Split installation into three distinct phases #119
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,143 @@ | ||
| - name: Generate certificates | ||
| become: true | ||
| hosts: | ||
| - quadlet | ||
| vars_files: | ||
| - "../vars/{{ certificate_source }}_certificates.yml" | ||
| vars: | ||
| certificate_source: default | ||
| certificates_hostnames: | ||
| - "{{ ansible_fqdn }}" | ||
| - localhost | ||
| certificates_ca_password: "CHANGEME" | ||
| roles: | ||
| - role: certificates | ||
| when: "certificate_source == 'default'" | ||
| - role: certificate_checks | ||
| vars: | ||
| certificate_checks_certificate: "{{ server_certificate }}" | ||
| certificate_checks_key: "{{ server_key }}" | ||
| certificate_checks_ca: "{{ ca_certificate }}" | ||
|
|
||
| - name: Install server | ||
| become: true | ||
| hosts: | ||
| - quadlet | ||
| vars_files: | ||
| - "../vars/{{ certificate_source }}_certificates.yml" | ||
| - "../vars/images.yml" | ||
| vars: | ||
| certificate_source: default | ||
| candlepin_db_password: "CHANGEME" | ||
| candlepin_keystore_password: "CHANGEME" | ||
| candlepin_oauth_secret: "CHANGEME" | ||
| candlepin_ca_key_password: "{{ ca_key_password }}" | ||
| candlepin_ca_key: "{{ ca_key }}" | ||
| candlepin_ca_certificate: "{{ ca_certificate }}" | ||
| candlepin_tomcat_key: "{{ localhost_key }}" | ||
| candlepin_tomcat_certificate: "{{ localhost_certificate }}" | ||
| candlepin_client_key: "{{ client_key }}" | ||
| candlepin_client_certificate: "{{ client_certificate }}" | ||
| foreman_ca_certificate: "{{ ca_certificate }}" | ||
| foreman_client_key: "{{ client_key }}" | ||
| foreman_client_certificate: "{{ client_certificate }}" | ||
| foreman_db_password: "CHANGEME" | ||
| foreman_oauth_consumer_key: abcdefghijklmnopqrstuvwxyz123456 | ||
| foreman_oauth_consumer_secret: abcdefghijklmnopqrstuvwxyz123456 | ||
| httpd_server_ca_certificate: "{{ ca_certificate }}" | ||
| httpd_client_ca_certificate: "{{ ca_certificate }}" | ||
| httpd_server_certificate: "{{ server_certificate }}" | ||
| httpd_server_key: "{{ server_key }}" | ||
| pulp_db_password: "CHANGEME" | ||
| pulp_content_origin: "https://{{ ansible_fqdn }}" | ||
| pulp_pulp_url: "https://{{ ansible_fqdn }}" | ||
| postgresql_restarted_state: started | ||
| postgresql_databases: | ||
| - name: candlepin | ||
| owner: candlepin | ||
| - name: foreman | ||
| owner: foreman | ||
| - name: pulp | ||
| owner: pulp | ||
| postgresql_users: | ||
| - name: candlepin | ||
| password: "{{ candlepin_db_password }}" | ||
| - name: foreman | ||
| password: "{{ foreman_db_password }}" | ||
| - name: pulp | ||
| password: "{{ pulp_db_password }}" | ||
| postgresql_hba_entries: | ||
| - { type: local, database: all, user: postgres, auth_method: ident } | ||
| - { type: local, database: all, user: all, auth_method: ident } | ||
| - { type: host, database: all, user: postgres, address: '127.0.0.1/32', auth_method: md5 } | ||
| - { type: host, database: all, user: postgres, address: '0.0.0.0/0', auth_method: reject } | ||
| - { type: host, database: all, user: all, address: '127.0.0.1/32', auth_method: md5 } | ||
| - { type: host, database: all, user: all, address: '::1/128', auth_method: md5 } | ||
| roles: | ||
| - geerlingguy.postgresql | ||
| - redis | ||
| - candlepin | ||
| - httpd | ||
| - pulp | ||
| - foreman | ||
|
|
||
| - name: Install smart-proxy | ||
| become: true | ||
| hosts: | ||
| - quadlet | ||
| vars_files: | ||
| - "../vars/{{ certificate_source }}_certificates.yml" | ||
| vars: | ||
| certificate_source: default | ||
| foreman_oauth_consumer_key: abcdefghijklmnopqrstuvwxyz123456 | ||
| foreman_oauth_consumer_secret: abcdefghijklmnopqrstuvwxyz123456 | ||
| pre_tasks: | ||
| - name: Enable foreman-installer PR 1016 Copr repo | ||
| community.general.copr: | ||
| host: copr.fedorainfracloud.org | ||
| state: enabled | ||
