ExternalMirrors
/
salt-formula
mirror of https://github.com/salt-formulas/salt-formula-salt
Watch 1
Star 0
Fork 0
Code Issues 0 Releases 7 Wiki Activity
New version of salt-formula from Saltstack
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
367 Commits
26 Branches
Tree: eb45892b34
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'eb45892b34'
${ noResults }
salt-formula/salt/minion/cert.sls

226 lines
7.0KB
Raw Blame History 

  1. {%- from "salt/map.jinja" import minion with context %}

  2. 

  3. {%- if minion.enabled %}

  4. 

  5. {%- if grains.os_family == 'RedHat' %}

  6. {%- set cacerts_dir='/etc/pki/ca-trust/source/anchors' %}

  7. {%- else %}

  8. {%- set cacerts_dir='/usr/local/share/ca-certificates' %}

  9. {%- endif %}

  10. 

  11. {%- if minion.cert is defined %}

  12. 

  13. {%- set created_ca_files = [] %}

  14. 

  15. {%- for cert_name,cert in minion.get('cert', {}).iteritems() %}

  16. {%- set rowloop = loop %}

  17. 

  18. {%- set key_file  = cert.get('key_file', '/etc/ssl/private/' + cert.common_name + '.key') %}

  19. {%- set cert_file = cert.get('cert_file', '/etc/ssl/certs/' + cert.common_name + '.crt') %}

  20. {%- set ca_file = cert.get('ca_file', '/etc/ssl/certs/ca-' + cert.authority + '.crt') %}

  21. {%- set key_dir = salt['file.dirname'](key_file) %}

  22. {%- set cert_dir = salt['file.dirname'](cert_file) %}

  23. {%- set ca_dir = salt['file.dirname'](ca_file) %}

  24. 

  25. {# Only ensure directories exists, don't touch permissions, etc. #}

  26. salt_minion_cert_{{ cert_name }}_dirs:

  27.   file.directory:

  28.     - names:

  29.       - {{ key_dir }}

  30.       - {{ cert_dir }}

  31.       - {{ ca_dir }}

  32.     - makedirs: true

  33.     - replace: false

  34. 

  35. {{ key_file }}:

  36.   x509.private_key_managed:

  37.     - bits: {{ cert.get('bits', 4096) }}

  38.     - require:

  39.       - file: salt_minion_cert_{{ cert_name }}_dirs

  40.     {%- if cert.all_file is defined %}

  41.     - watch_in:

  42.       - cmd: salt_minion_cert_{{ cert_name }}_all

  43.     {%- endif %}

  44. 

  45. # TODO: Squash this with the previous state after switch to Salt version >= 2016.11.2

  46. {{ key_file }}_key_permissions:

  47.   file.managed:

  48.     - name: {{ key_file }}

  49.     - mode: {{ cert.get("mode", 0600) }}

  50.     {%- if salt['user.info'](cert.get("user", "root")) %}

  51.     - user: {{ cert.get("user", "root") }}

  52.     {%- endif %}

  53.     {%- if salt['group.info'](cert.get("group", "root")) %}

  54.     - group: {{ cert.get("group", "root") }}

  55.     {%- endif %}

  56.     - replace: false

  57.     - require:

  58.       - x509: {{ key_file }}

  59. 

  60. {{ cert_file }}:

  61.   x509.certificate_managed:

  62.     {% if cert.host is defined %}- ca_server: {{ cert.host }}{%- endif %}

  63.     {% if cert.authority is defined and cert.signing_policy is defined %}

  64.     - signing_policy: {{ cert.authority }}_{{ cert.signing_policy }}

  65.     {%- endif %}

  66.     - public_key: {{ key_file }}

  67.     - CN: "{{ cert.common_name }}"

  68.     {% if cert.state is defined %}- ST: {{ cert.state }}{%- endif %}

  69.     {% if cert.country is defined %}- C: {{ cert.country }}{%- endif %}

  70.     {% if cert.locality is defined %}- L: {{ cert.locality }}{%- endif %}

  71.     {% if cert.organization is defined %}- O: {{ cert.organization }}{%- endif %}

  72.     {% if cert.organization_name is defined %}- organizationName: {{ cert.organization_name }}{%- endif %}

  73.     {% if cert.signing_private_key is defined and cert.signing_cert is defined %}

  74.     - signing_private_key: "{{ cert.signing_private_key }}"

  75.     - signing_cert: "{{ cert.signing_cert }}"

  76.     {%- endif %}

  77.     {% if cert.alternative_names is defined %}

  78.     - subjectAltName: "{{ cert.alternative_names }}"

  79.     {%- endif %}

  80.     {%- if cert.extended_key_usage is defined %}

  81.     - extendedKeyUsage: "{{ cert.extended_key_usage }}"

  82.     {%- endif %}

  83.     {%- if cert.key_usage is defined %}

  84.     - keyUsage: "{{ cert.key_usage }}"

  85.     {%- endif %}

  86.     - days_remaining: 30

  87.     - backup: True

  88.     - watch:

  89.       - x509: {{ key_file }}

  90.     {%- if cert.all_file is defined %}

  91.     - watch_in:

  92.       - cmd: salt_minion_cert_{{ cert_name }}_all

  93.     {%- endif %}

  94.     {%- if grains['saltversioninfo'][0] >= 2017 %}

  95.     - retry:

  96.         attepmts: 5

  97.         until: True

  98.         interval: 60

  99.     {%- endif %}

  100. 

