs
28+
ansible.builtin.file:
29+
path: "{{ [__pvc_tls_tempdir.path, item] | path_join }}"
30+
state: directory
31+
mode: '0755'
32+
loop:
33+
- csrs
34+
- certs
35+
- ca_certs
36+
37+
- name: Play 1 - Generate CSR on each host
38+
hosts: "{{ target | default('cluster') }}"
39+
become: yes
40+
gather_facts: yes
41+
tasks:
42+
43+
- name: Call tls_generate_csr role
44+
ansible.builtin.import_role:
45+
name: cloudera.exe.tls_generate_csr
46+
vars:
47+
local_csrs_dir: "{{ (hostvars['localhost']['__pvc_tls_tempdir']['path'], 'csrs') | path_join }}"
48+
49+
- name: Get the list of CSRs to sign
50+
hosts: localhost
51+
connection: local
52+
tasks:
53+
- name: "Set fact for all CSRs in {{ local_csrs_dir }}"
54+
ansible.builtin.find:
55+
paths: "{{ local_csrs_dir }}"
56+
file_type: file
57+
register: __csrs_to_sign
58+
vars:
59+
local_csrs_dir: "{{ (hostvars['localhost']['__pvc_tls_tempdir']['path'], 'csrs') | path_join }}"
60+
61+
- name: Set fact for csrs to sign
62+
ansible.builtin.set_fact:
63+
local_csrs_to_sign: "{{ __csrs_to_sign.files | json_query('[*].path') | flatten }}"
64+
65+
- name: Play 2 - Sign the CSR
66+
hosts: ca_server
67+
become: yes
68+
gather_facts: yes
69+
tasks:
70+
71+
- name: Call tls_signing role
72+
ansible.builtin.import_role:
73+
name: cloudera.exe.tls_signing
74+
vars:
75+
csrs_to_sign: "{{ hostvars['localhost']['local_csrs_to_sign'] }}"
76+
copy_from_controller: true
77+
local_certs_dir: "{{ (hostvars['localhost']['__pvc_tls_tempdir']['path'], 'certs') | path_join }}"
78+
79+
- name: Play 3 - Install the sign certs on each host
80+
hosts: "{{ target | default('cluster') }}"
81+
become: yes
82+
gather_facts: yes
83+
tasks:
84+
85+
- name: Call tls_install_certs role
86+
ansible.builtin.import_role:
87+
name: cloudera.exe.tls_install_certs
88+
vars:
89+
local_tls_signed_certs_dir: "{{ (hostvars['localhost']['__pvc_tls_tempdir']['path'], 'certs') | path_join }}"
90+
91+
- name: Post 1 - Restart CM Server service
92+
hosts: cloudera_manager
93+
become: yes
94+
gather_facts: yes
95+
tasks:
96+
97+
- name: Restart CM Server service
98+
when:
99+
- restart_services | default(False)
100+
ansible.builtin.service:
101+
name: cloudera-scm-server
102+
state: restarted
103+
104+
- name: Post 2 - Restart DB Server service
105+
hosts: db_server
106+
become: yes
107+
gather_facts: yes
108+
tasks:
109+
110+
- name: Restart DB Server service
111+
when:
112+
- restart_services | default(False)
113+
ansible.builtin.service:
114+
name: "{{ db_service_name }}"
115+
state: reloaded
116+
117+
- name: Post 3 - Restart CM Agent service
118+
hosts: cluster
119+
become: yes
120+
gather_facts: yes
121+
tasks:
122+
123+
- name: Restart CM Agent service
124+
when:
125+
- restart_services | default(False)
126+
ansible.builtin.service:
127+
name: cloudera-scm-agent
128+
state: restarted

‎roles/tls_fetch_ca_certs/README.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<!--
2+
# Copyright 2024 Cloudera, Inc. All Rights Reserved.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
-->
16+
17+
# cloudera.exe.tls_fetch_ca_certs

‎roles/tls_fetch_ca_certs/defaults/main.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Copyright 2024 Cloudera, Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
---
16+
17+
ca_server_intermediate_path: /ca/intermediate/certs
18+
ca_server_intermediate_cert_name: intermediate.cert.pem
19+
ca_server_root_path: /ca/certs
20+
ca_server_root_cert_name: ca.cert.pem
21+
22+
# local_ca_certs_dir

