Skip to content
This repository was archived by the owner on Aug 29, 2018. It is now read-only.

Commit 3f25bf1

Browse files
andrewklauandrewklau
committed
Adding TLS encryption to Mcollective
Attempt to split tls_enabled into enabled,disabled,strict Remove duplication Add simple certificate file check
1 parent 6fd2b7b commit 3f25bf1

File tree

13 files changed

+277
-14
lines changed

13 files changed

+277
-14
lines changed

‎Modulefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ project_page 'https://github.com/openshift/puppet-openshift_origin'
66
source 'git://github.com/openshift/puppet-openshift_origin.git'
77
summary 'Module for installing Red Hat Openshift'
88
description 'Configures OpenShift broker, nodes and support servers'
9+
dependency 'puppetlabs/java_ks', '>=1.2.5'
910
dependency 'rharrison/lokkit', '>=0.2.0'
1011
dependency 'puppetlabs/ntp', '>=0.1.0'
1112
dependency 'puppetlabs/stdlib', '>=2.6.0'

‎README.asciidoc‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -463,6 +463,33 @@ not needed by OpenShift but might be useful in troubleshooting.
463463

464464
Default: scrambled
465465

466+
=== msgserver_tls_enabled
467+
This configures mcollective and activemq to use end-to-end encryption over TLS.
468+
Use enabled to support both TLS and non-TLS, or strict to only support TLS.
469+
470+
Default: 'disabled'
471+
472+
=== msgserver_tls_keystore_password
473+
The password used to protect the keystore. It must be greater than 6 characters. This is required.
474+
475+
Default: password
476+
477+
=== msgserver_tls_ca
478+
Location for certificate ca
479+
480+
Default: /var/lib/puppet/ssl/certs/ca.pem
481+
482+
=== msgserver_tls_cert
483+
Location for certificate cert
484+
485+
Default: /var/lib/puppet/ssl/certs/${lower_fqdn}.pem
486+
487+
=== msgserver_tls_key
488+
Location for certificate key
489+
490+
Default: /var/lib/puppet/ssl/private_keys/${lower_fqdn}.pem
491+
492+
466493
=== mcollective_user
467494
=== mcollective_password
468495
This is the user and password shared between broker and node for

‎manifests/activemq_keystores.pp‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
class openshift_origin::activemq_keystores (
2+
3+
$ca = $::openshift_origin::msgserver_tls_ca,
4+
$cert = $::openshift_origin::msgserver_tls_cert,
5+
$private_key = $::openshift_origin::msgserver_tls_key,
6+
$keystore_password = $::openshift_origin::msgserver_tls_keystore_password,
7+
8+
9+
$activemq_confdir = '/etc/activemq',
10+
$activemq_user = 'activemq',
11+
) {
12+
13+
# ----- Restart ActiveMQ if the SSL credentials ever change -----
14+
# ----- Uncomment if you are fully managing ActiveMQ with Puppet. -----
15+
16+
Package['activemq'] -> Class[$title]
17+
Java_ks['activemq_cert:keystore'] ~> Service['activemq']
18+
Java_ks['activemq_ca:truststore'] ~> Service['activemq']
19+
20+
21+
# ----- Manage PEM files -----
22+
23+
File {
24+
owner => root,
25+
group => root,
26+
mode => 0600,
27+
}
28+
file {"${activemq_confdir}/ssl_credentials":
29+
ensure => directory,
30+
mode => 0700,
31+
}
32+
file {"${activemq_confdir}/ssl_credentials/activemq_certificate.pem":
33+
ensure => file,
34+
source => $cert,
35+
}
36+
file {"${activemq_confdir}/ssl_credentials/activemq_private.pem":
37+
ensure => file,
38+
source => $private_key,
39+
}
40+
file {"${activemq_confdir}/ssl_credentials/ca.pem":
41+
ensure => file,
42+
source => $ca,
43+
}
44+
45+
46+
# ----- Manage Keystore Contents -----
47+
48+
# Each keystore should have a dependency on the PEM files it relies on.
49+
50+
# Truststore with copy of CA cert
51+
java_ks { 'activemq_ca:truststore':
52+
ensure => latest,
53+
certificate => "${activemq_confdir}/ssl_credentials/ca.pem",
54+
target => "${activemq_confdir}/truststore.jks",
55+
password => $keystore_password,
56+
trustcacerts => true,
57+
require => File["${activemq_confdir}/ssl_credentials/ca.pem"],
58+
}
59+
60+
# Keystore with ActiveMQ cert and private key
61+
java_ks { 'activemq_cert:keystore':
62+
ensure => latest,
63+
certificate => "${activemq_confdir}/ssl_credentials/activemq_certificate.pem",
64+
private_key => "${activemq_confdir}/ssl_credentials/activemq_private.pem",
65+
target => "${activemq_confdir}/keystore.jks",
66+
password => $keystore_password,
67+
require => [
68+
File["${activemq_confdir}/ssl_credentials/activemq_private.pem"],
69+
File["${activemq_confdir}/ssl_credentials/activemq_certificate.pem"]
70+
],
71+
}
72+
73+
74+
# ----- Manage Keystore Files -----
75+
76+
# Permissions only.
77+
# No ensure, source, or content.
78+
79+
file {"${activemq_confdir}/keystore.jks":
80+
owner => $activemq_user,
81+
group => $activemq_user,
82+
mode => 0600,
83+
require => Java_ks['activemq_cert:keystore'],
84+
}
85+
file {"${activemq_confdir}/truststore.jks":
86+
owner => $activemq_user,
87+
group => $activemq_user,
88+
mode => 0600,
89+
require => Java_ks['activemq_ca:truststore'],
90+
}
91+
92+
}

