Skip to content

Commit 5e673ed

Browse files
adamlazik1adamlazik1
committed
Introduce SSH cert support
1 parent f6d14e8 commit 5e673ed

File tree

4 files changed

+63
-26
lines changed

4 files changed

+63
-26
lines changed

‎manifests/plugin/ansible.pp‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,6 @@
5050
$foreman_ssl_key = pick($foreman_proxy::foreman_ssl_key, $foreman_proxy::ssl_key)
5151
$foreman_ssl_ca = pick($foreman_proxy::foreman_ssl_ca, $foreman_proxy::ssl_ca)
5252

53-
file { "${foreman_proxy::config_dir}/ansible.env":
54-
ensure => file,
55-
content => template('foreman_proxy/plugin/ansible.env.erb'),
56-
owner => 'root',
57-
group => $foreman_proxy::user,
58-
mode => '0640',
59-
}
60-
6153
if ($facts['os']['family'] in ['RedHat', 'Debian'] and $foreman_proxy::plugin::ansible::callback == 'theforeman.foreman.foreman') {
6254
stdlib::ensure_packages(['ansible-collection-theforeman-foreman'])
6355
}
@@ -68,6 +60,24 @@
6860
include foreman_proxy::plugin::ansible::runner
6961
}
7062

63+
$certificate_file_option = $foreman_proxy::plugin::remote_execution::script::ssh_user_ca_public_key_file ? {
64+
undef => '',
65+
default => " -o CertificateFile=${foreman_proxy::plugin::remote_execution::script::ssh_identity_path}-cert.pub",
66+
}
67+
$host_ca_options = $foreman_proxy::plugin::remote_execution::script::ssh_host_ca_public_key ? {
68+
undef => '',
69+
default => " -o UserKnownHostsFile=${foreman_proxy::plugin::remote_execution::script::ssh_ca_known_hosts_file} -o StrictHostKeyChecking=yes",
70+
}
71+
$ansible_ssh_args = "${ssh_args}${certificate_file_option}${host_ca_options}"
72+
73+
file { "${foreman_proxy::config_dir}/ansible.env":
74+
ensure => file,
75+
content => template('foreman_proxy/plugin/ansible.env.erb'),
76+
owner => 'root',
77+
group => $foreman_proxy::user,
78+
mode => '0640',
79+
}
80+
7181
foreman_proxy::plugin::module { 'ansible':
7282
enabled => $enabled,
7383
listen_on => $listen_on,

