Commit 1f1f5c60 authored by Joanne Hugé's avatar Joanne Hugé

roles/generate-key: add role to generate private key for ORS

This will generate a key pair in /opt/private-key.
The public key will then be published in ansible report to
the slapos monitoring service running on the machine.
This private key will be used to decrypt encrypted
data uploaded on shacache.
parent cf982bf0
- name: a play that runs entirely on the ansible host
hosts: 127.0.0.1
connection: local
vars_files:
- settings/ors.yml
roles:
- generate-key
#!/usr/bin/env python3
import sys
CONF_PATH = "/etc/opt/slapos/slapos.cfg"
signature = """ -----BEGIN CERTIFICATE-----
MIIEDTCCAnWgAwIBAgIUOPXvdYH461MtYKJFh4uf9ANwn5AwDQYJKoZIhvcNAQEL
BQAwFTETMBEGA1UEAwwKUmFwaWRTcGFjZTAgFw0yNDA0MTkxMjU0MjNaGA8yMTIy
MTExMjEyNTQyM1owFTETMBEGA1UEAwwKUmFwaWRTcGFjZTCCAaIwDQYJKoZIhvcN
AQEBBQADggGPADCCAYoCggGBAObATKTWgX/3mvapLlrFrlTybAzX2NQqSmjeMrfZ
v/rkGGQzUPVugJ7J8TxDIpaxanDBI0+uIlluGDCVcDh0+jV0xzDOKYGckZqfxcXC
k4RHxIAx2+Z+Y3DCY0QlzEfAyBmsV7U5Xhq6JAcgIIZdc9Fa/lsXJbwgNTQ9F/mx
DfCbN0x/MnAdRHnIWvIhKY3NWEtBPdQvrKAiBYwxXuRE2MYivPHUMWicdAobvVi9
JbXavkmvAQ7lVwOHnRa1I8H+C50RywMdKiW9r5pMlkwu9kdes5a4mVo2wRwoRFNQ
cVh8yHoOg9PNpB5otOjAMazTwZXKVDUxC03LHsBGgEM6y3rtE5fFajvvT0N6/0jR
zJQ+cXNadjevLs9xA94d3VLBZtY1Od9nkyKvZNzu047e/9RGI8lI0eRpbSAWCnE+
p0qDHYaTeT90+Iot/femp+ZG0wNVUNoBkw4jIyatsXRkgFrEVO9chL6FtXgdJH3H
wwus3RT5malA5UZafJTTNrhpyQIDAQABo1MwUTAdBgNVHQ4EFgQUW6DVpr2gLhrr
0vj1o28lBncj8jowHwYDVR0jBBgwFoAUW6DVpr2gLhrr0vj1o28lBncj8jowDwYD
VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAYEAOgi2NdYRlR7WfNtuUVoq
Yacmmefy9S3si5/hTI0pHuHxAVPYyAYJZJy60bnjxphUF+m5FvErweFVPpkJaUvg
hht23dXUcyYMukDjG2VvJjFcIbfIE9WZFhofN8hGI9PjEFOb98kqexYlCmTN48nP
2EaQ6HC3ZZ6PqKdhCRdWa6MeHSy7UNK+9VKLKbe40sZJRvvgTIazHgb+t+r+qhXi
D9nkcfvvV7BfclKflYrLNLiTcwg8J/gcI2IMbu3lTZyQrYbBCKwxQZGzQfeX1LCV
P26M6mP/wWlo7DrHof/FdJ+Qdr8gUhH59y6vNsofzy4P0oC8GcwcTam7o6FJMC5l
QVWI8zm7G64UGKJBKMoNiP25t1uZzDaJucQAd+4ovsjHctgvcJj8JKzQovIcly+r
PGHKeoTr8UBhoZZxYQTiOO8OK/F0GFfP9OsXoyFp+527X9tezUk28gzmoi7nuaSt
qYacPjDsKHmV1RfQFweSMk57RYN4NRJuHhl1OvY8FafK
-----END CERTIFICATE-----""".split('\n')
def main():
with open(CONF_PATH, 'r') as f:
i = 0
for l in f:
if i == len(signature):
return 0
if signature[i] == l[:-1]:
i += 1
else:
i = 0
conf = []
with open(CONF_PATH, 'r') as f:
for l in f:
conf.append(l[:-1])
if l[:-1] == 'signature-certificate-list = ':
conf += signature
with open(CONF_PATH, 'w+') as f:
f.write('\n'.join(conf))
return 0
if __name__ == '__main__':
sys.exit(main())
---
dependencies:
- { role: package, package_name: openssl, package_state: present }
---
- set_fact: cn="{{ ansible_hostname }}"
- name: Update certificate signature list
script: update-signature-list.py
- name: Create directory if it does not exist
file: path="{{ pkdir }}" state=directory mode=0755
- stat: path="{{ pkdir }}/{{ cn }}.key"
register: private_key
- name: Generate private key
shell: 'openssl genrsa -out {{ pkdir }}/{{ cn }}.key 4096'
when: private_key.stat.exists == False
- stat: path="{{ pkdir }}/{{ cn }}.key"
register: private_key
- stat: path="{{ pkdir }}/{{ cn }}.pub"
register: public_key
- name: Generate public key
shell: 'openssl rsa -in {{ pkdir }}/{{ cn }}.key -outform PEM -pubout -out {{ pkdir }}/{{ cn }}.pub'
when: private_key.stat.exists == True and public_key.stat.exists == False
- name: Get monitor private directory path
shell: 'realpath $(dirname $(grep -lR "software_release_url = .*software/monitor/software.cfg" $(find /srv/slapgrid -type f -name "buildout.cfg")))/srv/monitor/private'
register: monitor_path
- name: Create directory if it does not exist
file: path="{{ monitor_path.stdout }}/playbook-report" state=directory mode=0755
- stat: path="{{ pkdir }}/{{ cn }}.pub"
register: public_key
- name: Copy public key
copy: src="{{ pkdir }}/{{ cn }}.pub" dest="{{ monitor_path.stdout }}/playbook-report/{{ cn }}.pub" owner=root mode=774
when: public_key.stat.exists == True
{"time": "{{ ansible_date_time['date'] }} {{ ansible_date_time['time'] }}", "log_level": "INFO", "message": "msg"}
a0c509f6bba4a62a2dbefe8e79b32f05ef4026e7e763bae5ec6db5d1e173a723 - 34ae53bd05e2233ae16b221ba031973f4213800ae12ab0abcc628b5d97e16302 -
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment