summaryrefslogtreecommitdiffstats
path: root/roles/openshift_metrics/tasks
diff options
context:
space:
mode:
authorJeff Cantrill <jcantril@redhat.com>2016-11-29 16:31:13 -0500
committerJeff Cantrill <jcantril@redhat.com>2017-01-17 11:45:04 -0500
commit04c1500801f4d88635001bda1e4f73473fe8e33a (patch)
treef2b5a87f6f793c5c1083b58e422c82ae30f793ab /roles/openshift_metrics/tasks
parente810fb6abab0c6fe9198bfc3f39c82ca8054f76e (diff)
downloadopenshift-04c1500801f4d88635001bda1e4f73473fe8e33a.tar.gz
openshift-04c1500801f4d88635001bda1e4f73473fe8e33a.tar.bz2
openshift-04c1500801f4d88635001bda1e4f73473fe8e33a.tar.xz
openshift-04c1500801f4d88635001bda1e4f73473fe8e33a.zip
Bruno Barcarol GuimarĂ£es work to move metrics to ansible from deployer
Diffstat (limited to 'roles/openshift_metrics/tasks')
-rw-r--r--roles/openshift_metrics/tasks/cleanup.yaml14
-rw-r--r--roles/openshift_metrics/tasks/generate_certificates.yaml233
-rw-r--r--roles/openshift_metrics/tasks/generate_rolebindings.yaml30
-rw-r--r--roles/openshift_metrics/tasks/generate_serviceaccounts.yaml25
-rw-r--r--roles/openshift_metrics/tasks/generate_services.yaml43
-rw-r--r--roles/openshift_metrics/tasks/install_hawkular.yaml57
-rw-r--r--roles/openshift_metrics/tasks/install_heapster.yaml3
-rw-r--r--roles/openshift_metrics/tasks/install_metrics.yaml17
-rw-r--r--roles/openshift_metrics/tasks/main.yaml24
-rw-r--r--roles/openshift_metrics/tasks/setup_certificate.yaml50
10 files changed, 496 insertions, 0 deletions
diff --git a/roles/openshift_metrics/tasks/cleanup.yaml b/roles/openshift_metrics/tasks/cleanup.yaml
new file mode 100644
index 000000000..a61fed7b4
--- /dev/null
+++ b/roles/openshift_metrics/tasks/cleanup.yaml
@@ -0,0 +1,14 @@
+---
+- name: remove metrics components
+ command: >
+ {{ openshift.common.client_binary }} -n '{{ metrics_project }}'
+ delete --selector=metrics-infra
+ all,sa,secrets,templates,routes,pvc,rolebindings,clusterrolebindings
+ register: delete_metrics
+ changed_when: "delete_metrics.stdout != 'No resources found'"
+- name: remove rolebindings
+ command: >
+ {{ openshift.common.client_binary }} -n {{ metrics_project }}
+ delete --ignore-not-found
+ rolebinding/hawkular-view
+ clusterrolebinding/heapster-cluster-reader
diff --git a/roles/openshift_metrics/tasks/generate_certificates.yaml b/roles/openshift_metrics/tasks/generate_certificates.yaml
new file mode 100644
index 000000000..b1ecf46b9
--- /dev/null
+++ b/roles/openshift_metrics/tasks/generate_certificates.yaml
@@ -0,0 +1,233 @@
+---
+# TODO idempotency?
+# TODO support providing custom certificates
+- name: create certificate output directory
+ file:
+ path: "{{ mktemp.stdout }}/certs"
+ state: directory
+ mode: 0700
+- name: generate ca certificate chain
+ shell: >
+ {{ openshift.common.admin_binary }} ca create-signer-cert
+ --key='{{ mktemp.stdout }}/certs/ca.key'
+ --cert='{{ mktemp.stdout }}/certs/ca.crt'
+ --serial='{{ mktemp.stdout }}/certs/ca.serial.txt'
+ --name="metrics-signer@$(date +%s)"
+- name: generate heapster key/cert
+ command: >
+ {{ openshift.common.admin_binary }} ca create-server-cert
+ --key='{{ mktemp.stdout }}/certs/heapster.key'
+ --cert='{{ mktemp.stdout }}/certs/heapster.cert'
+ --hostnames=heapster
+ --signer-cert='{{ mktemp.stdout }}/certs/ca.crt'
+ --signer-key='{{ mktemp.stdout }}/certs/ca.key'
+ --signer-serial='{{ mktemp.stdout }}/certs/ca.serial.txt'
+# TODO maybe there's an easier way to get the service accounts' ca crt?
