Feature/ca san extra

README.md

@@ -45,6 +45,7 @@ You need to have the Python library `cryptography` in version `>1.2.3` available
 * `ca_logstash`: Create Logstash compatible certificate as well. Needs `ca_server_cert` to be set. (default: `false`)
 * `ca_etcd`: Create additional etcd compatible certificates. Requires `ca_etcd_group` to be defined. (default: `false`)
 * `ca_etcd_group`: Needs to be set to the group name of etcd nodes and will add the default IPv4 address of each node to the certificates. 127.0.0.1 will also be added by the role to the SAN for loopback purposes.(default: `undefined`)
+* `ca_san_extra`: Extra subject alternative names for the client and server certificates of a host, for example `["IP:192.0.2.10", "DNS:lb.example.com"]`. (default: `[]`)
 * `ca_keypassphrase`: Password for the client key, default not defined
 * `ca_openssl_cipher`: Cipher to use for key creation, default not defined
 * `ca_client_ca_dir`: Directory to place CA and certificates on the clients (default: `/opt/ca`)

defaults/main.yml

@@ -15,6 +15,8 @@ ca_server_cert: true
 ca_logstash: false
 ca_etcd: false
 
+ca_san_extra: []
+
 ca_country: EX
 ca_state: EX
 ca_locality: EX

molecule/default/molecule.yml

@@ -27,5 +27,11 @@ provisioner:
   config_options:
     defaults:
       roles_path: "$MOLECULE_PROJECT_DIRECTORY/.."
+  inventory:
+    host_vars:
+      ca_default_client:
+        ca_san_extra:
+          - IP:192.0.2.10
+          - DNS:lb.example.com
 verifier:
   name: ansible

molecule/default/verify.yml

@@ -116,3 +116,34 @@
         - hostvars['ca_default_client']['ansible_default_ipv4']['address']
           not in etcd_san_server_stat.stdout
         - '"127.0.0.1" not in etcd_san_server_stat.stdout'
+
+    - name: Register SAN of client and server certificate
+      command: >
+        openssl x509 -noout -ext subjectAltName
+        -in {{ ca_client_ca_dir }}/{{ inventory_hostname }}{{ item }}.crt
+      loop:
+        - ""
+        - "-server"
+      register: san_stat
+      changed_when: false
+
+    # openssl prints an IP entry as "IP Address:192.0.2.10"
+    - name: Fail if an entry of ca_san_extra is missing
+      fail:
+        msg: >-
+          {{ item.1 }} is missing in
+          {{ inventory_hostname }}{{ item.0.item }}.crt
+      loop: "{{ san_stat.results | product(san_extra) | list }}"
+      vars:
+        san_extra: "{{ ca_san_extra | default([]) }}"
+      when: item.1 | regex_replace('^IP:', 'IP Address:') not in item.0.stdout
+
+    - name: Fail if a host without ca_san_extra got the extra names
+      fail:
+        msg: >-
+          {{ inventory_hostname }}{{ item.item }}.crt
+          contains names of ca_san_extra
+      loop: "{{ san_stat.results }}"
+      when:
+        - ca_san_extra is not defined
+        - "'192.0.2.10' in item.stdout or 'lb.example.com' in item.stdout"

tasks/main.yml

@@ -44,6 +44,11 @@
       DNS:{{ ansible_fqdn }},
       DNS:{{ inventory_hostname }}
 
+- name: Add ca_san_extra to ca_san
+  ansible.builtin.set_fact:
+    ca_san: "{{ ([ca_san] + ca_san_extra) | join(', ') }}"
+  when: ca_san_extra | length > 0
+
 ### client certificate ###
 
 - name: Create key
@@ -251,7 +256,7 @@
 
     - name: Add IP addresses for etcd to ca_san_etcd
       ansible.builtin.set_fact:
         ca_san_etcd: >-
           {{ ca_san }},
           IP:127.0.0.1,
           {%- for host in groups[ca_etcd_group] -%}