‎manifests/plugin/remote_execution/script.pp‎

Lines changed: 37 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -4,42 +4,45 @@
44
#
55
# === Parameters:
66
#
7-
# $mode:: Operation Mode of the plugin.
7+
# $mode:: Operation Mode of the plugin.
88
#
9-
# $cockpit_integration:: Enables/disables Cockpit integration
9+
# $cockpit_integration:: Enables/disables Cockpit integration
1010
#
1111
# === SSH parameters:
1212
#
13-
# $generate_keys:: Automatically generate SSH keys
13+
# $generate_keys:: Automatically generate SSH keys
1414
#
15-
# $install_key:: Automatically install generated SSH key to root authorized keys
16-
# which allows managing this host through Remote Execution
15+
# $install_key:: Automatically install generated SSH key to root authorized keys which allows managing this host through Remote Execution
1716
#
18-
# $ssh_identity_dir:: Directory where SSH keys are stored
17+
# $ssh_identity_dir:: Directory where SSH keys are stored
1918
#
20-
# $ssh_identity_file:: Provide an alternative name for the SSH keys
19+
# $ssh_identity_file:: Provide an alternative name for the SSH keys
2120
#
22-
# $ssh_keygen:: Location of the ssh-keygen binary
21+
# $ssh_user_ca_public_key_file:: Public key file for the SSH CA certificate
2322
#
24-
# $ssh_kerberos_auth:: Enable kerberos authentication for SSH
23+
# $ssh_host_ca_public_key:: Trusted host CA public key
2524
#
26-
# $local_working_dir:: Local working directory on the smart proxy
25+
# $ssh_keygen:: Location of the ssh-keygen binary
2726
#
28-
# $remote_working_dir:: Remote working directory on clients
27+
# $ssh_kerberos_auth:: Enable kerberos authentication for SSH
2928
#
30-
# $ssh_log_level:: Configure ssh client LogLevel
29+
# $local_working_dir:: Local working directory on the smart proxy
30+
#
31+
# $remote_working_dir:: Remote working directory on clients
32+
#
33+
# $ssh_log_level:: Configure ssh client LogLevel
3134
#
3235
# === Advanced parameters:
3336
#
34-
# $enabled:: Enables/disables the plugin
37+
# $enabled:: Enables/disables the plugin
3538
#
36-
# $listen_on:: Proxy feature listens on https, http, or both
39+
# $listen_on:: Proxy feature listens on https, http, or both
3740
#
38-
# $mqtt_ttl:: Time interval in seconds given to the host to pick up the job before considering the job undelivered.
41+
# $mqtt_ttl:: Time interval in seconds given to the host to pick up the job before considering the job undelivered.
3942
#
40-
# $mqtt_rate_limit:: Number of jobs that are allowed to run at the same time
43+
# $mqtt_rate_limit:: Number of jobs that are allowed to run at the same time
4144
#
42-
# $mqtt_resend_interval:: Time interval in seconds at which the notification should be re-sent to the host until the job is picked up or canceleld
45+
# $mqtt_resend_interval:: Time interval in seconds at which the notification should be re-sent to the host until the job is picked up or canceleld
4346
#
4447
class foreman_proxy::plugin::remote_execution::script (
4548
Boolean $enabled = true,
@@ -48,6 +51,8 @@
4851
Boolean $install_key = false,
4952
Stdlib::Absolutepath $ssh_identity_dir = '/var/lib/foreman-proxy/ssh',
5053
String $ssh_identity_file = 'id_rsa_foreman_proxy',
54+
Optional[Stdlib::Absolutepath] $ssh_user_ca_public_key_file = undef,
55+
Optional[String] $ssh_host_ca_public_key = undef,
5156
String $ssh_keygen = '/usr/bin/ssh-keygen',
5257
Stdlib::Absolutepath $local_working_dir = '/var/tmp',
5358
Stdlib::Absolutepath $remote_working_dir = '/var/tmp',
@@ -59,6 +64,7 @@
5964
Optional[Integer] $mqtt_rate_limit = undef,
6065
Optional[Integer] $mqtt_resend_interval = undef,
6166
) {
67+
$ssh_ca_known_hosts_file = "${ssh_identity_dir}/foreman_known_hosts_ca"
6268
$ssh_identity_path = "${ssh_identity_dir}/${ssh_identity_file}"
6369

6470
include foreman_proxy
@@ -87,5 +93,19 @@
8793
ssl_key => $foreman_proxy::ssl_key,
8894
}
8995

96+
if $ssh_host_ca_public_key {
97+
file { $ssh_ca_known_hosts_file:
98+
ensure => file,
99+
owner => $foreman_proxy::user,
100+
group => $foreman_proxy::group,
101+
mode => '0600',
102+
content => "@cert-autority * ${ssh_host_ca_public_key}\n",
103+
}
104+
} else {
105+
file { $ssh_ca_known_hosts_file:
106+
ensure => absent,
107+
}
108+
}
109+
90110
Class['foreman_proxy::config'] ~> Class['foreman_proxy::plugin::remote_execution::mosquitto']
91111
}

‎templates/plugin/ansible.env.erb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@ export FOREMAN_SSL_CERT="<%= @foreman_ssl_cert %>"
1010
export FOREMAN_SSL_KEY="<%= @foreman_ssl_key %>"
1111
export FOREMAN_SSL_VERIFY="<%= @foreman_ssl_ca %>"
1212

13-
export ANSIBLE_SSH_ARGS="<%= @ssh_args %>"
13+
export ANSIBLE_SSH_ARGS="<%= @ansible_ssh_args %>"

‎templates/plugin/remote_execution_ssh.yml.erb‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,13 @@
1010

1111
:cockpit_integration: <%= scope.lookupvar('::foreman_proxy::plugin::remote_execution::script::cockpit_integration') %>
1212

13+
<% if ssh_user_ca_public_key_file = scope.lookupvar('::foreman_proxy::plugin::remote_execution::script::ssh_user_ca_public_key_file') -%>
14+
:ssh_user_ca_public_key_file: <%= ssh_user_ca_public_key_file %>
15+
<% end -%>
16+
<% if ssh_ca_known_hosts_file = scope.lookupvar('::foreman_proxy::plugin::remote_execution::script::ssh_ca_known_hosts_file') -%>
17+
:ssh_ca_known_hosts_file: <%= ssh_ca_known_hosts_file %>
18+
<% end -%>
19+
1320
# Whether to run remote execution jobs asynchronously
1421
:mode: <%= scope.lookupvar("::foreman_proxy::plugin::remote_execution::script::mode") %>
1522
<% if scope.lookupvar("::foreman_proxy::plugin::remote_execution::script::mode") == 'pull-mqtt' -%>

0 commit comments

Comments
 (0)