enable injection of custom ca cert into trust chain

Author: wrichter

bastion.yaml

@@ -196,6 +196,10 @@ parameters:
     description: List of docker repository URLs which will be installed on each node, if a repo is insecure use '#insecure' suffix.
     default: ''
 
+  trusted_ca_cert:
+    type: string
+    description: Certificate Authority Certificate to be added to trust chain
+
 resources:
 
   # A VM to provide host based orchestration and other sub-services
@@ -230,6 +234,7 @@ resources:
       parts:
       - config: {get_resource: set_hostname}
       - config: {get_resource: included_files}
+      - config: {get_resource: ca_cert}
       - config: {get_resource: rhn_register}
       - config: {get_resource: set_extra_repos}
       - config: {get_resource: set_extra_docker_repos}
@@ -293,6 +298,15 @@ resources:
         ssh_authorized_keys:
         - {get_param: ansible_public_key}
 
+  # Add CA Cert to trust chain
+  ca_cert:
+    type: OS::Heat::SoftwareConfig
+    properties:
+      config:
+        str_replace:
+          params:
+            $CA_CERT: {get_param: trusted_ca_cert}
+          template: {get_file: fragments/ca_cert.sh}
 
   # Register the host with RHN for access to software packages
   rhn_register:

fragments/ca_cert.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+#
+# Register with subscription manager and enable required RPM respositories
+#
+# ENVVARS:
+#   CA_CERT - a ca certificate to be added to trust chain
+
+# Exit on command fail
+set -eu
+set -x
+
+# Return the final non-zero exit code of a failed pipe (or 0 for success)
+set -o pipefail
+
+# =============================================================================
+# MAIN
+# =============================================================================
+
+if [ -n "$CA_CERT" ] ; then
+    update-ca-trust enable
+    cat >/etc/pki/ca-trust/source/anchors/ca.crt <<EOF
+$CA_CERT
+EOF
+    update-ca-trust extract
+else
+    exit 0
+fi

infra.yaml

@@ -228,6 +228,10 @@ parameters:
     type: string
     hidden: true
 
+  trusted_ca_cert:
+    type: string
+    description: Certificate Authority Certificate to be added to trust chain
+
 resources:
 
   # Create a network connection on the internal communications network
@@ -299,6 +303,7 @@ resources:
       parts:
       - config: {get_resource: set_hostname}
       - config: {get_resource: included_files}
+      - config: {get_resource: ca_cert}
       - config: {get_resource: rhn_register}
       - config: {get_resource: set_extra_repos}
       - config: {get_resource: set_extra_docker_repos}
@@ -350,6 +355,16 @@ resources:
         ssh_authorized_keys:
         - {get_param: ansible_public_key}
 
+  # Add CA Cert to trust chain
+  ca_cert:
+    type: OS::Heat::SoftwareConfig
+    properties:
+      config:
+        str_replace:
+          params:
+            $CA_CERT: {get_param: trusted_ca_cert}
+          template: {get_file: fragments/ca_cert.sh}
+
   # Attach to a source of software updates for RHEL
   rhn_register:
     type: OS::Heat::SoftwareConfig

loadbalancer_dedicated.yaml

@@ -169,6 +169,10 @@ parameters:
     type: string
     hidden: true
 
+  trusted_ca_cert:
+    type: string
+    description: Certificate Authority Certificate to be added to trust chain
+
 resources:
   floating_ip_assoc:
     type: OS::Neutron::FloatingIPAssociation
@@ -233,6 +237,7 @@ resources:
       parts:
       - config: {get_resource: set_hostname}
       - config: {get_resource: included_files}
+      - config: {get_resource: ca_cert}
       - config: {get_resource: rhn_register}
       - config: {get_resource: set_extra_repos}
       - config: {get_resource: set_extra_docker_repos}
@@ -281,6 +286,16 @@ resources:
         ssh_authorized_keys:
         - {get_param: ansible_public_key}
 
+  # Add CA Cert to trust chain
+  ca_cert:
+    type: OS::Heat::SoftwareConfig
+    properties:
+      config:
+        str_replace:
+          params:
+            $CA_CERT: {get_param: trusted_ca_cert}
+          template: {get_file: fragments/ca_cert.sh}
+
   # Connect to a software source for updates on RHEL
   rhn_register:
     type: OS::Heat::SoftwareConfig

master.yaml

@@ -221,6 +221,10 @@ parameters:
     type: string
     hidden: true
 
+  trusted_ca_cert:
+    type: string
+    description: Certificate Authority Certificate to be added to trust chain
+
 resources:
 
