hortonworks_security/02_general_ssl_setup.yml at master · matrixbi/hortonworks_security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
- name: Copy all nodes cetificates to every node
  copy:
    src: /home/dba/ssl/certs/{{ item }}.crt
    dest: /etc/security/serverKeys/certs
  with_items:
    - "{{ ansible_play_batch|lower }}"

- name: Copy all nodes java keystores to every node
  copy:
    src: /home/dba/ssl/jks/{{ item }}-keystore.jks
    dest: /etc/security/serverKeys/jks/
  with_items:
    - "{{ ansible_play_batch|lower }}"

- name: Create copy of keystore file with generic name
  copy:
    remote_src: yes
    src: /etc/security/serverKeys/jks/{{ inventory_hostname|lower }}-keystore.jks
    dest: /etc/security/serverKeys/jks/keystore.jks

- name: Import ROOT and INT CAs to keystore
  shell: keytool -import -alias {{ item.alias }} -trustcacerts -file /etc/security/serverKeys/certs/{{ item.cert }} -keystore /etc/security/serverKeys/jks/{{ inventory_hostname|lower }}-keystore.jks -storepass {{ security_password }} -noprompt
  with_items:
    - { cert: 'RootCA.cer', alias: 'rootca' }
    - { cert: 'SubCA.cer', alias: 'intca' }
  ignore_errors: True

- name: Import certs into node keystore
  java_cert:
    cert_alias: "{{ item.alias | default( item ) }}"
    cert_path: /etc/security/serverKeys/certs/{{ item.cert | default( item ~ '.crt' ) }}
    keystore_path: /etc/security/serverKeys/jks/keystore.jks
    keystore_pass: "{{ security_password }}"
    state: present
  with_items:
    - "{{ ansible_play_batch|lower }}"

- name: Import certs into node truststore
  java_cert:
    cert_alias: "{{ item.alias | default( item ) }}"
    cert_path: /etc/security/serverKeys/certs/{{ item.cert | default( item ~ '.crt' ) }}
    keystore_path: /etc/security/serverKeys/jks/truststore.jks
    keystore_pass: "{{ security_password }}"
    keystore_create: yes
    state: present
  with_items:
    - "{{ ansible_play_batch|lower }}"

- name: Import ROOT and INT CAs to truststore
  shell: keytool -import -alias {{ item.alias }} -trustcacerts -file /etc/security/serverKeys/certs/{{ item.cert }} -keystore /etc/security/serverKeys/jks/truststore.jks -storepass {{ security_password }} -noprompt
  with_items:
    - { cert: 'RootCA.cer', alias: 'rootca' }
    - { cert: 'SubCA.cer', alias: 'intca' }
  ignore_errors: True