‎manifests/firewall/activemq.pp‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,24 @@
1717
if $::openshift_origin::manage_firewall {
1818
require openshift_origin::firewall
1919

20+
if $::openshift_origin::msgserver_tls_enabled == 'strict' {
21+
$activemq_port = '61614'
22+
$activemq_openwire_port = '61617'
23+
} elsif $::openshift_origin::msgserver_tls_enabled == 'enabled' {
24+
$activemq_port = '61613-61614'
25+
$activemq_openwire_port = '61616-61617'
26+
} else {
27+
$activemq_port = '61613'
28+
$activemq_openwire_port = '61616'
29+
}
30+
2031
lokkit::ports { 'ActiveMQ':
21-
tcpPorts => [ '61613' ],
32+
tcpPorts => [ $activemq_port ],
2233
}
2334

2435
if $::openshift_origin::msgserver_cluster {
2536
lokkit::ports { 'ActiveMQ-Openwire':
26-
tcpPorts => [ '61616' ],
37+
tcpPorts => [ $activemq_openwire_port ],
2738
}
2839
}
2940
}

‎manifests/init.pp‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,27 @@
307307
# This is the admin password for the ActiveMQ admin console, which is
308308
# not needed by OpenShift but might be useful in troubleshooting.
309309
#
310+
# [*msgserver_tls_enabled*]
311+
# Default: 'disabled'
312+
# This configures mcollective and activemq to use end-to-end encryption over TLS.
313+
# Use enabled to support both TLS and non-TLS, or strict to only support TLS.
314+
#
315+
# [*msgserver_tls_keystore_password*]
316+
# Default: password
317+
# The password used to protect the keystore. It must be greater than 6 characters. This is required.
318+
#
319+
# [*msgserver_tls_ca*]
320+
# Default: /var/lib/puppet/ssl/certs/ca.pem
321+
# Location for certificate ca
322+
#
323+
# [*msgserver_tls_cert*]
324+
# Default: /var/lib/puppet/ssl/certs/${lower_fqdn}.pem
325+
# Location for certificate cert
326+
#
327+
# [*msgserver_tls_key*]
328+
# Default: /var/lib/puppet/ssl/private_keys/${lower_fqdn}.pem
329+
# Location for certificate key
330+
#
310331
# [*mcollective_user*]
311332
# [*mcollective_password*]
312333
# Default: mcollective/marionette
@@ -741,6 +762,7 @@
741762
class openshift_origin (
742763
$ose_version = undef,
743764
$ose_unsupported = false,
765+
$lower_fqdn = $openshift_origin::params::lower_fqdn,
744766
$roles = ['broker','node','msgserver','datastore','nameserver'],
745767
$install_method = 'yum',
746768
$parallel_deployment = false,
@@ -808,6 +830,11 @@
808830
$mcollective_cluster_members = undef,
809831
$msgserver_password = 'changeme',
810832
$msgserver_admin_password = inline_template('<%= require "securerandom"; SecureRandom.base64 %>'),
833+
$msgserver_tls_enabled = 'disabled',
834+
$msgserver_tls_keystore_password = 'password',
835+
$msgserver_tls_ca = "/var/lib/puppet/ssl/certs/ca.pem",
836+
$msgserver_tls_cert = inline_template('<%= "/var/lib/puppet/ssl/certs/#{fqdn.downcase}.pem" %>'),
837+
$msgserver_tls_key = inline_template('<%= "/var/lib/puppet/ssl/private_keys/#{fqdn.downcase}.pem" %>'),
811838
$mcollective_user = 'mcollective',
812839
$mcollective_password = 'marionette',
813840
$mongodb_admin_user = 'admin',

