mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-06-10 18:55:53 +00:00
9c13882428
This patch adds Ansible tasks to create and remove self-signed certificates, instead of using previously created certificates. The certificates are then `lookup`, instead of being used inline in the playbooks. Playbooks are easier to read and maintain with this changes, and there is no need to change the playbooks, if a certificate expires.
108 lines
3.2 KiB
YAML
108 lines
3.2 KiB
YAML
---
|
|
- name: Test host certificates
|
|
hosts: ipaserver
|
|
become: true
|
|
|
|
tasks:
|
|
- name: Get Domain from server name
|
|
set_fact:
|
|
ipaserver_domain: "{{ ansible_fqdn.split('.')[1:] | join ('.') }}"
|
|
when: ipaserver_domain is not defined
|
|
|
|
- name: Host test absent
|
|
ipahost:
|
|
ipaadmin_password: SomeADMINpassword
|
|
hosts:
|
|
- name: "{{ 'test.' + ipaserver_domain }}"
|
|
state: absent
|
|
|
|
- name: Host test present
|
|
ipahost:
|
|
ipaadmin_password: SomeADMINpassword
|
|
hosts:
|
|
- name: "{{ 'test.' + ipaserver_domain }}"
|
|
force: yes
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Generate self-signed certificates.
|
|
shell:
|
|
cmd: |
|
|
openssl req -x509 -newkey rsa:2048 -days 365 -nodes -keyout "private{{ item }}.key" -out "cert{{ item }}.pem" -subj '/CN=test'
|
|
openssl x509 -outform der -in "cert{{ item }}.pem" -out "cert{{ item }}.der"
|
|
with_items: [1, 2, 3]
|
|
become: no
|
|
delegate_to: localhost
|
|
|
|
- name: Host test cert members present
|
|
ipahost:
|
|
ipaadmin_password: SomeADMINpassword
|
|
hosts:
|
|
- name: "{{ 'test.' + ipaserver_domain }}"
|
|
certificate:
|
|
- "{{ lookup('file', 'cert1.der') | b64encode }}"
|
|
- "{{ lookup('file', 'cert2.der') | b64encode }}"
|
|
- "{{ lookup('file', 'cert3.der') | b64encode }}"
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Host test cert members present again
|
|
ipahost:
|
|
ipaadmin_password: SomeADMINpassword
|
|
hosts:
|
|
- name: "{{ 'test.' + ipaserver_domain }}"
|
|
certificate:
|
|
- "{{ lookup('file', 'cert1.der') | b64encode }}"
|
|
- "{{ lookup('file', 'cert2.der') | b64encode }}"
|
|
- "{{ lookup('file', 'cert3.der') | b64encode }}"
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed
|
|
|
|
- name: Host test cert members absent
|
|
ipahost:
|
|
ipaadmin_password: SomeADMINpassword
|
|
hosts:
|
|
- name: "{{ 'test.' + ipaserver_domain }}"
|
|
certificate:
|
|
- "{{ lookup('file', 'cert1.der') | b64encode }}"
|
|
- "{{ lookup('file', 'cert2.der') | b64encode }}"
|
|
- "{{ lookup('file', 'cert3.der') | b64encode }}"
|
|
state: absent
|
|
action: member
|
|
#register: result
|
|
#failed_when: not result.changed
|
|
|
|
- name: Host test cert members absent again
|
|
ipahost:
|
|
ipaadmin_password: SomeADMINpassword
|
|
hosts:
|
|
- name: "{{ 'test.' + ipaserver_domain }}"
|
|
certificate:
|
|
- "{{ lookup('file', 'cert1.der') | b64encode }}"
|
|
- "{{ lookup('file', 'cert2.der') | b64encode }}"
|
|
- "{{ lookup('file', 'cert3.der') | b64encode }}"
|
|
state: absent
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed
|
|
|
|
- name: Host test absent
|
|
ipahost:
|
|
ipaadmin_password: SomeADMINpassword
|
|
hosts:
|
|
- name: "{{ 'test.' + ipaserver_domain }}"
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Remove certificate files.
|
|
shell:
|
|
cmd: rm -f "private{{ item }}.key" "cert{{ item }}.pem" "cert{{ item }}.der"
|
|
with_items: [1, 2, 3]
|
|
become: no
|
|
delegate_to: localhost
|
|
args:
|
|
warn: no # suppres warning for not using the `file` module.
|