ExternalMirrors
/
salt-formula
mirror of https://github.com/salt-formulas/salt-formula-salt
Watch 1
Star 0
Fork 0
Code Issues 0 Releases 7 Wiki Activity
New version of salt-formula from Saltstack
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
219 Commits
26 Branches
Tree: b38c992eed
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'b38c992eed'
${ noResults }
salt-formula/salt/minion/cert.sls

259 lines
7.7KB
Raw Blame History 

  1. {%- from "salt/map.jinja" import minion with context %}

  2. 

  3. {%- if minion.enabled %}

  4. 

  5. {%- if grains.os_family == 'RedHat' %}

  6. {%- set cacerts_dir='/etc/pki/ca-trust/source/anchors' %}

  7. {%- else %}

  8. {%- set cacerts_dir='/usr/local/share/ca-certificates' %}

  9. {%- endif %}

  10. 

  11. {%- if minion.cert is defined %}

  12. 

  13. {%- set created_ca_files = [] %}

  14. {%- set created_ca_key_files = [] %}

  15. 

  16. {%- for cert_name,cert in minion.get('cert', {}).iteritems() %}

  17. {%- set rowloop = loop %}

  18. 

  19. {%- set key_file  = cert.get('key_file', '/etc/ssl/private/' + cert.common_name + '.key') %}

  20. {%- set cert_file = cert.get('cert_file', '/etc/ssl/certs/' + cert.common_name + '.crt') %}

  21. {%- set ca_file = cert.get('ca_file', '/etc/ssl/certs/ca-' + cert.authority + '.crt') %}

  22. {%- set ca_key_file = cert.get('ca_key_file', '/etc/ssl/certs/ca-' + cert.authority + '.key') %}

  23. {%- set key_dir = salt['file.dirname'](key_file) %}

  24. {%- set cert_dir = salt['file.dirname'](cert_file) %}

  25. {%- set ca_dir = salt['file.dirname'](ca_file) %}

  26. {%- set ca_key_dir = salt['file.dirname'](ca_key_file) %}

  27. 

  28. {# Only ensure directories exists, don't touch permissions, etc. #}

  29. salt_minion_cert_{{ cert_name }}_dirs:

  30.   file.directory:

  31.     - names:

  32.       - {{ key_dir }}

  33.       - {{ cert_dir }}

  34.       - {{ ca_dir }}

  35.       - {{ ca_key_dir }}

  36.     - makedirs: true

  37.     - replace: false

  38. 

  39. {{ key_file }}:

  40.   x509.private_key_managed:

  41.     - bits: {{ cert.get('bits', 4096) }}

  42.     - require:

  43.       - file: salt_minion_cert_{{ cert_name }}_dirs

  44.     {%- if cert.all_file is defined %}

  45.     - watch_in:

  46.       - cmd: salt_minion_cert_{{ cert_name }}_all

  47.     {%- endif %}

  48. 

  49. {{ key_file }}_key_permissions:

  50.   file.managed:

  51.     - name: {{ key_file }}

  52.     - mode: {{ cert.get("mode", 0600) }}

  53.     {%- if salt['user.info'](cert.get("user", "root")) %}

  54.     - user: {{ cert.get("user", "root") }}

  55.     {%- endif %}

  56.     {%- if salt['group.info'](cert.get("group", "root")) %}

  57.     - group: {{ cert.get("group", "root") }}

  58.     {%- endif %}

  59.     - replace: false

  60.     - watch:

  61.       - x509: {{ key_file }}

  62. 

  63. {{ cert_file }}:

  64.   x509.certificate_managed:

  65.     {% if cert.host is defined %}- ca_server: {{ cert.host }}{%- endif %}

  66.     {% if cert.authority is defined and cert.signing_policy is defined %}

  67.     - signing_policy: {{ cert.authority }}_{{ cert.signing_policy }}

  68.     {%- endif %}

  69.     - public_key: {{ key_file }}

  70.     - CN: "{{ cert.common_name }}"

