Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Refactor CA file handling in replica installer. #1093

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Refactor CA file handling in replica installer. #1093

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 6 additions & 0 deletions roles/ipareplica/library/ipareplica_install_ca_certs.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,12 @@ def main():
config.ca_host_name = config_ca_host_name
config.ips = config_ips

if install_ca_cert is None:
ansible_module.exit_json(
changed=False,
config_master_host_name=config.master_host_name,
config_ca_host_name=config.ca_host_name)

remote_api = gen_remote_api(config.master_host_name, paths.ETC_IPA)
installer._remote_api = remote_api

Expand Down
24 changes: 19 additions & 5 deletions roles/ipareplica/library/ipareplica_prepare.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,7 +275,8 @@
check_domain_level_is_supported, errors, ScriptError, setup_logging,
logger, check_dns_resolution, service, find_providing_server, ca, kra,
dns, no_matching_interface_for_ip_address_warning, adtrust,
constants, api, redirect_stdout, replica_conn_check, tasks
constants, api, redirect_stdout, replica_conn_check, tasks,
is_ipa_client_configured, install_ca_cert,
)
from ansible.module_utils import six

Expand Down Expand Up @@ -601,10 +602,23 @@ def main():
ansible_log.debug("-- CA_CRT --")

cafile = paths.IPA_CA_CRT
if not os.path.isfile(cafile):
ansible_module.fail_json(
msg="CA cert file is not available! Please reinstall"
"the client and try again.")
if install_ca_cert is not None:
if not os.path.isfile(cafile):
ansible_module.fail_json(
msg="CA cert file is not available! Please reinstall"
"the client and try again.")
else:
if (
is_ipa_client_configured is not None
and is_ipa_client_configured(on_master=True)
):
# host was already an IPA client, refresh client cert stores to
# ensure we have up to date CA certs.
try:
ipautil.run([paths.IPA_CERTUPDATE])
except ipautil.CalledProcessError:
ansible_module.fail_json(
msg="ipa-certupdate failed to refresh certs.")

ansible_log.debug("-- REMOTE_API --")

Expand Down
14 changes: 12 additions & 2 deletions roles/ipareplica/module_utils/ansible_ipa_replica.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@
"dnsname", "kernel_keyring", "krbinstance", "getargspec",
"adtrustinstance", "paths", "api", "dsinstance", "ipaldap", "Env",
"ipautil", "installutils", "IPA_PYTHON_VERSION", "NUM_VERSION",
"ReplicaConfig", "create_api"]
"ReplicaConfig", "create_api", "is_ipa_client_configured", ]

import sys
import logging
Expand Down Expand Up @@ -134,14 +134,24 @@ def getargspec(func):
find_providing_servers, find_providing_server)
from ipaserver.install.installutils import (
ReplicaConfig, load_pkcs12)
try:
from ipalib.facts import is_ipa_client_configured
except ImportError:
is_ipa_client_configured = None
try:
from ipalib.facts import is_ipa_configured
except ImportError:
from ipaserver.install.installutils import is_ipa_configured
from ipaserver.install.replication import (
ReplicationManager, replica_conn_check)
try:
from ipaserver.install.server.replicainstall import (
install_ca_cert
)
except ImportError:
install_ca_cert = None
from ipaserver.install.server.replicainstall import (
make_pkcs12_info, install_replica_ds, install_krb, install_ca_cert,
make_pkcs12_info, install_replica_ds, install_krb,
install_http, install_dns_records, create_ipa_conf, check_dirsrv,
check_dns_resolution, configure_certmonger,
remove_replica_info_dir,
Expand Down