  101. # TODO: Squash this with the previous state after switch to Salt version >= 2016.11.2

  102. {{ cert_file }}_cert_permissions:

  103.   file.managed:

  104.     - name: {{ cert_file }}

  105.     - mode: {{ cert.get("mode", 0600) }}

  106.     {%- if salt['user.info'](cert.get("user", "root")) %}

  107.     - user: {{ cert.get("user", "root") }}

  108.     {%- endif %}

  109.     {%- if salt['group.info'](cert.get("group", "root")) %}

  110.     - group: {{ cert.get("group", "root") }}

  111.     {%- endif %}

  112.     - replace: false

  113.     - require:

  114.       - x509: {{ cert_file }}

  115. 

  116. {%- if cert.host is defined and ca_file not in created_ca_files %}

  117. {%- for ca_path,ca_cert in salt['mine.get'](cert.host, 'x509.get_pem_entries').get(cert.host, {}).iteritems() %}

  118. 

  119. {%- if '/etc/pki/ca/'+cert.authority in ca_path %}

  120. 

  121. {{ ca_file }}:

  122.   x509.pem_managed:

  123.     - name: {{ ca_file }}

  124.     - text: {{ ca_cert|replace('\n', '') }}

  125.     - watch:

  126.       - x509: {{ cert_file }}

  127.     {%- if cert.all_file is defined %}

  128.     - watch_in:

  129.       - cmd: salt_minion_cert_{{ cert_name }}_all

  130.     {%- endif %}

  131. 

  132. 

  133. # TODO: Squash this with the previous state after switch to Salt version >= 2016.11.2

  134. {{ ca_file }}_cert_permissions:

  135.   file.managed:

  136.     - name: {{ ca_file }}

  137.     - mode: 0644

  138.     {%- if salt['user.info'](cert.get("user", "root")) %}

  139.     - user: {{ cert.get("user", "root") }}

  140.     {%- endif %}

  141.     {%- if salt['group.info'](cert.get("group", "root")) %}

  142.     - group: {{ cert.get("group", "root") }}

  143.     {%- endif %}

  144.     - require:

  145.       - x509: {{ ca_file }}

  146. 

  147. {%- endif %}

  148. 

  149. {%- endfor %}

  150. 

  151. {%- do created_ca_files.append(ca_file) %}

  152. {%- endif %}

  153. 

  154. {%- if cert.all_file is defined %}

  155. 

  156. salt_minion_cert_{{ cert_name }}_all:

  157.   cmd.wait:

  158.     - name: cat {{ key_file }} {{ cert_file }} {{ ca_file }} > {{ cert.all_file }}

  159. 

  160. {{ cert.all_file }}_cert_permissions:

  161.   file.managed:

  162.     - name: {{ cert.all_file }}

  163.     - mode: {{ cert.get("mode", 0600) }}

  164.     {%- if salt['user.info'](cert.get("user", "root")) %}

  165.     - user: {{ cert.get("user", "root") }}

  166.     {%- endif %}

  167.     {%- if salt['group.info'](cert.get("group", "root")) %}

  168.     - group: {{ cert.get("group", "root") }}

  169.     {%- endif %}

  170.     - replace: false

  171.     - require:

  172.       - cmd: salt_minion_cert_{{ cert_name }}_all

  173. {%- endif %}

  174. 

  175. {%- endfor %}

  176. 

  177. {%- endif %}

  178. 

  179. salt_ca_certificates_packages:

  180.   pkg.installed:

  181.     - names: {{ minion.cert_pkgs }}

  182. 

  183. salt_update_certificates:

  184.   cmd.wait:

  185. {%- if grains.os_family == 'Debian' %}

  186.     - name: "update-ca-certificates{% if minion.get('ca_certificates_cleanup') %} --fresh {% endif %}"

  187. {%- elif grains.os_family == 'RedHat' %}

  188.     - name: "update-ca-trust extract"

  189. {%- else %}

  190.     - name: true

  191. {%- endif %}

  192.     - require:

  193.       - pkg: salt_ca_certificates_packages

  194. 

  195. {%- if minion.get('trust_salt_ca', True) %}

  196. 

  197. {%- for trusted_ca_minion in minion.get('trusted_ca_minions', []) %}

  198. {%- for ca_host, certs in salt['mine.get'](trusted_ca_minion+'*', 'x509.get_pem_entries').iteritems() %}

  199. {%- for ca_path, ca_cert in certs.iteritems() %}

  200. {%- if ca_path.endswith('ca.crt') %}

  201. 

  202. {# authority name can be obtained only from a cacert path in case of mine.get #}

  203. {%- set ca_authority = ca_path.split("/")[-2] %}

  204. {%- set cacert_file="%s/ca-%s.crt" % (cacerts_dir,ca_authority) %}

  205. 

  206. salt_trust_ca_{{ cacert_file }}:

  207.   x509.pem_managed:

  208.     - name: {{ cacert_file }}

  209.     - text: {{ ca_cert|replace('\n', '') }}

  210.     - watch_in:

  211.       - file: salt_trust_ca_{{ cacert_file }}_permissions

  212.       - cmd: salt_update_certificates

  213. 

  214. salt_trust_ca_{{ cacert_file }}_permissions:

  215.   file.managed:

  216.     - name: {{ cacert_file }}

  217.     - mode: 0444

  218. 

  219. {%- endif %}

  220. {%- endfor %}

  221. {%- endfor %}

  222. {%- endfor %}

  223. {%- endif %}

  224. 

  225. {%- endif %}