+- name: get heapster service account secrets
+ shell: >
+ {{ openshift.common.client_binary }} -n '{{ metrics_project }}'
+ get serviceaccount/default
+ --template '{{ '{{range .secrets}}{{println .name}}{{end}}' }}'
+ | grep ^default-token-
+ register: sa_secret
+- name: get heapster service account ca
+ command: >
+ {{ openshift.common.client_binary }} -n '{{ metrics_project }}'
+ get 'secret/{{ sa_secret.stdout }}'
+ --template '{{ '{{index .data "ca.crt"}}' }}'
+ register: sa_secret
+- name: read files for the heapster secret
+ command: base64 --wrap 0 "{{ mktemp.stdout }}/certs/heapster.{{ item }}"
+ register: heapster_secret
+ with_items:
+ - cert
+ - key
+- name: generate heapster secret template
+ template:
+ src: secret.j2
+ dest: "{{ mktemp.stdout }}/templates/heapster_secrets.yaml"
+ vars:
+ name: heapster-secrets
+ labels:
+ metrics-infra: heapster
+ data:
+ heapster.cert: "{{ heapster_secret.results[0].stdout }}"
+ heapster.key: "{{ heapster_secret.results[1].stdout }}"
+ heapster.client-ca: "{{ sa_secret.stdout }}"
+ heapster.allowed-users: "{{ heapster_allowed_users|b64encode }}"
+- name: generate hawkular-metrics certificates
+ include: setup_certificate.yaml
+ vars:
+ component: hawkular-metrics
+ hostnames: "hawkular-metrics,{{ hawkular_metrics_hostname }}"
+- name: generate hawkular-cassandra certificates
+ include: setup_certificate.yaml
+ vars:
+ component: hawkular-cassandra
+ hostnames: hawkular-cassandra
+# TODO keytool as dependency? move key/trust store generation to containers?
+- name: import the hawkular metrics cert into the cassandra truststore
+ shell: >
+ keytool -noprompt -import -v -trustcacerts
+ -alias hawkular-metrics
+ -file '{{ mktemp.stdout|quote }}/certs/hawkular-metrics.cert'
+ -keystore '{{ mktemp.stdout|quote }}/certs/hawkular-cassandra.truststore'
+ -storepass
+ "$(< "{{ mktemp.stdout|quote }}/certs/hawkular-cassandra-truststore.pwd")"
+- name: import the hawkular cassandra cert into the hawkular metrics truststore
+ shell: >
+ keytool -noprompt -import -v -trustcacerts
+ -alias hawkular-cassandra
+ -file '{{ mktemp.stdout }}/certs/hawkular-cassandra.cert'
+ -keystore '{{ mktemp.stdout }}/certs/hawkular-metrics.truststore'
+ -storepass
+ "$(< "{{ mktemp.stdout|quote }}/certs/hawkular-metrics-truststore.pwd")"
+- name: import the hawkular cassandra cert into the cassandra truststore
+ shell: >
+ keytool -noprompt -import -v -trustcacerts
+ -alias hawkular-cassandra
+ -file '{{ mktemp.stdout }}/certs/hawkular-cassandra.cert'
+ -keystore '{{ mktemp.stdout }}/certs/hawkular-cassandra.truststore'
+ -storepass
+ "$(< "{{ mktemp.stdout|quote }}/certs/hawkular-cassandra-truststore.pwd")"
+- name: import the ca certificate into the cassandra truststore
+ shell: >
+ keytool -noprompt -import -v -trustcacerts
+ -alias '{{ item }}'
+ -file '{{ mktemp.stdout }}/certs/ca.crt'
+ -keystore '{{ mktemp.stdout }}/certs/hawkular-cassandra.truststore'
+ -storepass
+ "$(< "{{ mktemp.stdout|quote }}/certs/hawkular-cassandra-truststore.pwd")"
+ with_items:
+ - ca
+ - metricca
+ - cassandraca
+- name: import the ca certificate into the hawkular metrics truststore
+ shell: >
+ keytool -noprompt -import -v -trustcacerts
+ -alias '{{ item }}'
+ -file '{{ mktemp.stdout }}/certs/ca.crt'
+ -keystore '{{ mktemp.stdout }}/certs/hawkular-metrics.truststore'
+ -storepass
+ "$(< "{{ mktemp.stdout|quote }}/certs/hawkular-metrics-truststore.pwd")"
+ with_items:
+ - ca
+ - metricca
+ - cassandraca
+- name: generate password for htpasswd file for hawkular metrics
+ shell: cat /dev/urandom | tr -dc _A-Z-a-z-0-9 | head -c15
+ register: hawkular_metrics_password
+- name: generate password for hawkular metrics jgroups
+ shell: cat /dev/urandom | tr -dc _A-Z-a-z-0-9 | head -c15
+ register: hawkular_metrics_jgroups_password
+- name: generate htpasswd file for hawkular metrics
+ shell: >
+ htpasswd -cb
+ "{{ mktemp.stdout|quote }}/certs/hawkular-metrics.htpasswd" hawkular
+ '{{ hawkular_metrics_password.stdout }}'
+- name: generate the jgroups keystore
+ command: >
+ keytool -genseckey -alias hawkular
+ -keypass {{ hawkular_metrics_jgroups_password.stdout }}
+ -storepass {{ hawkular_metrics_jgroups_password.stdout }}
+ -keyalg Blowfish -keysize 56 -storetype JCEKS
+ -keystore {{ mktemp.stdout }}/certs/hawkular-jgroups.keystore
+- name: read files for the hawkular-metrics secret
+ command: >
+ base64 --wrap 0 "{{ mktemp.stdout }}/certs/{{ item }}"
+ register: hawkular_metrics_secret
+ with_items:
+ - hawkular-metrics.keystore
+ - hawkular-metrics-keystore.pwd
+ - hawkular-metrics.truststore
+ - hawkular-metrics-truststore.pwd
+ - hawkular-metrics.htpasswd
+ - hawkular-metrics.cert
+ - ca.crt
+ - hawkular-cassandra.keystore
+ - hawkular-cassandra-keystore.pwd
+ - hawkular-cassandra.truststore
+ - hawkular-cassandra-truststore.pwd
+ - hawkular-cassandra.pem
+ - hawkular-cassandra.cert
+ - hawkular-jgroups.keystore
+- name: generate hawkular-metrics-secrets secret template
+ template:
+ src: secret.j2
+ dest: "{{ mktemp.stdout }}/templates/hawkular_metrics_secrets.yaml"
+ vars:
+ name: hawkular-metrics-secrets
+ labels:
+ metrics-infra: hawkular-metrics
+ data:
+ hawkular-metrics.keystore: >
+ "{{ hawkular_metrics_secret.results[0].stdout }}"
+ hawkular-metrics.keystore.password: >
+ "{{ hawkular_metrics_secret.results[1].stdout }}"
+ hawkular-metrics.truststore: >
+ "{{ hawkular_metrics_secret.results[2].stdout }}"
+ hawkular-metrics.truststore.password: >
+ "{{ hawkular_metrics_secret.results[3].stdout }}"
+ hawkular-metrics.keystore.alias: "{{ 'hawkular-metrics'|b64encode }}"
+ hawkular-metrics.htpasswd.file: >
+ "{{ hawkular_metrics_secret.results[4].stdout }}"
+ hawkular-metrics.jgroups.keystore.password: >
+ "{{ hawkular_metrics_jgroups_password.stdout|b64encode }}"
+ hawkular-metrics.jgroups.keystore: >
+ "{{ hawkular_metrics_secret.results[13].stdout }}"
+ hawkular-metrics.jgroups.alias: "{{ 'hawkular'|b64encode }}"
+- name: generate hawkular-metrics-certificate secret template
+ template:
+ src: secret.j2
+ dest: "{{ mktemp.stdout }}/templates/hawkular_metrics_certificate.yaml"
