833b58da2c
Current copy certificates task works only if octavia_cert_setup_host is localhost, because it copies from local path. See bug 1842117 To fix this issue certs are slurped and registered after they are created. If octavia_cert_setup_host is 'localhost' cert variables are registered to task_vars scope. If octavia_cert_setup_host is one of the octavia containers or utility containers, i.e. setup host exists in inventory cert variables are registered to hostvars[octavia_cert_setup_host] i.e hostvars scope. Certs facts are set according to octavia_cert_setup_host value. Certs distribution play copies certs from certs facts to each octavia conatainer. Change-Id: I0906c7cf80c3345fb993a71fe190fa2f6baa55e4 Closes-Bug: 1842117
44 lines
2.0 KiB
YAML
44 lines
2.0 KiB
YAML
---
|
|
|
|
- name: Create certs directory
|
|
file:
|
|
path: /etc/octavia/certs/
|
|
state: directory
|
|
|
|
- name: Register a fact for the cert and key
|
|
set_fact:
|
|
octavia_ca_private_key_fact: "{{ hostvars[octavia_cert_setup_host]['_octavia_ca_private_key']['content'] | b64decode }}"
|
|
octavia_ca_certificate_fact: "{{ hostvars[octavia_cert_setup_host]['_octavia_ca_certificate']['content'] | b64decode }}"
|
|
octavia_server_ca_fact: "{{ hostvars[octavia_cert_setup_host]['_octavia_server_ca']['content'] | b64decode }}"
|
|
octavia_client_ca_fact: "{{ hostvars[octavia_cert_setup_host]['_octavia_client_ca']['content'] | b64decode }}"
|
|
octavia_client_cert_fact: "{{ hostvars[octavia_cert_setup_host]['_octavia_client_cert']['content'] | b64decode }}"
|
|
when: octavia_cert_setup_host != 'localhost'
|
|
|
|
- name: Register a fact for the cert and key
|
|
set_fact:
|
|
octavia_ca_private_key_fact: "{{ _octavia_ca_private_key['content'] | b64decode }}"
|
|
octavia_ca_certificate_fact: "{{ _octavia_ca_certificate['content'] | b64decode }}"
|
|
octavia_server_ca_fact: "{{ _octavia_server_ca['content'] | b64decode }}"
|
|
octavia_client_ca_fact: "{{ _octavia_client_ca['content'] | b64decode }}"
|
|
octavia_client_cert_fact: "{{ _octavia_client_cert['content'] | b64decode }}"
|
|
when: octavia_cert_setup_host == 'localhost'
|
|
|
|
- name: Copy certificates
|
|
copy:
|
|
content: "{{ item.content }}"
|
|
dest: "{{ item.dest }}"
|
|
owner: "{{ octavia_system_user_name }}"
|
|
group: "{{ octavia_system_group_name }}"
|
|
mode: "0640"
|
|
with_items:
|
|
- content: "{{ octavia_ca_private_key_fact }}"
|
|
dest: "/etc/octavia/certs/ca_key.pem"
|
|
- content: "{{ octavia_ca_certificate_fact }}"
|
|
dest: "/etc/octavia/certs/ca.pem"
|
|
- content: "{{ octavia_server_ca_fact }}"
|
|
dest: "/etc/octavia/certs/server_ca.pem"
|
|
- content: "{{ octavia_client_ca_fact }}"
|
|
dest: "/etc/octavia/certs/client_ca.pem"
|
|
- content: "{{ octavia_client_cert_fact }}"
|
|
dest: "/etc/octavia/certs/client.pem"
|