This change adds support for DNS over TLS to the ipaclient role.
New variables
ipaclient_dns_over_tls
Configure DNS over TLS. Requires FreeIPA version 4.12.5 or later.
(bool, default: false)
required: false
ipaclient_no_dnssec_validation
Disable DNSSEC validation for DNS over TLS. This turns off DNSSEC
validation for unbound. Only usable if `ipaserver_dns_over_tls` is
enabled. (bool, default: false)
reqiured: false
New distribution specific variable
ipaclient_packages_dot
List of IPA packages needed for DNS over TLS.
The resolver configuratoin for DNS over TLS is not part of this change
and will be added later on. Therefore it is needed to configure the
resolver for DNS over TLS before starting the deployment with ipaclient
role. This is essential for using an IPA DNS server with DoT and enforced
DNS policy so that only DoT is usable.
This is an ansible-freeipa update for the freeipa RFE:
https://pagure.io/freeipa/issue/9159
"`ipa-client-install` should provide option to enable `subid: sss`
in `/etc/nsswitch.conf`".
This option allows to configure authselect with the sssd
profile + with-subid feature, in order to have SSSD setup as
a datasource for subid in /etc/nsswitch.conf.
The default behavior remains unchanged: without the option,
/etc/nsswitch.conf keeps the line subid: files
Signed-off-by: Denis Karpelevich <dkarpele@redhat.com>
The configuration of the DNS resolver is useful if the IPA server has
internal DNS support.
The installation of packages is happening before the DNS resolver is
configured, therefore package installation needs to be possible without
the configuration of the DNS resolver.
The DNS nameservers are configured for `NetworkManager`, `systemd-resolved`
(if installed and enabled) and `/etc/resolv.conf` if neither NetworkManager
nor systemd-resolved is used.
Example inventory:
[ipaserver]
ipaserver.example.com
[ipaclients]
ipaclient1.example.com
[ipaclients:vars]
ipaadmin_principal=admin
ipaadmin_password=MySecretPassword123
ipaclient_domain=example.com
ipaclient_configure_dns_resolver=yes
ipaclient_dns_servers=192.168.100.1
ipaclient_cleanup_dns_resolver=yes
New parameters:
ipaclient_configure_dns_resolver
The bool value defines if the DNS resolver is configured. before deploying
the client. This is useful if the IPA server has internal DNS support.
ipaclient_dns_server need to be set also.
ipaclient_dns_servers
The list of DNS server IP addresses. This is only useful with
ipaclient_configure_dns_resolver.
ipaclient_cleanup_dns_resolver
The bool value defines if DNS resolvers that have been configured before
with ipaclient_configure_dns_resolver will be cleaned up again.
New module:
roles/ipaclient/library/ipaclient_configure_dns_resolver.py
Fixes: #902 (Consider adding support for client DNS resolver
configuration)
The sssd options in the ipaclient role missed a 's' in the role. The readme
of the role used the proper names with 3 's'. The names in the role have
been fixed and if the old setting are used, they will be used in the first
place.
Also utils/ansible-ipa-client-install has been adaped to use the proper
option names now.
This fixes issue #145 (The ipaclient role misspells sssd)
There have been several settings in ipaclient_setup_nss that have been
hard coded instead of using the settings from the role. This has been
fixed and the code in ipaclient_setup_nss has been updated to the latest
version of FreeIPA with compatibility changes for older FreeIPA versions.
Additionally the api is now properly configured so that the DNS SSHFP
records are now properly created if no_dns_sshfp is not enabled.
This setting had the wrong and unsed prefix ipahost. THis has been fixed and
the proper prefix ipaclient is now used.
The change in ipaclient/defaults/main.yml was missing from the first commit
b5d6dc00d2
The advantage of this is that the krb5 configuration is created in the same
way as in the normal installers. The same functionality as in the normal
installers is used in ipaclient_setup_krb5. There is no need to adapt the
ipa-krb5 role or the the ask file for changes in how the krb5 configuration
is done. Additionally ipaclient_force is now a supported parameter as
it is in the normal installer.