+ vars:
+ name: hawkular-metrics-certificate
+ labels:
+ metrics-infra: hawkular-metrics
+ data:
+ hawkular-metrics.certificate: >
+ "{{ hawkular_metrics_secret.results[5].stdout }}"
+ hawkular-metrics-ca.certificate: >
+ "{{ hawkular_metrics_secret.results[6].stdout }}"
+- name: generate hawkular-metrics-account secret template
+ template:
+ src: secret.j2
+ dest: "{{ mktemp.stdout }}/templates/hawkular_metrics_account.yaml"
+ vars:
+ name: hawkular-metrics-account
+ labels:
+ metrics-infra: hawkular-metrics
+ data:
+ hawkular-metrics.username: "{{ 'hawkular'|b64encode }}"
+ hawkular-metrics.password: >
+ "{{ hawkular_metrics_password.stdout|b64encode }}"
+- name: generate cassandra secret template
+ template:
+ src: secret.j2
+ dest: "{{ mktemp.stdout }}/templates/cassandra_secrets.yaml"
+ vars:
+ name: hawkular-cassandra-secrets
+ labels:
+ metrics-infra: hawkular-cassandra
+ data:
+ cassandra.keystore: "{{ hawkular_metrics_secret.results[7].stdout }}"
+ cassandra.keystore.password: >
+ {{ hawkular_metrics_secret.results[8].stdout }}
+ cassandra.keystore.alias: "{{ 'hawkular-cassandra'|b64encode }}"
+ cassandra.truststore: "{{ hawkular_metrics_secret.results[9].stdout }}"
+ cassandra.truststore.password: >
+ {{ hawkular_metrics_secret.results[10].stdout }}
+ cassandra.pem: "{{ hawkular_metrics_secret.results[10].stdout }}"
+- name: generate cassandra-certificate secret template
+ template:
+ src: secret.j2
+ dest: "{{ mktemp.stdout }}/templates/cassandra_certificate.yaml"
+ vars:
+ name: hawkular-cassandra-certificate
+ labels:
+ metrics-infra: hawkular-cassandra
+ data:
+ cassandra.certificate: >
+ {{ hawkular_metrics_secret.results[11].stdout }}
+ cassandra-ca.certificate: >
+ {{ hawkular_metrics_secret.results[7].stdout }}
diff --git a/roles/openshift_metrics/tasks/generate_rolebindings.yaml b/roles/openshift_metrics/tasks/generate_rolebindings.yaml
new file mode 100644
index 000000000..d1bc7374a
--- /dev/null
+++ b/roles/openshift_metrics/tasks/generate_rolebindings.yaml
@@ -0,0 +1,30 @@
+---
+- name: generate view role binding for the hawkular service account
+ template:
+ src: rolebinding.j2
+ dest: "{{ mktemp.stdout }}/templates/hawkular-rolebinding.yaml"
+ vars:
+ obj_name: hawkular-view
+ labels:
+ metrics-infra: hawkular
+ roleRef:
+ name: view
+ subjects:
+ - kind: ServiceAccount
+ name: hawkular
+- name: generate cluster-reader role binding for the heapster service account
+ template:
+ src: rolebinding.j2
+ dest: "{{ mktemp.stdout }}/templates/heapster-rolebinding.yaml"
+ vars:
+ cluster: True
+ obj_name: heapster-cluster-reader
+ labels:
+ metrics-infra: heapster
+ roleRef:
+ kind: ClusterRole
+ name: cluster-reader
+ subjects:
+ - kind: ServiceAccount
+ name: heapster
+ namespace: "{{ metrics_project }}"
diff --git a/roles/openshift_metrics/tasks/generate_serviceaccounts.yaml b/roles/openshift_metrics/tasks/generate_serviceaccounts.yaml
new file mode 100644
index 000000000..9230e0423
--- /dev/null
+++ b/roles/openshift_metrics/tasks/generate_serviceaccounts.yaml
@@ -0,0 +1,25 @@
+---
+- name: Generating serviceaccounts for hawkular metrics/cassandra
+ template: src=serviceaccount.j2 dest={{mktemp.stdout}}/templates/metrics-{{obj_name}}-sa.yaml
+ vars:
+ obj_name: "{{item.name}}"
+ labels:
+ metrics-infra: support
+ secrets:
+ - hawkular-{{item.secret}}-secrets
+ with_items:
+ - name: hawkular
+ secret: hawkular-metrics-secrets
+ - name: cassandra
+ secret: hawkular-cassandra-secrets
+
+- name: Generating serviceaccount for heapster
+ template: src=serviceaccount.j2 dest={{mktemp.stdout}}/templates/metrics-{{obj_name}}-sa.yaml
+ vars:
+ obj_name: heapster
+ labels:
+ metrics-infra: support
+ secrets:
+ - heapster-secrets
+ - hawkular-metrics-certificate
+ - hawkular-metrics-account
diff --git a/roles/openshift_metrics/tasks/generate_services.yaml b/roles/openshift_metrics/tasks/generate_services.yaml
new file mode 100644
index 000000000..4f7616a1c
--- /dev/null
+++ b/roles/openshift_metrics/tasks/generate_services.yaml
@@ -0,0 +1,43 @@
+---
+- name: Generate service for heapster
+ template: src=service.j2 dest={{mktemp.stdout}}/templates/metrics-{{obj_name}}-svc.yaml
+ vars:
+ obj_name: heapster
+ ports:
+ - {port: 80, targetPort: http-endpoint}
+ selector:
+ name: "{{obj_name}}"
+ labels:
+ metrics-infra: "{{obj_name}}"
+ name: "{{obj_name}}"
+
+- name: Generate service for hawkular-metrics
+ template: src=service.j2 dest={{mktemp.stdout}}/templates/metrics-{{obj_name}}-svc.yaml
+ vars:
+ obj_name: hawkular-metrics
+ ports:
+ - {port: 443, targetPort: https-endpoint}
+ selector:
+ name: "{{obj_name}}"
+ labels:
+ metrics-infra: "{{obj_name}}"
+ name: "{{obj_name}}"
+
+- name: Generate services for cassandra
+ template: src=service.j2 dest={{mktemp.stdout}}/templates/metrics-{{obj_name}}-svc.yaml
+ vars:
+ obj_name: hawkular-{{item}}
+ ports:
+ - {name: cql-port, port: 9042, targetPort: cql-port}
+ - {name: thrift-port, port: 9160, targetPort: thrift-port}
+ - {name: tcp-port, port: 7000, targetPort: tcp-port}
+ - {name: ssl-port, port: 7001, targetPort: ssl-port}
+ selector:
+ type: hawkular-cassandra
+ labels:
+ metrics-infra: hawkular-cassandra
+ name: hawkular-cassandra
+ headless: "{{ item == 'cassandra-nodes' }}"
+ with_items:
+ - cassandra
+ - cassandra-nodes
diff --git a/roles/openshift_metrics/tasks/install_hawkular.yaml b/roles/openshift_metrics/tasks/install_hawkular.yaml
new file mode 100644
index 000000000..670396f6e
--- /dev/null
+++ b/roles/openshift_metrics/tasks/install_hawkular.yaml
@@ -0,0 +1,57 @@
+---
+- name: generate hawkular-metrics replication controller
+ template:
+ src: hawkular_metrics_rc.j2
+ dest: "{{ mktemp.stdout }}/templates/hawkular_metrics_rc.yaml"
+- name: generate hawkular-cassandra replication controllers
+ template:
+ src: hawkular_cassandra_rc.j2
+ dest: "{{ mktemp.stdout }}/templates/hawkular-cassandra-rc{{ item }}.yaml"
+ vars:
+ node: "{{ item }}"
+ master: "{{ (item == '1')|string|lower }}"
+ with_sequence: count={{ hawkular_cassandra_nodes }}
+- name: generate hawkular-cassandra persistent volume claims