| name: packit/theforeman-foreman-installer-1016 | ||
| chroot: rhel-9-x86_64 | ||
|
|
||
| - ansible.builtin.include_role: | ||
| name: theforeman.operations.puppet_repositories | ||
| vars: | ||
| foreman_puppet_repositories_version: "8" | ||
|
|
||
| - ansible.builtin.include_role: | ||
| name: theforeman.operations.foreman_repositories | ||
| vars: | ||
| foreman_repositories_version: nightly | ||
| foreman_repositories_katello_version: nightly | ||
|
|
||
| - name: Install foreman-proxy | ||
| package: | ||
| name: foreman-proxy | ||
|
|
||
| - name: Deploy default certificates | ||
| ansible.builtin.copy: | ||
| src: "{{ item.value }}" | ||
| dest: "{{ item.key }}" | ||
| remote_src: true | ||
| owner: foreman-proxy | ||
| group: foreman-proxy | ||
| mode: 440 | ||
| loop: "{{ certs | dict2items }}" | ||
| vars: | ||
| certs: | ||
| '/etc/foreman-proxy/foreman_ssl_ca.pem': "{{ ca_certificate }}" | ||
| '/etc/foreman-proxy/foreman_ssl_cert.pem': "{{ client_certificate }}" | ||
| '/etc/foreman-proxy/foreman_ssl_key.pem': "{{ client_key }}" | ||
| '/etc/foreman-proxy/ssl_ca.pem': "{{ ca_certificate }}" | ||
| '/etc/foreman-proxy/ssl_cert.pem': "{{ server_certificate }}" | ||
| '/etc/foreman-proxy/ssl_key.pem': "{{ server_key }}" | ||
| roles: | ||
| - role: theforeman.operations.installer | ||
| vars: | ||
| foreman_installer_scenario: katello | ||
| foreman_installer_package: foreman-installer-katello | ||
| foreman_installer_options: | ||
| - '--foreman-proxy-oauth-consumer-key {{ foreman_oauth_consumer_key }}' | ||
| - '--foreman-proxy-oauth-consumer-secret {{ foreman_oauth_consumer_secret }}' | ||
| - '--no-enable-katello' | ||
| - '--tuning development' | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| # utilize https://github.com/theforeman/foreman-installer/pull/935 | ||
| - name: Generate certs | ||
| ansible.builtin.command: foreman-certs --apache true --foreman true --candlepin true --foreman-proxy true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Assuming this is temporarily, given the current installer can't deal well with "proxy only certs for the internal proxy" scenario, what would be the most elegant way for us to pass those certs on?
Part of me wants to say "the tarball we have for external proxies is nice", but given that we don't need to transfer it across systems, it's not strictly required to be a single file (which adds complexity).
We could set the API to be "a folder with a specified structure" (think like the one in ssl-build), but put it soemwhere like
/var/lib/foreman-certsand it either gets fed byforeman-certscli or thecertificatesrole, and then everyone can just pick up things from there.For the external proxy we'd then tar things up that resemble the same structure and off we go.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is tricky because there is this unfun orchestration that has to happen as shown here. The certificates need to be deployed to a location with the correct ownership (user/group/mode) access by foreman-proxy. Which means the foreman-proxy RPM needs to be installed or something needs to ensure creation of them.
For foreman-installer based certificates, I proposed fixing that with this class https://github.com/theforeman/puppet-certs/pull/449/files#diff-e6327449f108163297d1ce69ca08f3a4d8013b01d772a4be3aba628b223bd8c5 and adding it to the answers file. This wouldn't solve it for the new certificate generation though.
I was also thinking of adding certificate "management" to puppet-foreman_proxy based on a parameter so that the module could ensure the right user/group and permissions are ensured on the certificates. I tried this idea out like 4 years ago -- theforeman/puppet-foreman_proxy#599
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I updated theforeman/puppet-foreman_proxy#599 idea to our current certificates approach.