‎manifests/mcollective_client.pp‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,16 @@
3131
$pool_size = '1'
3232
}
3333

34+
if ($::openshift_origin::msgserver_tls_enabled == 'enabled' or $::openshift_origin::msgserver_tls_enabled == 'strict') {
35+
if ($::openshift_origin::msgserver_tls_ca != '') and ($::openshift_origin::msgserver_tls_key != '') and ($::openshift_origin::msgserver_tls_cert != '') {
36+
$tls_certs_provided = true
37+
} else { $tls_certs_provided = false }
38+
}
39+
40+
if ($::openshift_origin::msgserver_tls_enabled == 'strict' and $tls_certs_provided == false) {
41+
fail 'Valid certificate file locations are required when msgserver_tls_enabled is in strict mode.'
42+
}
43+
3444
file { 'mcollective client config':
3545
ensure => present,
3646
path => "${::openshift_origin::params::ruby_scl_path_prefix}/etc/mcollective/client.cfg",

‎manifests/mcollective_server.pp‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,17 @@
3737
ensure => 'directory',
3838
require => Package['mcollective'],
3939
}
40+
41+
if ($::openshift_origin::msgserver_tls_enabled == 'enabled' or $::openshift_origin::msgserver_tls_enabled == 'strict') {
42+
if ($::openshift_origin::msgserver_tls_ca != '') and ($::openshift_origin::msgserver_tls_key != '') and ($::openshift_origin::msgserver_tls_cert != '') {
43+
$tls_certs_provided = true
44+
} else { $tls_certs_provided = false }
45+
}
4046

47+
if ($::openshift_origin::msgserver_tls_enabled == 'strict' and $tls_certs_provided == false) {
48+
fail 'Valid certificate file locations are required when msgserver_tls_enabled is in strict mode.'
49+
}
50+
4151
file { 'mcollective server config':
4252
ensure => present,
4353
path => "${::openshift_origin::params::ruby_scl_path_prefix}/etc/mcollective/server.cfg",

‎manifests/msgserver.pp‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,18 @@
5252
require => Package['activemq'],
5353
}
5454

55+
if ($::openshift_origin::msgserver_tls_enabled == 'enabled') or ($::openshift_origin::msgserver_tls_enabled == 'strict') {
56+
if ($::openshift_origin::msgserver_tls_ca != '') and ($::openshift_origin::msgserver_tls_key != '') and ($::openshift_origin::msgserver_tls_cert != '') {
57+
anchor { 'openshift_origin::msgserver_keystores_begin': } ->
58+
class { 'openshift_origin::activemq_keystores' : } ->
59+
anchor { 'openshift_origin::msgserver_keystores_end': }
60+
61+
$activemq_openwire_port = '61617'
62+
} else { fail 'Valid certificate file locations are required when msgserver_tls_enabled is in strict or enabled mode.' }
63+
} else {
64+
$activemq_openwire_port = '61616'
65+
}
66+
5567
if $::openshift_origin::msgserver_cluster {
5668
$activemq_config_template_real = 'openshift_origin/activemq/activemq-network.xml.erb'
5769
} else {