  71.     {% if cert.state is defined %}- ST: {{ cert.state }}{%- endif %}

  72.     {% if cert.country is defined %}- C: {{ cert.country }}{%- endif %}

  73.     {% if cert.locality is defined %}- L: {{ cert.locality }}{%- endif %}

  74.     {% if cert.organization is defined %}- O: {{ cert.organization }}{%- endif %}

  75.     {% if cert.signing_private_key is defined and cert.signing_cert is defined %}

  76.     - signing_private_key: "{{ cert.signing_private_key }}"

  77.     - signing_cert: "{{ cert.signing_cert }}"

  78.     {%- endif %}

  79.     {% if cert.alternative_names is defined %}

  80.     - subjectAltName: "{{ cert.alternative_names }}"

  81.     {%- endif %}

  82.     {%- if cert.extended_key_usage is defined %}

  83.     - extendedKeyUsage: "{{ cert.extended_key_usage }}"

  84.     {%- endif %}

  85.     {%- if cert.key_usage is defined %}

  86.     - keyUsage: "{{ cert.key_usage }}"

  87.     {%- endif %}

  88.     - days_remaining: 30

  89.     - backup: True

  90.     - watch:

  91.       - x509: {{ key_file }}

  92.     {%- if cert.all_file is defined %}

  93.     - watch_in:

  94.       - cmd: salt_minion_cert_{{ cert_name }}_all

  95.     {%- endif %}

  96. 

  97. {{ cert_file }}_cert_permissions:

  98.   file.managed:

  99.     - name: {{ cert_file }}

  100.     - mode: {{ cert.get("mode", 0600) }}

  101.     {%- if salt['user.info'](cert.get("user", "root")) %}

  102.     - user: {{ cert.get("user", "root") }}

  103.     {%- endif %}

  104.     {%- if salt['group.info'](cert.get("group", "root")) %}

  105.     - group: {{ cert.get("group", "root") }}

  106.     {%- endif %}

  107.     - replace: false

  108.     - watch:

  109.       - x509: {{ cert_file }}

  110. 

  111. {%- if cert.host is defined and ca_file not in created_ca_files %}

  112. {%- for ca_path,ca_cert in salt['mine.get'](cert.host, 'x509.get_pem_entries').get(cert.host, {}).iteritems() %}

  113. 

  114. {%- if '/etc/pki/ca/'+cert.authority in ca_path %}

  115. 

  116. {{ ca_file }}:

  117.   x509.pem_managed:

  118.     - name: {{ ca_file }}

  119.     - text: {{ ca_cert|replace('\n', '') }}

  120.     - watch:

  121.       - x509: {{ cert_file }}

  122.     {%- if cert.all_file is defined %}

  123.     - watch_in:

  124.       - cmd: salt_minion_cert_{{ cert_name }}_all

  125.     {%- endif %}

  126. 

  127. 

  128. {{ ca_file }}_cert_permissions:

  129.   file.managed:

  130.     - name: {{ ca_file }}

  131.     - mode: 0644

  132.     {%- if salt['user.info'](cert.get("user", "root")) %}

  133.     - user: {{ cert.get("user", "root") }}

  134.     {%- endif %}

  135.     {%- if salt['group.info'](cert.get("group", "root")) %}

  136.     - group: {{ cert.get("group", "root") }}

  137.     {%- endif %}

  138.     - watch:

  139.       - x509: {{ ca_file }}

  140. 

  141. {%- endif %}

  142. 

  143. {%- endfor %}

  144. 

  145. {%- do created_ca_files.append(ca_file) %}

  146. {%- endif %}

  147. 

  148. {%- if cert.host is defined and ca_key_file not in created_ca_key_files %}

  149. {%- for ca_key_path,ca_key in salt['mine.get'](cert.host, 'x509_get_private_key').get(cert.host, {}).iteritems() %}

  150. 

  151. {%- if '/etc/pki/ca/'+cert.authority in ca_key_path %}

  152. 

  153. {{ ca_key_file }}:

  154.   x509.pem_managed:

  155.     - name: {{ ca_key_file }}

  156.     - text: {{ ca_key|replace('\n', '') }}

  157.     - watch:

  158.       - x509: {{ cert_file }}

  159. 