+ template:
+ src: pvc.j2
+ dest: "{{ mktemp.stdout }}/templates/hawkular-cassandra-pvc{{ item }}.yaml"
+ vars:
+ obj_name: "{{ hawkular_cassandra_pv_prefix }}-{{ item }}"
+ labels:
+ metrics-infra: hawkular-cassandra
+ access_modes:
+ - ReadWriteOnce
+ size: "{{ hawkular_cassandra_pv_size }}"
+ with_sequence: count={{ hawkular_cassandra_nodes }}
+ when: hawkular_cassandra_storage_type == 'pv'
+- name: generate hawkular-cassandra persistent volume claims (dynamic)
+ template:
+ src: pvc.j2
+ dest: "{{ mktemp.stdout }}/templates/hawkular-cassandra-pvc{{ item }}.yaml"
+ vars:
+ obj_name: "{{ hawkular_cassandra_pv_prefix }}-{{ item }}"
+ labels:
+ metrics-infra: hawkular-cassandra
+ annotations:
+ volume.alpha.kubernetes.io/storage-class: dynamic
+ access_modes:
+ - ReadWriteOnce
+ size: "{{ hawkular_cassandra_pv_size }}"
+ with_sequence: count={{ hawkular_cassandra_nodes }}
+ when: hawkular_cassandra_storage_type == 'dynamic'
+- name: generate the hawkular-metrics route
+ template:
+ src: route.j2
+ dest: "{{ mktemp.stdout }}/templates/hawkular-metrics-route.yaml"
+ vars:
+ name: hawkular-metrics
+ labels:
+ metrics-infra: hawkular-metrics
+ host: hawkular-metrics.example.com
+ to:
+ kind: Service
+ name: hawkular-metrics
+ tls:
+ termination: reencrypt
+ destination_ca_certificate: >
+ {{ hawkular_metrics_secret.results[6].stdout|b64decode }}
diff --git a/roles/openshift_metrics/tasks/install_heapster.yaml b/roles/openshift_metrics/tasks/install_heapster.yaml
new file mode 100644
index 000000000..a8f849a88
--- /dev/null
+++ b/roles/openshift_metrics/tasks/install_heapster.yaml
@@ -0,0 +1,3 @@
+---
+- name: Generate heapster replication controller
+ template: src=heapster.j2 dest={{mktemp.stdout}}/templates/metrics-heapster-rc.yaml
diff --git a/roles/openshift_metrics/tasks/install_metrics.yaml b/roles/openshift_metrics/tasks/install_metrics.yaml
new file mode 100644
index 000000000..34b4a47fe
--- /dev/null
+++ b/roles/openshift_metrics/tasks/install_metrics.yaml
@@ -0,0 +1,17 @@
+---
+# This is the base configuration for installing the other components
+- name: Create temp directory for doing work in
+ command: mktemp -td openshift-metrics-ansible-XXXXXX
+ register: mktemp
+ changed_when: False
+
+- debug: msg="Created temp dir {{mktemp.stdout}}"
+
+- name: Create temp directory for all our templates
+ file: path={{mktemp.stdout}}/templates state=directory mode=0755
+ changed_when: False
+
+- include: generate_serviceaccounts.yaml
+- include: generate_services.yaml
+- include: generate_certificates.yaml
+- include: generate_rolebindings.yaml
diff --git a/roles/openshift_metrics/tasks/main.yaml b/roles/openshift_metrics/tasks/main.yaml
new file mode 100644
index 000000000..e9a5fbebd
--- /dev/null
+++ b/roles/openshift_metrics/tasks/main.yaml
@@ -0,0 +1,24 @@
+---
+- name: check that hawkular_metrics_hostname is set
+ fail: msg='the hawkular_metrics_hostname variable is required'
+ when: "{{ hawkular_metrics_hostname is not defined }}"