‎roles/tls_fetch_ca_certs/meta/argument_specs.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Copyright 2024 Cloudera, Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
---
16+
17+
argument_specs:
18+
main:
19+
short_description: "Bring CA root and intermediate cert back to controller"
20+
description:
21+
- Fetch the named root and intermediate CA TLS Certificates from the CA Server.
22+
author:
23+
- "Jim Enright <[email protected]>"
24+
options:
25+
ca_server_intermediate_path:
26+
description: "Path to intermediate CA cert on the CA server"
27+
default: "/ca/intermediate/certs"
28+
type: "str"
29+
ca_server_intermediate_cert_name:
30+
description: "Name of the intermediate CA cert file"
31+
type: "str"
32+
default: "intermediate.cert.pem"
33+
ca_server_root_path:
34+
description: "Path to root CA cert on the CA server"
35+
default: "/ca/certs"
36+
type: "str"
37+
ca_server_root_cert_name:
38+
description: "Name of the root CA cert file"
39+
type: "str"
40+
default: "ca.cert.pem"
41+
local_ca_certs_dir:
42+
description: "Directory on Ansible controller to store the root and intermediate CA cert files"
43+
type: "str"
44+
required: true

‎roles/tls_fetch_ca_certs/tasks/main.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Copyright 2024 Cloudera, Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
---
16+
17+
- name: Bring ca root and intermediate cert back to controller
18+
ansible.builtin.fetch:
19+
src: "{{ item.cert_path }}/{{ item.cert_filename }}"
20+
dest: "{{ local_ca_certs_dir }}/{{ item.cert_filename }}"
21+
flat: yes
22+
loop:
23+
- cert_path: "{{ ca_server_intermediate_path }}"
24+
cert_filename: "{{ ca_server_intermediate_cert_name }}"
25+
- cert_path: "{{ ca_server_root_path }}"
26+
cert_filename: "{{ ca_server_root_cert_name }}"

‎roles/tls_generate_csr/README.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<!--
2+
# Copyright 2024 Cloudera, Inc. All Rights Reserved.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
-->
16+
17+
# cloudera.exe.tls_generate_csr

‎roles/tls_generate_csr/defaults/main.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Copyright 2023 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
---
16+
openssl_path: /usr/bin/openssl
17+
18+
base_dir_security: /opt/cloudera/security
19+
base_dir_security_pki: "{{ base_dir_security }}/pki"
20+
tls_csr_path: "{{ base_dir_security_pki }}/{{ inventory_hostname }}.csr"
21+
22+
# local_csrs_dir: "/tmp/csrs"
23+
24+
ca_server_attrs_general:
25+
OU: PS
26+
O: Cloudera, Inc.
27+
ST: CA
28+
C: US
29+
30+
31+
tls_key_password: changeme
32+
33+
tls_key_path: "{{ base_dir_security_pki }}/{{ inventory_hostname }}.key"

‎roles/tls_generate_csr/meta/argument_specs.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Copyright 2024 Cloudera, Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
---
16+
17+
argument_specs:
18+
main:
19+
short_description: "Generates a CSR on each host and copies it back to the Ansible controller"
20+
description:
21+
- Generates a TLS Certificate Signing Request (CSR).
22+
- Once created the CSR file is copied back to the Ansibles controller.
23+
author:
24+
- "Jim Enright <[email protected]>"
25+
options:
26+
base_dir_security:
27+
description: "Base directory for Cloudera CDP security related files"
28+
type: "str"
29+
default: "/opt/cloudera/security"
30+
base_dir_security_pki:
31+
description: "Base directory for Cloudera CDP PKI security related files"
32+
type: "str"
33+
default: "{{ base_dir_security }}/pki"
34+
tls_csr_path:
35+
description: "Location of the OpenSSL Certificate Signing Request file that will be created by the role"
36+
type: "str"
37+
default: "{{ base_dir_security_pki }}/{{ inventory_hostname }}.csr"
38+
ca_server_attrs_general:
39+
description: "Attributes to use in the certificate signing request"
40+
type: "dict"
41+
default:
42+
OU: PS
43+
O: "Cloudera, Inc."
44+
ST: "CA"
45+
C: "US"
46+
tls_key_password:
47+
description: "Password for the TLS Key."
48+
type: "str"
49+
default: "changeme"
50+
tls_key_path:
51+
description: "Location of the TLS key."
52+
type: "str"
53+
default: "{{ base_dir_security_pki }}/{{ inventory_hostname }}.key"
54+
local_csrs_dir:
55+
description: "Location on the Ansible Controller where the CSR will be copied."
56+
type: "str"
57+
default: "{{ base_dir_security_pki }}/{{ inventory_hostname }}.key"

0 commit comments

Comments
 (0)