  160. {{ ca_key_file }}_cert_permissions:

  161.   file.managed:

  162.     - name: {{ ca_key_file }}

  163.     - mode: 0644

  164.     {%- if salt['user.info'](cert.get("user", "root")) %}

  165.     - user: {{ cert.get("user", "root") }}

  166.     {%- endif %}

  167.     {%- if salt['group.info'](cert.get("group", "root")) %}

  168.     - group: {{ cert.get("group", "root") }}

  169.     {%- endif %}

  170.     - watch:

  171.       - x509: {{ ca_key_file }}

  172. 

  173. {%- endif %}

  174. 

  175. {%- endfor %}

  176. 

  177. {%- do created_ca_key_files.append(ca_key_file) %}

  178. {%- endif %}

  179. 

  180. {%- if cert.all_file is defined %}

  181. 

  182. salt_minion_cert_{{ cert_name }}_all:

  183.   cmd.wait:

  184.     - name: cat {{ key_file }} {{ cert_file }} {{ ca_file }} > {{ cert.all_file }}

  185. 

  186. {{ cert.all_file }}_cert_permissions:

  187.   file.managed:

  188.     - name: {{ cert.all_file }}

  189.     - mode: {{ cert.get("mode", 0600) }}

  190.     {%- if salt['user.info'](cert.get("user", "root")) %}

  191.     - user: {{ cert.get("user", "root") }}

  192.     {%- endif %}

  193.     {%- if salt['group.info'](cert.get("group", "root")) %}

  194.     - group: {{ cert.get("group", "root") }}

  195.     {%- endif %}

  196.     - replace: false

  197.     - watch:

  198.       - cmd: salt_minion_cert_{{ cert_name }}_all

  199. {%- endif %}

  200. 

  201. {%- endfor %}

  202. 

  203. {%- endif %}

  204. 

  205. salt_ca_certificates_packages:

  206.   pkg.installed:

  207. {%- if grains.os_family == 'Debian' %}

  208.     - name: ca-certificates

  209. {%- elif grains.os_family == 'RedHat' %}

  210.     - name: ca-certificates

  211. {%- else %}

  212.     - name: []

  213. {%- endif %}

  214. 

  215. salt_update_certificates:

  216.   cmd.wait:

  217. {%- if grains.os_family == 'Debian' %}

  218.     - name: "update-ca-certificates{% if minion.get('ca_certificates_cleanup') %} --fresh {% endif %}"

  219. {%- elif grains.os_family == 'RedHat' %}

  220.     - name: "update-ca-trust extract"

  221. {%- else %}

  222.     - name: true

  223. {%- endif %}

  224.     - require:

  225.       - pkg: salt_ca_certificates_packages

  226. 

  227. {%- if minion.get('trust_salt_ca', True) %}

  228. 

  229. {%- for trusted_ca_minion in minion.get('trusted_ca_minions', []) %}

  230. {%- for ca_host, certs in salt['mine.get'](trusted_ca_minion+'*', 'x509.get_pem_entries').iteritems() %}

  231. {%- for ca_path, ca_cert in certs.iteritems() %}

  232. {%- if ca_path.startswith('/etc/pki/ca/') and ca_path.endswith('ca.crt') %}

  233. 

  234. {# authority name can be obtained only from a cacert path in case of mine.get #}

  235. {%- set ca_authority = ca_path.split("/")[4] %}

  236. {%- set cacert_file="%s/ca-%s.crt" % (cacerts_dir,ca_authority) %}

  237. 

  238. salt_trust_ca_{{ cacert_file }}:

  239.   x509.pem_managed:

  240.     - name: {{ cacert_file }}

  241.     - text: {{ ca_cert|replace('\n', '') }}

  242.     - makedirs: True

  243.     - watch_in:

  244.       - file: salt_trust_ca_{{ cacert_file }}_permissions

  245.       - cmd: salt_update_certificates

  246. 

  247. salt_trust_ca_{{ cacert_file }}_permissions:

  248.   file.managed:

  249.     - name: {{ cacert_file }}

  250.     - mode: 0444

  251. 

  252. {%- endif %}

  253. {%- endfor %}

  254. {%- endfor %}

  255. {%- endfor %}

  256. {%- endif %}

  257. 

  258. {%- endif %}