+- name: check the value of hawkular_cassandra_storage_type
+ fail:
+ msg: >
+ hawkular_cassandra_storage_type ({{ hawkular_cassandra_storage_type }})
+ is invalid, must be one of: emptydir, pv, dynamic
+ when: hawkular_cassandra_storage_type not in hawkular_cassandra_storage_types
+- name: Install Metrics
+ include: "{{ role_path }}/tasks/install_{{ include_file }}.yaml"
+ with_items:
+ - metrics
+ - heapster
+ - hawkular
+ loop_control:
+ loop_var: include_file
+- name: create objects
+ command: >
+ {{ openshift.common.client_binary }} -n '{{ metrics_project }}'
+ apply -f {{ item }}
+ with_fileglob:
+ - "{{ mktemp.stdout }}/templates/*.yaml"
diff --git a/roles/openshift_metrics/tasks/setup_certificate.yaml b/roles/openshift_metrics/tasks/setup_certificate.yaml
new file mode 100644
index 000000000..46ac4ea7f
--- /dev/null
+++ b/roles/openshift_metrics/tasks/setup_certificate.yaml
@@ -0,0 +1,50 @@
+---
+- name: generate {{ component }} keys
+ command: >
+ {{ openshift.common.admin_binary }} ca create-server-cert
+ --key='{{ mktemp.stdout }}/certs/{{ component }}.key'
+ --cert='{{ mktemp.stdout }}/certs/{{ component }}.crt'
+ --hostnames='{{ hostnames }}'
+ --signer-cert='{{ mktemp.stdout }}/certs/ca.crt'
+ --signer-key='{{ mktemp.stdout }}/certs/ca.key'
+ --signer-serial='{{ mktemp.stdout }}/certs/ca.serial.txt'
+- name: generate {{ component }} certificate
+ shell: >
+ cat
+ '{{ mktemp.stdout|quote }}/certs/{{ component|quote }}.key'
+ '{{ mktemp.stdout|quote }}/certs/{{ component|quote }}.crt'
+ > '{{ mktemp.stdout|quote }}/certs/{{ component|quote }}.pem'
+- name: generate random password for the {{ component }} keystore
+ shell: tr -dc _A-Z-a-z-0-9 < /dev/urandom | head -c15
+ register: keystore_pwd
+- name: create the password file for {{ component }}
+ shell: >
+ echo '{{ keystore_pwd.stdout|quote }}'
+ > '{{ mktemp.stdout }}/certs/{{ component|quote }}-keystore.pwd'
+- name: create the {{ component }} pkcs12 from the pem file
+ command: >
+ openssl pkcs12 -export
+ -in '{{ mktemp.stdout }}/certs/{{ component }}.pem'
+ -out '{{ mktemp.stdout }}/certs/{{ component }}.pkcs12'
+ -name '{{ component }}' -noiter -nomaciter
+ -password 'pass:{{ keystore_pwd.stdout }}'
+- name: create the {{ component }} keystore from the pkcs12 file
+ command: >
+ keytool -v -importkeystore
+ -srckeystore '{{ mktemp.stdout }}/certs/{{ component }}.pkcs12'
+ -srcstoretype PKCS12
+ -destkeystore '{{ mktemp.stdout }}/certs/{{ component }}.keystore'
+ -deststoretype JKS
+ -deststorepass '{{ keystore_pwd.stdout }}'
+ -srcstorepass '{{ keystore_pwd.stdout }}'
+- name: create the {{ component }} certificate
+ command: >
+ keytool -noprompt -export
+ -alias '{{ component }}'
+ -file '{{ mktemp.stdout }}/certs/{{ component }}.cert'
+ -keystore '{{ mktemp.stdout }}/certs/{{ component }}.keystore'
+ -storepass '{{ keystore_pwd.stdout }}'
+- name: generate random password for the {{ component }} truststore
+ shell: >
+ tr -dc _A-Z-a-z-0-9 < /dev/urandom | head -c15
+ > '{{ mktemp.stdout }}/certs/{{ component|quote }}-truststore.pwd'