From 5ff3071297b0bd91e5135bbe9def3a59dadfe885 Mon Sep 17 00:00:00 2001 From: Kenny Woodson Date: Fri, 17 Feb 2017 09:34:10 -0500 Subject: Rename of oadm_ca to oc_adm_ca. Decided to whittle down to the direct call, server_cert. --- .../src/ansible/oadm_certificate_authority.py | 48 ------- .../src/ansible/oc_adm_ca_server_cert.py | 36 ++++++ .../src/class/oadm_certificate_authority.py | 110 ---------------- .../src/class/oc_adm_ca_server_cert.py | 104 +++++++++++++++ roles/lib_openshift/src/doc/ca_server_cert | 141 +++++++++++++++++++++ roles/lib_openshift/src/doc/certificate_authority | 141 --------------------- roles/lib_openshift/src/sources.yml | 8 +- 7 files changed, 285 insertions(+), 303 deletions(-) delete mode 100644 roles/lib_openshift/src/ansible/oadm_certificate_authority.py create mode 100644 roles/lib_openshift/src/ansible/oc_adm_ca_server_cert.py delete mode 100644 roles/lib_openshift/src/class/oadm_certificate_authority.py create mode 100644 roles/lib_openshift/src/class/oc_adm_ca_server_cert.py create mode 100644 roles/lib_openshift/src/doc/ca_server_cert delete mode 100644 roles/lib_openshift/src/doc/certificate_authority (limited to 'roles/lib_openshift/src') diff --git a/roles/lib_openshift/src/ansible/oadm_certificate_authority.py b/roles/lib_openshift/src/ansible/oadm_certificate_authority.py deleted file mode 100644 index ad00b25b4..000000000 --- a/roles/lib_openshift/src/ansible/oadm_certificate_authority.py +++ /dev/null @@ -1,48 +0,0 @@ -# pylint: skip-file -# flake8: noqa - -def main(): - ''' - ansible oadm module for ca - ''' - - module = AnsibleModule( - argument_spec=dict( - state=dict(default='present', type='str', choices=['present']), - debug=dict(default=False, type='bool'), - kubeconfig=dict(default='/etc/origin/master/admin.kubeconfig', type='str'), - cmd=dict(default=None, require=True, type='str'), - - # oadm ca create-master-certs [options] - cert_dir=dict(default=None, type='str'), - hostnames=dict(default=[], type='list'), - master=dict(default=None, type='str'), - public_master=dict(default=None, type='str'), - overwrite=dict(default=False, type='bool'), - signer_name=dict(default=None, type='str'), - - # oadm ca create-key-pair [options] - private_key=dict(default=None, type='str'), - public_key=dict(default=None, type='str'), - - # oadm ca create-server-cert [options] - cert=dict(default=None, type='str'), - key=dict(default=None, type='str'), - signer_cert=dict(default=None, type='str'), - signer_key=dict(default=None, type='str'), - signer_serial=dict(default=None, type='str'), - - ), - supports_check_mode=True, - ) - - # pylint: disable=line-too-long - results = CertificateAuthority.run_ansible(module.params, module.check_mode) - if 'failed' in results: - return module.fail_json(**results) - - return module.exit_json(**results) - - -if __name__ == '__main__': - main() diff --git a/roles/lib_openshift/src/ansible/oc_adm_ca_server_cert.py b/roles/lib_openshift/src/ansible/oc_adm_ca_server_cert.py new file mode 100644 index 000000000..91d8c83b0 --- /dev/null +++ b/roles/lib_openshift/src/ansible/oc_adm_ca_server_cert.py @@ -0,0 +1,36 @@ +# pylint: skip-file +# flake8: noqa + +def main(): + ''' + ansible oc adm module for ca create-server-cert + ''' + + module = AnsibleModule( + argument_spec=dict( + state=dict(default='present', type='str', choices=['present']), + debug=dict(default=False, type='bool'), + kubeconfig=dict(default='/etc/origin/master/admin.kubeconfig', type='str'), + cmd=dict(default=None, require=True, type='str'), + # oadm ca create-server-cert [options] + cert=dict(default=None, type='str'), + key=dict(default=None, type='str'), + signer_cert=dict(default=None, type='str'), + signer_key=dict(default=None, type='str'), + signer_serial=dict(default=None, type='str'), + hostnames=dict(default=[], type='list'), + overwrite=dict(default=False, type='bool'), + ), + supports_check_mode=True, + ) + + # pylint: disable=line-too-long + results = CAServerCert.run_ansible(module.params, module.check_mode) + if 'failed' in results: + return module.fail_json(**results) + + return module.exit_json(**results) + + +if __name__ == '__main__': + main() diff --git a/roles/lib_openshift/src/class/oadm_certificate_authority.py b/roles/lib_openshift/src/class/oadm_certificate_authority.py deleted file mode 100644 index 34bd0f0a9..000000000 --- a/roles/lib_openshift/src/class/oadm_certificate_authority.py +++ /dev/null @@ -1,110 +0,0 @@ -# pylint: skip-file - -class CertificateAuthorityConfig(OpenShiftCLIConfig): - ''' CertificateAuthorityConfig is a DTO for the oadm ca command ''' - def __init__(self, cmd, kubeconfig, verbose, ca_options): - super(CertificateAuthorityConfig, self).__init__('ca', None, kubeconfig, ca_options) - self.cmd = cmd - self.kubeconfig = kubeconfig - self.verbose = verbose - self._ca = ca_options - -class CertificateAuthority(OpenShiftCLI): - ''' Class to wrap the oc command line tools ''' - def __init__(self, - config, - verbose=False): - ''' Constructor for oadm ca ''' - super(CertificateAuthority, self).__init__(None, config.kubeconfig, verbose) - self.config = config - self.verbose = verbose - - def get(self): - '''get the current cert file - - If a file exists by the same name in the specified location then the cert exists - ''' - cert = self.config.config_options['cert']['value'] - if cert and os.path.exists(cert): - return open(cert).read() - - return None - - def create(self): - '''Create a deploymentconfig ''' - options = self.config.to_option_list() - - cmd = ['ca'] - cmd.append(self.config.cmd) - cmd.extend(options) - - return self.openshift_cmd(cmd, oadm=True) - - def exists(self): - ''' check whether the certificate exists and has the clusterIP ''' - - cert_path = self.config.config_options['cert']['value'] - if not os.path.exists(cert_path): - return False - - proc = subprocess.Popen(['openssl', 'x509', '-noout', '-subject', '-in', cert_path], - stdout=subprocess.PIPE, stderr=subprocess.PIPE) - stdout, stderr = proc.communicate() - if proc.returncode == 0: - for var in self.config.config_options['hostnames']['value'].split(','): - if var in stdout: - return True - - return False - - @staticmethod - def run_ansible(params, check_mode): - '''run the idempotent ansible code''' - - config = CertificateAuthorityConfig(params['cmd'], - params['kubeconfig'], - params['debug'], - {'cert_dir': {'value': params['cert_dir'], 'include': True}, - 'cert': {'value': params['cert'], 'include': True}, - 'hostnames': {'value': ','.join(params['hostnames']), 'include': True}, - 'master': {'value': params['master'], 'include': True}, - 'public_master': {'value': params['public_master'], 'include': True}, - 'overwrite': {'value': params['overwrite'], 'include': True}, - 'signer_name': {'value': params['signer_name'], 'include': True}, - 'private_key': {'value': params['private_key'], 'include': True}, - 'public_key': {'value': params['public_key'], 'include': True}, - 'key': {'value': params['key'], 'include': True}, - 'signer_cert': {'value': params['signer_cert'], 'include': True}, - 'signer_key': {'value': params['signer_key'], 'include': True}, - 'signer_serial': {'value': params['signer_serial'], 'include': True}, - }) - - - oadm_ca = CertificateAuthority(config) - - state = params['state'] - - if state == 'present': - ######## - # Create - ######## - if not oadm_ca.exists() or params['overwrite']: - - if check_mode: - return {'changed': True, - 'msg': "CHECK_MODE: Would have created the certificate.", - 'state': state} - - api_rval = oadm_ca.create() - - return {'changed': True, 'results': api_rval, 'state': state} - - ######## - # Exists - ######## - api_rval = oadm_ca.get() - return {'changed': False, 'results': api_rval, 'state': state} - - return {'failed': True, - 'msg': 'Unknown state passed. %s' % state} - diff --git a/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py b/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py new file mode 100644 index 000000000..92505c08e --- /dev/null +++ b/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py @@ -0,0 +1,104 @@ +# pylint: skip-file + +class CAServerCertConfig(OpenShiftCLIConfig): + ''' CertificateAuthorityConfig is a DTO for the oadm ca command ''' + def __init__(self, cmd, kubeconfig, verbose, ca_options): + super(CertificateAuthorityConfig, self).__init__('ca', None, kubeconfig, ca_options) + self.cmd = cmd + self.kubeconfig = kubeconfig + self.verbose = verbose + self._ca = ca_options + +class CAServerCert(OpenShiftCLI): + ''' Class to wrap the oc command line tools ''' + def __init__(self, + config, + verbose=False): + ''' Constructor for oadm ca ''' + super(CAServerCert, self).__init__(None, config.kubeconfig, verbose) + self.config = config + self.verbose = verbose + + def get(self): + '''get the current cert file + + If a file exists by the same name in the specified location then the cert exists + ''' + cert = self.config.config_options['cert']['value'] + if cert and os.path.exists(cert): + return open(cert).read() + + return None + + def create(self): + '''run openshift ca cmd''' + options = self.config.to_option_list() + + cmd = ['ca'] + cmd.append(self.config.cmd) + cmd.extend(options) + + return self.openshift_cmd(cmd, oadm=True) + + def exists(self): + ''' check whether the certificate exists and has the clusterIP ''' + + cert_path = self.config.config_options['cert']['value'] + if not os.path.exists(cert_path): + return False + + proc = subprocess.Popen(['openssl', 'x509', '-noout', '-subject', '-in', cert_path], + stdout=subprocess.PIPE, stderr=subprocess.PIPE) + stdout, stderr = proc.communicate() + if proc.returncode == 0: + for var in self.config.config_options['hostnames']['value'].split(','): + if var in stdout: + return True + + return False + + @staticmethod + def run_ansible(params, check_mode): + '''run the idempotent ansible code''' + + config = CAServerCertConfig(params['cmd'], + params['kubeconfig'], + params['debug'], + {'cert': {'value': params['cert'], 'include': True}, + 'hostnames': {'value': ','.join(params['hostnames']), 'include': True}, + 'overwrite': {'value': params['overwrite'], 'include': True}, + 'signer_name': {'value': params['signer_name'], 'include': True}, + 'key': {'value': params['key'], 'include': True}, + 'signer_cert': {'value': params['signer_cert'], 'include': True}, + 'signer_key': {'value': params['signer_key'], 'include': True}, + 'signer_serial': {'value': params['signer_serial'], 'include': True}, + }) + + server_cert = CAServerCert(config) + + state = params['state'] + + if state == 'present': + ######## + # Create + ######## + if not server_cert.exists() or params['overwrite']: + + if check_mode: + return {'changed': True, + 'msg': "CHECK_MODE: Would have created the certificate.", + 'state': state} + + api_rval = server_cert.create() + + return {'changed': True, 'results': api_rval, 'state': state} + + ######## + # Exists + ######## + api_rval = server_cert.get() + return {'changed': False, 'results': api_rval, 'state': state} + + return {'failed': True, + 'msg': 'Unknown state passed. %s' % state} + diff --git a/roles/lib_openshift/src/doc/ca_server_cert b/roles/lib_openshift/src/doc/ca_server_cert new file mode 100644 index 000000000..bf299f0cb --- /dev/null +++ b/roles/lib_openshift/src/doc/ca_server_cert @@ -0,0 +1,141 @@ +# flake8: noqa +# pylint: skip-file + +DOCUMENTATION = ''' +--- +module: oadm_ca +short_description: Module to manage openshift certificate authority +description: + - Wrapper around the openshift `oc adm ca` command. +options: + state: + description: + - Present is the only supported state. The state present means that `oc adm ca` will generate a certificate + - When create-master-certs is desired then the following parameters are passed. + - ['cert_dir', 'hostnames', 'master', 'public_master', 'overwrite', 'signer_name'] + - When create-key-pair is desired then the following parameters are passed. + - ['private_key', 'public_key'] + - When create-server-cert is desired then the following parameters are passed. + - ['cert', 'key', 'signer_cert', 'signer_key', 'signer_serial'] + required: false + default: present + choices: + - present + aliases: [] + kubeconfig: + description: + - The path for the kubeconfig file to use for authentication + required: false + default: /etc/origin/master/admin.kubeconfig + aliases: [] + debug: + description: + - Turn on debug output. + required: false + default: False + aliases: [] + cmd: + description: + - The sub command given for `oc adm ca` + required: false + default: None + choices: + - create-master-certs + - create-key-pair + - create-server-cert + aliases: [] + cert_dir: + description: + - The certificate data directory. + required: false + default: None + aliases: [] + cert: + description: + - The certificate file. Choose a name that indicates what the service is. + required: false + default: None + aliases: [] + key: + description: + - The key file. Choose a name that indicates what the service is. + required: false + default: None + aliases: [] + overwrite: + description: + - Overwrite existing cert files if found. If false, any existing file will be left as-is. + required: false + default: False + aliases: [] + signer_cert: + description: + - The signer certificate file. + required: false + default: None + aliases: [] + signer_key: + description: + - The signer key file. + required: false + default: None + aliases: [] + signer_serial: + description: + - The signer serial file. + required: false + default: None + aliases: [] + public_key: + description: + - The public key file used with create-key-pair + required: false + default: None + aliases: [] + private_key: + description: + - The private key file used with create-key-pair + required: false + default: None + aliases: [] + + hostnames: + description: + - Every hostname or IP that server certs should be valid for (comma-delimited list) + required: false + default: None + aliases: [] + master: + description: + - The API server's URL + required: false + default: None + aliases: [] + public_master: + description: + - The API public facing server's URL (if applicable) + required: false + default: None + aliases: [] + signer_name: + description: + - The name to use for the generated signer + required: false + default: None + aliases: [] +author: +- "Kenny Woodson " +extends_documentation_fragment: [] +''' + +EXAMPLES = ''' +- name: Create a self-signed cert + oadm_ca: + cmd: create-server-cert + signer_cert: /etc/origin/master/ca.crt + signer_key: /etc/origin/master/ca.key + signer_serial: /etc/origin/master/ca.serial.txt + hostnames: "registry.test.openshift.com,127.0.0.1,docker-registry.default.svc.cluster.local" + cert: /etc/origin/master/registry.crt + key: /etc/origin/master/registry.key +''' diff --git a/roles/lib_openshift/src/doc/certificate_authority b/roles/lib_openshift/src/doc/certificate_authority deleted file mode 100644 index bf299f0cb..000000000 --- a/roles/lib_openshift/src/doc/certificate_authority +++ /dev/null @@ -1,141 +0,0 @@ -# flake8: noqa -# pylint: skip-file - -DOCUMENTATION = ''' ---- -module: oadm_ca -short_description: Module to manage openshift certificate authority -description: - - Wrapper around the openshift `oc adm ca` command. -options: - state: - description: - - Present is the only supported state. The state present means that `oc adm ca` will generate a certificate - - When create-master-certs is desired then the following parameters are passed. - - ['cert_dir', 'hostnames', 'master', 'public_master', 'overwrite', 'signer_name'] - - When create-key-pair is desired then the following parameters are passed. - - ['private_key', 'public_key'] - - When create-server-cert is desired then the following parameters are passed. - - ['cert', 'key', 'signer_cert', 'signer_key', 'signer_serial'] - required: false - default: present - choices: - - present - aliases: [] - kubeconfig: - description: - - The path for the kubeconfig file to use for authentication - required: false - default: /etc/origin/master/admin.kubeconfig - aliases: [] - debug: - description: - - Turn on debug output. - required: false - default: False - aliases: [] - cmd: - description: - - The sub command given for `oc adm ca` - required: false - default: None - choices: - - create-master-certs - - create-key-pair - - create-server-cert - aliases: [] - cert_dir: - description: - - The certificate data directory. - required: false - default: None - aliases: [] - cert: - description: - - The certificate file. Choose a name that indicates what the service is. - required: false - default: None - aliases: [] - key: - description: - - The key file. Choose a name that indicates what the service is. - required: false - default: None - aliases: [] - overwrite: - description: - - Overwrite existing cert files if found. If false, any existing file will be left as-is. - required: false - default: False - aliases: [] - signer_cert: - description: - - The signer certificate file. - required: false - default: None - aliases: [] - signer_key: - description: - - The signer key file. - required: false - default: None - aliases: [] - signer_serial: - description: - - The signer serial file. - required: false - default: None - aliases: [] - public_key: - description: - - The public key file used with create-key-pair - required: false - default: None - aliases: [] - private_key: - description: - - The private key file used with create-key-pair - required: false - default: None - aliases: [] - - hostnames: - description: - - Every hostname or IP that server certs should be valid for (comma-delimited list) - required: false - default: None - aliases: [] - master: - description: - - The API server's URL - required: false - default: None - aliases: [] - public_master: - description: - - The API public facing server's URL (if applicable) - required: false - default: None - aliases: [] - signer_name: - description: - - The name to use for the generated signer - required: false - default: None - aliases: [] -author: -- "Kenny Woodson " -extends_documentation_fragment: [] -''' - -EXAMPLES = ''' -- name: Create a self-signed cert - oadm_ca: - cmd: create-server-cert - signer_cert: /etc/origin/master/ca.crt - signer_key: /etc/origin/master/ca.key - signer_serial: /etc/origin/master/ca.serial.txt - hostnames: "registry.test.openshift.com,127.0.0.1,docker-registry.default.svc.cluster.local" - cert: /etc/origin/master/registry.crt - key: /etc/origin/master/registry.key -''' diff --git a/roles/lib_openshift/src/sources.yml b/roles/lib_openshift/src/sources.yml index 7f0de6a65..b49f7b490 100644 --- a/roles/lib_openshift/src/sources.yml +++ b/roles/lib_openshift/src/sources.yml @@ -1,13 +1,13 @@ --- -oadm_ca.py: +oc_adm_ca_server_cert.py: - doc/generated - doc/license - lib/import.py -- doc/certificate_authority +- doc/ca_server_cert - ../../lib_utils/src/class/yedit.py - lib/base.py -- class/oadm_certificate_authority.py -- ansible/oadm_certificate_authority.py +- class/oc_adm_ca_server_cert.py +- ansible/oc_adm_ca_server_cert.py oadm_manage_node.py: - doc/generated -- cgit v1.2.3