New config option:
ipaclient_force
The variable has been added to ipaclient/defaults/main.yml.
ipaclient_setup_sssd is now using configure_sssd_conf from
ipaclient/install/client.py instead. This simplified the module a lot
and also adds more configuratino options for sssd.
These are new config options supported by ipaclient_setup_sssd:
ipaclient_no_sudo
ipassd_fixed_primary
ipassd_permit
ipassd_enable_dns_updates
ipassd_no_krb5_offline_passwords
ipassd_preserve_sssd
These variables have been added to ipaclient/defaults/main.yml.
The ipaclient_test module was not doing all tests that should be done
with the provided settings. All tests from ipaclient installer parts
are now part of ipaclient_test. There are some minor changes though to
make sure that the repair mode could still be used.
ansible_ipa_client bindings have been updated to fullfill new needs.
The new module ipaclient_setup_ntp to configure and sync time with the NTP
server has been added. The irregular setting ipaclient_ntp has been removed.
The ipaclient_setup_ntp module is using either the new sync_time call or
for compatibility with older FreeIPA versions synconce_ntp.
The reference for ipaclient_ntp in REPLICA.md has been removed also.
This also fixes#55.
ipaclient_extras could configure several things internally according to
provided settings. These have been ssh, sshd, automount, firefox an also
nis. The ssh and sshd configuration is now plocated in ipaclient_setup_ssh,
the automount configuration in ipaclient_setup_automount, the firefox
configuration in ipaclient_setup_firefox and the nis configuration in
ipaclient_setup_nis.
The following additional settings have been added to
roles/ipaclient/defaults/main.yml to provide the same configruation options
as ipa-client-install does:
ipaclient_no_ssh: no
ipaclient_no_sshd: no
ipaclient_no_nisdomain: no
ipaclient_configure_firefox: no
With these settings for server, replica and client it is possible to skip
package installation. This is for example useful if the packages are already
installed. The settings default to yes
The setting ipareplica_no_package_install has been removed.
krb5 DNS discovery was not possible in cluster environments as the server
list from groups.ipaserver was used all the time. DNS discovery is though
only used if no servers are given.
The new setting ipaclient_no_dns_lookup has been added to make sure that
DNS lookup is used in the first place and can be disabled easily with this
setting. There is also a new way to override servers per client in the
inventory file with ipaclient_servers.
Two new settings have been added:
ipaclient_no_dns_lookup (bool, default: no)
Set to 'yes' to use groups.ipaserver in cluster environments as servers
for the clients. This deactivates DNS lookup in krb5.
ipaclient_servers (list of strings, default: undefined)
Manually override list of servers for example in a cluster environment on
a per client basis. The list of servers is normally taken from from
groups.ipaserver in cluster environments.
Attempt to sync time if on_master is not set and no_ntp is not set: At
first with given or dicovered time servers. If no ntp servers have been
given or discovered, then with the ipa server.
New parameters:
on_master:
description: IPA client installation on IPA server
required: false
default: false
type: bool
default: no
ntp_servers:
description: List of NTP servers to use
required: false
type: list
default: []
no_ntp:
description: Do not sync time and do not detect time servers
required: false
default: false
type: bool
default: no
The ntp_servers output parameter is now always an empty list if on_master
or no_ntp is set.
When allow_repair is enabled, then the playbook will continue for an
already joined host. The remaining steps ipaconf, ipasssd, krb5, ipaapi,
ipanss and ipaextras will be redone.
If allow_repair is disabled, then the meta module will be
used with the end_play option to stop the processing of the playbook
without an error.
The use of otp can be forced to not transfer the admin password while setting
up the ipa client. Only the one-time-password will be transferred to the
client machine.
ipaclient_password will be overwritten by the otp password.
