Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Copy the server CA certificate with file resource #420

Merged
merged 3 commits into from
Apr 23, 2024
Merged

Copy the server CA certificate with file resource #420

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6b76e2c
Copy the server CA certificate with file resource
ehelms Sep 23, 2023
d43d1a1
Copy server cert for Apache using file resource
ehelms Sep 23, 2023
80fc2c9
Copy server cert for Foreman Proxy using file resource
ehelms Sep 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
33 changes: 20 additions & 13 deletions manifests/apache.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,6 @@
Stdlib::Absolutepath $pki_dir = $certs::pki_dir,
Optional[Stdlib::Absolutepath] $server_cert = $certs::server_cert,
Optional[Stdlib::Absolutepath] $server_key = $certs::server_key,
Optional[Stdlib::Absolutepath] $server_cert_req = $certs::server_cert_req,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why was that ever needed? (curious-Evgeni is afraid of the answer)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure --

puppet-certs/lib/puppet/provider/cert/katello_ssl_tool.rb

Line 20 in 39713ae

FileUtils.cp(resource[:custom_req], build_path(File.basename(req_file)))
seems symbolic

String[2,2] $country = $certs::country,
String $state = $certs::state,
String $city = $certs::city,
Expand All @@ -70,19 +69,25 @@
# This variable is unused but considered public API
$apache_ca_cert = $certs::katello_server_ca_cert

$apache_cert_path = "${certs::ssl_build_dir}/${hostname}/${apache_cert_name}"

if $server_cert {
cert { $apache_cert_name:
ensure => present,
hostname => $hostname,
cname => $cname,
generate => $generate,
deploy => false,
regenerate => $regenerate,
custom_pubkey => $server_cert,
custom_privkey => $server_key,
custom_req => $server_cert_req,
build_dir => $certs::ssl_build_dir,
file { "${apache_cert_path}.crt":
ehelms marked this conversation as resolved.
Show resolved Hide resolved
ensure => file,
source => $server_cert,
owner => 'root',
group => 'root',
mode => '0440',
}
file { "${apache_cert_path}.key":
ensure => file,
source => $server_key,
owner => 'root',
group => 'root',
mode => '0440',
}

$require_cert = File["${apache_cert_path}.crt"]
} else {
cert { $apache_cert_name:
ensure => present,
Expand All @@ -101,6 +106,8 @@
password_file => $ca_key_password_file,
build_dir => $certs::ssl_build_dir,
}

$require_cert = Cert[$apache_cert_name]
}

if $deploy {
Expand All @@ -114,7 +121,7 @@
cert_owner => 'root',
cert_group => $group,
cert_mode => '0440',
require => Cert[$apache_cert_name],
require => $require_cert,
}
}
}
40 changes: 20 additions & 20 deletions manifests/ca.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,17 +12,17 @@
String $ca_expiration = $certs::ca_expiration,
Boolean $generate = $certs::generate,
Boolean $deploy = $certs::deploy,
Optional[Stdlib::Absolutepath] $server_cert = $certs::server_cert,
Optional[Stdlib::Absolutepath] $ssl_build_dir = $certs::ssl_build_dir,
String $group = $certs::group,
String $owner = $certs::user,
String $group = $certs::group,
Stdlib::Absolutepath $katello_server_ca_cert = $certs::katello_server_ca_cert,
Stdlib::Absolutepath $ca_key = $certs::ca_key,
Stdlib::Absolutepath $ca_cert = $certs::ca_cert,
Stdlib::Absolutepath $ca_cert_stripped = $certs::ca_cert_stripped,
String $ca_key_password = $certs::ca_key_password,
Stdlib::Absolutepath $ca_key_password_file = $certs::ca_key_password_file,
) {
$server_ca_path = "${certs::ssl_build_dir}/${server_ca_name}.crt"

file { "${certs::pki_dir}/private/${default_ca_name}.pwd":
ensure => absent,
}
Expand Down Expand Up @@ -51,29 +51,29 @@
}
$default_ca = Ca[$default_ca_name]

if $server_cert {
ca { $server_ca_name:
ensure => present,
generate => $generate,
deploy => false,
custom_pubkey => $certs::server_ca_cert,
build_dir => $certs::ssl_build_dir,
if $certs::server_ca_cert {
file { $server_ca_path:
ensure => file,
source => $certs::server_ca_cert,
owner => 'root',
group => 'root',
mode => '0644',
}
} else {
ca { $server_ca_name:
ensure => present,
generate => $generate,
deploy => false,
custom_pubkey => "${certs::ssl_build_dir}/${default_ca_name}.crt",
build_dir => $certs::ssl_build_dir,
file { $server_ca_path:
ensure => file,
source => "${certs::ssl_build_dir}/${default_ca_name}.crt",
owner => 'root',
group => 'root',
mode => '0644',
}
}

if $generate {
file { "${ssl_build_dir}/KATELLO-TRUSTED-SSL-CERT":
file { "${certs::ssl_build_dir}/KATELLO-TRUSTED-SSL-CERT":
ensure => link,
target => "${ssl_build_dir}/${server_ca_name}.crt",
require => Ca[$server_ca_name],
target => $server_ca_path,
require => File[$server_ca_path],
}
}

Expand All @@ -94,7 +94,7 @@

file { $katello_server_ca_cert:
ensure => file,
source => "${certs::ssl_build_dir}/${server_ca_name}.crt",
source => $server_ca_path,
owner => $owner,
group => $group,
mode => '0644',
Expand Down
32 changes: 20 additions & 12 deletions manifests/foreman_proxy.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,19 +37,25 @@
$foreman_proxy_client_cert_name = "${hostname}-foreman-proxy-client"
$foreman_proxy_ssl_client_bundle = "${pki_dir}/private/${foreman_proxy_client_cert_name}-bundle.pem"

$proxy_cert_path = "${certs::ssl_build_dir}/${hostname}/${proxy_cert_name}"

if $server_cert {
cert { $proxy_cert_name:
ensure => present,
hostname => $hostname,
cname => $cname,
generate => $generate,
regenerate => $regenerate,
deploy => false,
custom_pubkey => $server_cert,
custom_privkey => $server_key,
custom_req => $server_cert_req,
build_dir => $certs::ssl_build_dir,
file { "${proxy_cert_path}.crt":
ensure => file,
source => $server_cert,
owner => 'root',
group => 'root',
mode => '0440',
}
file { "${proxy_cert_path}.key":
ensure => file,
source => $server_key,
owner => 'root',
group => 'root',
mode => '0440',
}

$require_cert = File["${proxy_cert_path}.crt"]
} else {
# cert for ssl of foreman-proxy
cert { $proxy_cert_name:
Expand All @@ -69,6 +75,8 @@
password_file => $ca_key_password_file,
build_dir => $certs::ssl_build_dir,
}

$require_cert = Cert[$proxy_cert_name]
}

# cert for authentication of foreman_proxy against foreman
Expand Down Expand Up @@ -101,7 +109,7 @@
cert_owner => $owner,
cert_group => $group,
cert_mode => $public_key_mode,
require => Cert[$proxy_cert_name],
require => $require_cert,
}

file { $proxy_ca_cert:
Expand Down
27 changes: 27 additions & 0 deletions spec/acceptance/certs_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,4 +124,31 @@ class { 'certs':
it { should_not exist }
end
end

context 'with server CA cert' do
before(:context) do
source_path = "fixtures/example.partial.solutions-chain.pem"
dest_path = "/server-ca.crt"
scp_to(hosts, source_path, dest_path)
end

it_behaves_like 'an idempotent resource' do
let(:manifest) do
<<-PUPPET
class { 'certs':
server_ca_cert => '/server-ca.crt',
}
PUPPET
end
end

describe x509_certificate('/root/ssl-build/katello-server-ca.crt') do
it { should be_certificate }
# Doesn't have to be valid - can be expired since it's a static resource
it { should have_purpose 'CA' }
its(:issuer) { should eq('CN = Fake LE Root X1') }
its(:subject) { should eq('CN = Fake LE Intermediate X1') }
its(:keylength) { should be >= 2048 }
end
end
end