‎manifests/params.pp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,4 +35,5 @@
3535
$repos_base = $::operatingsystem ? {
3636
default => 'https://mirror.openshift.com/pub/origin-server/nightly/rhel-6',
3737
}
38+
3839
}

‎templates/activemq/activemq-network.xml.erb‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -69,10 +69,10 @@
6969

7070
<networkConnectors>
7171
<% @cluster_remote_members.each do |cluster_remote_member| -%>
72-
<networkConnector name="<%= scope.lookupvar('::openshift_origin::msgserver_fqdn') %>-<%= cluster_remote_member %>-topic" uri="static:(tcp://<%= cluster_remote_member %>:61616)" userName="amquser" password="<%= scope.lookupvar('::openshift_origin::msgserver_password') %>">
72+
<networkConnector name="<%= scope.lookupvar('::openshift_origin::msgserver_fqdn') %>-<%= cluster_remote_member %>-topic" uri="static:(tcp://<%= cluster_remote_member %>:<%= @activemq_openwire_port %>)" userName="amquser" password="<%= scope.lookupvar('::openshift_origin::msgserver_password') %>">
7373
<excludedDestinations><queue physicalName=">" /></excludedDestinations>
7474
</networkConnector>
75-
<networkConnector name="<%= scope.lookupvar('::openshift_origin::msgserver_fqdn') %>-<%= cluster_remote_member %>-queue" uri="static:(tcp://<%= cluster_remote_member %>:61616)" userName="amquser" password="<%= scope.lookupvar('::openshift_origin::msgserver_password') %>"
75+
<networkConnector name="<%= scope.lookupvar('::openshift_origin::msgserver_fqdn') %>-<%= cluster_remote_member %>-queue" uri="static:(tcp://<%= cluster_remote_member %>:<%= @activemq_openwire_port %>)" userName="amquser" password="<%= scope.lookupvar('::openshift_origin::msgserver_password') %>"
7676
conduitSubscriptions="false">
7777
<excludedDestinations><topic physicalName=">" /></excludedDestinations>
7878
</networkConnector>
@@ -137,15 +137,30 @@
137137
</systemUsage>
138138
</systemUsage>
139139

140+
<% if scope.lookupvar('::openshift_origin::msgserver_tls_enabled') == 'enabled' or scope.lookupvar('::openshift_origin::msgserver_tls_enabled') == 'strict' %>
141+
<sslContext>
142+
<sslContext
143+
keyStore="keystore.jks" keyStorePassword="<%= scope.lookupvar('::openshift_origin::msgserver_tls_keystore_password') %>"
144+
trustStore="truststore.jks" trustStorePassword="<%= scope.lookupvar('::openshift_origin::msgserver_tls_keystore_password') %>"
145+
/>
146+
</sslContext>
147+
<% end %>
148+
140149
<!--
141150
The transport connectors expose ActiveMQ over a given protocol to
142151
clients and other brokers. For more information, see:
143152
144153
http://activemq.apache.org/configuring-transports.html
145154
-->
146155
<transportConnectors>
147-
<transportConnector name="openwire" uri="tcp://0.0.0.0:61616"/>
148-
<transportConnector name="stomp" uri="stomp://0.0.0.0:61613"/>
156+
<% if scope.lookupvar('::openshift_origin::msgserver_tls_enabled') != 'disabled' %>
157+
<transportConnector name="openwire+ssl" uri="tcp://0.0.0.0:61617?needClientAuth=true&amp;transport.enabledProtocols=TLSv1,TLSv1.1,TLSv1.2"/>
158+
<transportConnector name="stomp+ssl" uri="stomp+ssl://0.0.0.0:61614?needClientAuth=true&amp;transport.enabledProtocols=TLSv1,TLSv1.1,TLSv1.2"/>
159+
<% end %>
160+
<% if scope.lookupvar('::openshift_origin::msgserver_tls_enabled') != 'strict' %>
161+
<transportConnector name="openwire" uri="tcp://0.0.0.0:61616"/>
162+
<transportConnector name="stomp" uri="stomp://0.0.0.0:61613"/>
163+
<% end %>
149164
</transportConnectors>
150165

151166
</broker>

0 commit comments

Comments
 (0)