From 02a6d993509ac395165c504dba7b92c4f2eb907c Mon Sep 17 00:00:00 2001
From: Jason DeTiberus <jdetiber@redhat.com>
Date: Fri, 16 Oct 2015 11:28:42 -0400
Subject: Fix etcd cert generation when etcd_interface is defined
- Refactor certificate generation to properly accept overrides of etcd_interface
per host and set the certificate SANS and peer URLs properly.
- Add sanity checking to user-set values of etcd_interface to provide a better
error message
---
roles/etcd_ca/tasks/main.yml | 30 +++++++++++++++---------------
1 file changed, 15 insertions(+), 15 deletions(-)
(limited to 'roles/etcd_ca/tasks')
diff --git a/roles/etcd_ca/tasks/main.yml b/roles/etcd_ca/tasks/main.yml
index 625756867..d32f5e48c 100644
--- a/roles/etcd_ca/tasks/main.yml
+++ b/roles/etcd_ca/tasks/main.yml
@@ -1,14 +1,14 @@
---
- file:
- path: "{{ etcd_ca_dir }}/{{ item }}"
+ path: "{{ item }}"
state: directory
mode: 0700
owner: root
group: root
with_items:
- - certs
- - crl
- - fragments
+ - "{{ etcd_ca_new_certs_dir }}"
+ - "{{ etcd_ca_crl_dir }}"
+ - "{{ etcd_ca_dir }}/fragments"
- command: cp /etc/pki/tls/openssl.cnf ./
args:
@@ -22,25 +22,25 @@
- assemble:
src: "{{ etcd_ca_dir }}/fragments"
- dest: "{{ etcd_ca_dir }}/openssl.cnf"
+ dest: "{{ etcd_openssl_conf }}"
-- command: touch index.txt
+- command: touch {{ etcd_ca_db }}
args:
- chdir: "{{ etcd_ca_dir }}"
- creates: "{{ etcd_ca_dir }}/index.txt"
+ creates: "{{ etcd_ca_db }}"
- copy:
- dest: "{{ etcd_ca_dir }}/serial"
+ dest: "{{ etcd_ca_serial }}"
content: "01"
force: no
- command: >
- openssl req -config openssl.cnf -newkey rsa:4096
- -keyout ca.key -new -out ca.crt -x509 -extensions etcd_v3_ca_self
- -batch -nodes -subj /CN=etcd-signer@{{ ansible_date_time.epoch }}
- -days 365
+ openssl req -config {{ etcd_openssl_conf }} -newkey rsa:4096
+ -keyout {{ etcd_ca_key }} -new -out {{ etcd_ca_cert }}
+ -x509 -extensions {{ etcd_ca_exts_self }} -batch -nodes
+ -days {{ etcd_ca_default_days }}
+ -subj /CN=etcd-signer@{{ ansible_date_time.epoch }}
args:
chdir: "{{ etcd_ca_dir }}"
- creates: "{{ etcd_ca_dir }}/ca.crt"
+ creates: "{{ etcd_ca_cert }}"
environment:
- SAN: ''
+ SAN: 'etcd-signer'
--
cgit v1.2.3