   # Create a network connection on the internal communications network
@@ -291,6 +295,7 @@ resources:
       parts:
       - config: {get_resource: set_hostname}
       - config: {get_resource: included_files}
+      - config: {get_resource: ca_cert}
       - config: {get_resource: rhn_register}
       - config: {get_resource: set_extra_repos}
       - config: {get_resource: set_extra_docker_repos}
@@ -342,6 +347,16 @@ resources:
         ssh_authorized_keys:
         - {get_param: ansible_public_key}
 
+  # Add CA Cert to trust chain
+  ca_cert:
+    type: OS::Heat::SoftwareConfig
+    properties:
+      config:
+        str_replace:
+          params:
+            $CA_CERT: {get_param: trusted_ca_cert}
+          template: {get_file: fragments/ca_cert.sh}
+
   # Attach to a source of software updates for RHEL
   rhn_register:
     type: OS::Heat::SoftwareConfig

node.yaml

@@ -346,6 +346,10 @@ parameters:
     type: string
     description: Extra parameters for openshift-ansible
 
+  trusted_ca_cert:
+    type: string
+    description: Certificate Authority Certificate to be added to trust chain
+
 resources:
 
   # Generate a string to distinguish one node from the others
@@ -396,6 +400,7 @@ resources:
       parts:
       - config: {get_resource: set_hostname}
       - config: {get_resource: included_files}
+      - config: {get_resource: ca_cert}
       - config: {get_resource: rhn_register}
       - config: {get_resource: set_extra_repos}
       - config: {get_resource: set_extra_docker_repos}
@@ -453,6 +458,16 @@ resources:
         ssh_authorized_keys:
         - {get_param: ansible_public_key}
 
+  # Add CA Cert to trust chain
+  ca_cert:
+    type: OS::Heat::SoftwareConfig
+    properties:
+      config:
+        str_replace:
+          params:
+            $CA_CERT: {get_param: trusted_ca_cert}
+          template: {get_file: fragments/ca_cert.sh}
+
   # Connect to software update source for RHEL
   rhn_register:
     type: OS::Heat::SoftwareConfig

openshift.yaml

@@ -493,6 +493,11 @@ parameters:
     description: Extra parameters for openshift-ansible as a JSON string
     default: ""
 
+  trusted_ca_cert:
+    type: string
+    description: Certificate Authority Certificate to be added to trust chain
+    default: ''
+
 resources:
 
   # Network Components
@@ -582,6 +587,7 @@ resources:
       system_update: {get_param: system_update}
       extra_repository_urls: {get_param: extra_repository_urls}
       extra_docker_repository_urls: {get_param: extra_docker_repository_urls}
+      trusted_ca_cert: {get_param: trusted_ca_cert}
 
   openshift_masters:
     depends_on: [external_router_interface, fixed_network, fixed_subnet]
@@ -625,6 +631,7 @@ resources:
           extra_docker_repository_urls: {get_param: extra_docker_repository_urls}
           dns_servers: {get_param: dns_nameserver}
           dns_update_key: {get_param: dns_update_key}
+          trusted_ca_cert: {get_param: trusted_ca_cert}
 
   openshift_infra_nodes:
     depends_on: [external_router_interface, fixed_network, fixed_subnet]
@@ -669,6 +676,7 @@ resources:
           extra_docker_repository_urls: {get_param: extra_docker_repository_urls}
           dns_servers: {get_param: dns_nameserver}
           dns_update_key: {get_param: dns_update_key}
+          trusted_ca_cert: {get_param: trusted_ca_cert}
 
   openshift_nodes:
     depends_on: [external_router_interface, fixed_network, fixed_subnet]
@@ -745,6 +753,7 @@ resources:
           prepare_ansible: {get_param: prepare_ansible}
           execute_ansible: {get_param: execute_ansible}
           extra_openshift_ansible_params: {get_param: extra_openshift_ansible_params}
+          trusted_ca_cert: {get_param: trusted_ca_cert}
 
   # Define the network access policy for openshift nodes
   node_security_group:
@@ -992,8 +1001,12 @@ resources:
       extra_docker_repository_urls: {get_param: extra_docker_repository_urls}
       stack_name: {get_param: 'OS::stack_name'}
       bastion_node: {get_attr: [bastion_host, resource.host]}
+<<<<<<< HEAD
       dns_servers: {get_param: dns_nameserver}
       dns_update_key: {get_param: dns_update_key}
+=======
+      trusted_ca_cert: {get_param: trusted_ca_cert}
+>>>>>>> aa01b47... add ca config to dedicated loadbalancer
 
 outputs: