From 6d7ca91fc4ddd7b40c8b7e9983a9a4b475f72214 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juraci=20Paix=C3=A3o=20Kr=C3=B6hling?= <juraci@kroehling.de>
Date: Wed, 15 Mar 2017 10:23:20 +0100
Subject: Switched Cassandra to use certificates generated by OpenShift

---
 .../tasks/generate_hawkular_certificates.yaml      | 51 ++++++----------------
 .../openshift_metrics/tasks/import_jks_certs.yaml  | 19 +-------
 2 files changed, 15 insertions(+), 55 deletions(-)

(limited to 'roles/openshift_metrics/tasks')

diff --git a/roles/openshift_metrics/tasks/generate_hawkular_certificates.yaml b/roles/openshift_metrics/tasks/generate_hawkular_certificates.yaml
index 61a240a33..01fc1ef64 100644
--- a/roles/openshift_metrics/tasks/generate_hawkular_certificates.yaml
+++ b/roles/openshift_metrics/tasks/generate_hawkular_certificates.yaml
@@ -13,9 +13,6 @@
     hostnames: hawkular-cassandra
   changed_when: no
 
-- slurp: src={{ mktemp.stdout }}/hawkular-cassandra-truststore.pwd
-  register: cassandra_truststore_password
-
 - slurp: src={{ mktemp.stdout }}/hawkular-metrics-truststore.pwd
   register: hawkular_truststore_password
 
@@ -67,11 +64,8 @@
   - hawkular-metrics.pwd
   - hawkular-metrics.htpasswd
   - hawkular-cassandra.crt
+  - hawkular-cassandra.key
   - hawkular-cassandra.pem
-  - hawkular-cassandra.keystore
-  - hawkular-cassandra-keystore.pwd
-  - hawkular-cassandra.truststore
-  - hawkular-cassandra-truststore.pwd
   changed_when: false
 
 - set_fact:
@@ -136,38 +130,21 @@
 - name: generate cassandra secret template
   template:
     src: secret.j2
-    dest: "{{ mktemp.stdout }}/templates/cassandra_secrets.yaml"
+    dest: "{{ mktemp.stdout }}/templates/hawkular-cassandra-certs.yaml"
   vars:
-    name: hawkular-cassandra-secrets
+    name: hawkular-cassandra-certs
     labels:
-      metrics-infra: hawkular-cassandra
+      metrics-infra: hawkular-cassandra-certs
+    annotations:
+      service.alpha.openshift.io/originating-service-name: hawkular-cassandra
     data:
-      cassandra.keystore: >
-        {{ hawkular_secrets['hawkular-cassandra.keystore'] }}
-      cassandra.keystore.password: >
-        {{ hawkular_secrets['hawkular-cassandra-keystore.pwd'] }}
-      cassandra.keystore.alias: "{{ 'hawkular-cassandra'|b64encode }}"
-      cassandra.truststore: >
-        {{ hawkular_secrets['hawkular-cassandra.truststore'] }}
-      cassandra.truststore.password: >
-        {{ hawkular_secrets['hawkular-cassandra-truststore.pwd'] }}
-      cassandra.pem: >
-        {{ hawkular_secrets['hawkular-cassandra.pem'] }}
-  when: name not in metrics_secrets
-  changed_when: no
-
-- name: generate cassandra-certificate secret template
-  template:
-    src: secret.j2
-    dest: "{{ mktemp.stdout }}/templates/cassandra_certificate.yaml"
-  vars:
-    name: hawkular-cassandra-certificate
-    labels:
-      metrics-infra: hawkular-cassandra
-    data:
-      cassandra.certificate: >
+      tls.crt: >
         {{ hawkular_secrets['hawkular-cassandra.crt'] }}
-      cassandra-ca.certificate: >
-        {{ hawkular_secrets['hawkular-cassandra.pem'] }}
-  when: name not in metrics_secrets.stdout_lines
+      tls.key: >
+        {{ hawkular_secrets['hawkular-cassandra.key'] }}
+      tls.peer.truststore.crt: >
+        {{ hawkular_secrets['hawkular-cassandra.crt'] }}
+      tls.client.truststore.crt: >
+        {{ hawkular_secrets['hawkular-metrics.crt'] }}
+  when: name not in metrics_secrets
   changed_when: no
diff --git a/roles/openshift_metrics/tasks/import_jks_certs.yaml b/roles/openshift_metrics/tasks/import_jks_certs.yaml
index 2a67dad0e..e098145e9 100644
--- a/roles/openshift_metrics/tasks/import_jks_certs.yaml
+++ b/roles/openshift_metrics/tasks/import_jks_certs.yaml
@@ -1,12 +1,4 @@
 ---
-- stat: path="{{mktemp.stdout}}/hawkular-cassandra.keystore"
-  register: cassandra_keystore
-  check_mode: no
-
-- stat: path="{{mktemp.stdout}}/hawkular-cassandra.truststore"
-  register: cassandra_truststore
-  check_mode: no
-
 - stat: path="{{mktemp.stdout}}/hawkular-metrics.keystore"
   register: metrics_keystore
   check_mode: no
@@ -19,9 +11,6 @@
   - slurp: src={{ mktemp.stdout }}/hawkular-metrics-keystore.pwd
     register: metrics_keystore_password
 
-  - slurp: src={{ mktemp.stdout }}/hawkular-cassandra-keystore.pwd
-    register: cassandra_keystore_password
-
   - fetch:
       dest: "{{local_tmp.stdout}}/"
       src: "{{ mktemp.stdout }}/{{item}}"
@@ -29,18 +18,14 @@
     changed_when: False
     with_items:
     - hawkular-metrics.pkcs12
-    - hawkular-cassandra.pkcs12
     - hawkular-metrics.crt
-    - hawkular-cassandra.crt
     - ca.crt
 
   - local_action: command {{role_path}}/files/import_jks_certs.sh
     environment:
       CERT_DIR: "{{local_tmp.stdout}}"
       METRICS_KEYSTORE_PASSWD: "{{metrics_keystore_password.content}}"
-      CASSANDRA_KEYSTORE_PASSWD: "{{cassandra_keystore_password.content}}"
       METRICS_TRUSTSTORE_PASSWD: "{{hawkular_truststore_password.content}}"
-      CASSANDRA_TRUSTSTORE_PASSWD: "{{cassandra_truststore_password.content}}"
     changed_when: False
 
   - copy:
@@ -49,6 +34,4 @@
     with_fileglob: "{{local_tmp.stdout}}/*.*store"
 
   when: not metrics_keystore.stat.exists or
-        not metrics_truststore.stat.exists or
-        not cassandra_keystore.stat.exists or
-        not cassandra_truststore.stat.exists
+        not metrics_truststore.stat.exists
-- 
cgit v1.2.3