Configure TLS on local Pulp

Author: m-bull

etc/kayobe/containers/pulp/pre.yml

@@ -19,3 +19,24 @@
     dest: /opt/kayobe/containers/pulp/settings.py
     mode: 0644
   become: true
+
+- name: Configure TLS for local Pulp
+  when: pulp_enable_tls
+  become: true
+  block:
+    - name: Ensure /opt/kayobe/containers/pulp/certs exists
+      file:
+        path: "/opt/kayobe/containers/pulp/certs"
+        state: directory
+
+    - name: Copy TLS cert and key into container directory
+      template:
+        src: "{{ item.src }}"
+        dest: "/opt/kayobe/containers/pulp/certs/{{ item.dest }}"
+        mode: 0644
+      become: true
+      loop:
+        - src: "{{ pulp_cert_path }}"
+          dest: 'pulp_webserver.crt'
+        - src: "{{ pulp_key_path }}"
+          dest: 'pulp_webserver.key'

etc/kayobe/pulp.yml

@@ -1,10 +1,22 @@
 ---
 ###############################################################################
-# Local Pulp access credentials
+# Local Pulp server configuration
 
 # Base URL of the local Pulp service.
 # Default uses the seed node's IP on the admin network.
-pulp_url: "http://{{ admin_oc_net_name | net_ip(groups['seed'][0]) }}:80"
+pulp_url: "{{ 'https' if pulp_enable_tls else 'http' }}://{{ admin_oc_net_name | net_ip(groups['seed'][0]) }}:80"
+
+# Whether to enable TLS for Pulp.
+pulp_enable_tls: false
+
+# Path to a TLS certificate to use when TLS is enabled.
+#pulp_cert_path:
+
+# Path to a TLS key to use when TLS is enabled.
+#pulp_key_path:
+
+###############################################################################
+# Local Pulp access credentials
 
 # Credentials used to access the local Pulp REST API.
 pulp_username: admin

etc/kayobe/seed.yml

@@ -96,7 +96,7 @@ seed_pulp_container:
     image: pulp/pulp
     pre: "{{ kayobe_config_path }}/containers/pulp/pre.yml"
     post: "{{ kayobe_config_path }}/containers/pulp/post.yml"
-    tag: "3.16"
+    tag: "{{ '3.16-https' if pulp_enable_tls else '3.16' }}"
     network_mode: host
     volumes:
       - /opt/kayobe/containers/pulp:/etc/pulp