blob: c185d3f88406676c2c452fd5632c2098ca154084 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
---
- name: generate {{ component }} keys
command: >
{{ openshift.common.admin_binary }} ca create-server-cert
--config={{ mktemp.stdout }}/admin.kubeconfig
--key='{{ openshift_metrics_certs_dir }}/{{ component }}.key'
--cert='{{ openshift_metrics_certs_dir }}/{{ component }}.crt'
--hostnames='{{ hostnames }}'
--signer-cert='{{ openshift_metrics_certs_dir }}/ca.crt'
--signer-key='{{ openshift_metrics_certs_dir }}/ca.key'
--signer-serial='{{ openshift_metrics_certs_dir }}/ca.serial.txt'
when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.key'|exists
- slurp: src={{item}}
register: component_certs
with_items:
- '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}.key'
- '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}.crt'
when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.pem'|exists
- name: generate {{ component }} certificate
copy:
dest: '{{ openshift_metrics_certs_dir }}/{{ component }}.pem'
content: "{{ component_certs.results | map(attribute='content') | map('b64decode') | join('') }}"
when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.pem'|exists
- name: generate random password for the {{ component }} keystore
copy:
content: "{{ 15 | oo_random_word }}"
dest: '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}-keystore.pwd'
when: >
not '{{ openshift_metrics_certs_dir }}/{{ component }}-keystore.pwd'|exists
- slurp: src={{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}-keystore.pwd
register: keystore_password
- name: create the {{ component }} pkcs12 from the pem file
command: >
openssl pkcs12 -export
-in '{{ openshift_metrics_certs_dir }}/{{ component }}.pem'
-out '{{ openshift_metrics_certs_dir }}/{{ component }}.pkcs12'
-name '{{ component }}' -noiter -nomaciter
-password 'pass:{{keystore_password.content | b64decode }}'
when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.pkcs12'|exists
- name: create the {{ component }} keystore from the pkcs12 file
command: >
keytool -v -importkeystore
-srckeystore '{{ openshift_metrics_certs_dir | quote }}/{{ component | quote }}.pkcs12'
-srcstoretype PKCS12
-destkeystore '{{ openshift_metrics_certs_dir | quote }}/{{ component | quote}}.keystore'
-deststoretype JKS
-deststorepass '{{keystore_password.content | b64decode }}'
-srcstorepass '{{keystore_password.content | b64decode }}'
when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.keystore'|exists
- name: generate random password for the {{ component }} truststore
copy:
content: "{{ 15 | oo_random_word }}"
dest: '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}-truststore.pwd'
when: >
not
'{{ openshift_metrics_certs_dir | quote }}/{{ component| quote }}-truststore.pwd'|exists
|
