Skip to content

Commit a9906b3

Browse files
adamlazik1adamlazik1
committed
Introduce SSH cert support
1 parent a9a5ab0 commit a9906b3

File tree

4 files changed

+64
-26
lines changed

4 files changed

+64
-26
lines changed

‎manifests/plugin/ansible.pp‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,6 @@
5050
$foreman_ssl_key = pick($foreman_proxy::foreman_ssl_key, $foreman_proxy::ssl_key)
5151
$foreman_ssl_ca = pick($foreman_proxy::foreman_ssl_ca, $foreman_proxy::ssl_ca)
5252

53-
file { "${foreman_proxy::config_dir}/ansible.env":
54-
ensure => file,
55-
content => template('foreman_proxy/plugin/ansible.env.erb'),
56-
owner => 'root',
57-
group => $foreman_proxy::user,
58-
mode => '0640',
59-
}
60-
6153
if ($facts['os']['family'] in ['RedHat', 'Debian'] and $foreman_proxy::plugin::ansible::callback == 'theforeman.foreman.foreman') {
6254
stdlib::ensure_packages(['ansible-collection-theforeman-foreman'])
6355
}
@@ -68,6 +60,24 @@
6860
include foreman_proxy::plugin::ansible::runner
6961
}
7062

63+
$certificate_file_option = $foreman_proxy::plugin::remote_execution::script::ssh_user_ca_public_key_file ? {
64+
undef => '',
65+
default => " -o CertificateFile=${foreman_proxy::plugin::remote_execution::script::ssh_identity_path}-cert.pub",
66+
}
67+
$host_ca_options = $foreman_proxy::plugin::remote_execution::script::ssh_host_ca_public_key ? {
68+
undef => '',
69+
default => " -o UserKnownHostsFile=${foreman_proxy::plugin::remote_execution::script::ssh_ca_known_hosts_file} -o StrictHostKeyChecking=yes",
70+
}
71+
$ansible_ssh_args = "${ssh_args}${certificate_file_option}${host_ca_options}"
72+
73+
file { "${foreman_proxy::config_dir}/ansible.env":
74+
ensure => file,
75+
content => template('foreman_proxy/plugin/ansible.env.erb'),
76+
owner => 'root',
77+
group => $foreman_proxy::user,
78+
mode => '0640',
79+
}
80+
7181
foreman_proxy::plugin::module { 'ansible':
7282
enabled => $enabled,
7383
listen_on => $listen_on,

‎manifests/plugin/remote_execution/script.pp‎

Lines changed: 38 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -4,42 +4,46 @@
44
#
55
# === Parameters:
66
#
7-
# $mode:: Operation Mode of the plugin.
7+
# $mode:: Operation Mode of the plugin.
88
#
9-
# $cockpit_integration:: Enables/disables Cockpit integration
9+
# $cockpit_integration:: Enables/disables Cockpit integration
1010
#
1111
# === SSH parameters:
1212
#
13-
# $generate_keys:: Automatically generate SSH keys
13+
# $generate_keys:: Automatically generate SSH keys
1414
#
15-
# $install_key:: Automatically install generated SSH key to root authorized keys
16-
# which allows managing this host through Remote Execution
15+
# $install_key:: Automatically install generated SSH key to root authorized keys
16+
# which allows managing this host through Remote Execution
1717
#
18-
# $ssh_identity_dir:: Directory where SSH keys are stored
18+
# $ssh_identity_dir:: Directory where SSH keys are stored
1919
#
20-
# $ssh_identity_file:: Provide an alternative name for the SSH keys
20+
# $ssh_identity_file:: Provide an alternative name for the SSH keys
2121
#
22-
# $ssh_keygen:: Location of the ssh-keygen binary
22+
# $ssh_user_ca_public_key_file:: Public key file for the SSH CA certificate
2323
#
24-
# $ssh_kerberos_auth:: Enable kerberos authentication for SSH
24+
# $ssh_host_ca_public_key:: Trusted host CA public key
2525
#
26-
# $local_working_dir:: Local working directory on the smart proxy
26+
# $ssh_keygen:: Location of the ssh-keygen binary
2727
#
28-
# $remote_working_dir:: Remote working directory on clients
28+
# $ssh_kerberos_auth:: Enable kerberos authentication for SSH
2929
#
30-
# $ssh_log_level:: Configure ssh client LogLevel
30+
# $local_working_dir:: Local working directory on the smart proxy
31+
#
32+
# $remote_working_dir:: Remote working directory on clients
33+
#
34+
# $ssh_log_level:: Configure ssh client LogLevel
3135
#
3236
# === Advanced parameters:
3337
#
34-
# $enabled:: Enables/disables the plugin
38+
# $enabled:: Enables/disables the plugin
3539
#
36-
# $listen_on:: Proxy feature listens on https, http, or both
40+
# $listen_on:: Proxy feature listens on https, http, or both
3741
#
38-
# $mqtt_ttl:: Time interval in seconds given to the host to pick up the job before considering the job undelivered.
42+
# $mqtt_ttl:: Time interval in seconds given to the host to pick up the job before considering the job undelivered.
3943
#
40-
# $mqtt_rate_limit:: Number of jobs that are allowed to run at the same time
44+
# $mqtt_rate_limit:: Number of jobs that are allowed to run at the same time
4145
#
42-
# $mqtt_resend_interval:: Time interval in seconds at which the notification should be re-sent to the host until the job is picked up or canceleld
46+
# $mqtt_resend_interval:: Time interval in seconds at which the notification should be re-sent to the host until the job is picked up or canceleld
4347
#
4448
class foreman_proxy::plugin::remote_execution::script (
4549
Boolean $enabled = true,
@@ -48,6 +52,8 @@
4852
Boolean $install_key = false,
4953
Stdlib::Absolutepath $ssh_identity_dir = '/var/lib/foreman-proxy/ssh',
5054
String $ssh_identity_file = 'id_rsa_foreman_proxy',
55+
Optional[Stdlib::Absolutepath] $ssh_user_ca_public_key_file = undef,
56+
Optional[String] $ssh_host_ca_public_key = undef,
5157
String $ssh_keygen = '/usr/bin/ssh-keygen',
5258
Stdlib::Absolutepath $local_working_dir = '/var/tmp',
5359
Stdlib::Absolutepath $remote_working_dir = '/var/tmp',
@@ -59,6 +65,7 @@
5965
Optional[Integer] $mqtt_rate_limit = undef,
6066
Optional[Integer] $mqtt_resend_interval = undef,
6167
) {
68+
$ssh_ca_known_hosts_file = "${ssh_identity_dir}/foreman_known_hosts_ca"
6269
$ssh_identity_path = "${ssh_identity_dir}/${ssh_identity_file}"
6370

6471
include foreman_proxy
@@ -87,5 +94,19 @@
8794
ssl_key => $foreman_proxy::ssl_key,
8895
}
8996

97+
if $ssh_host_ca_public_key {
98+
file { $ssh_ca_known_hosts_file:
99+
ensure => file,
100+
owner => $foreman_proxy::user,
101+
group => $foreman_proxy::group,
102+
mode => '0600',
103+
content => "@cert-autority * ${ssh_host_ca_public_key}\n",
104+
}
105+
} else {
106+
file { $ssh_ca_known_hosts_file:
107+
ensure => absent,
108+
}
109+
}
110+
90111
Class['foreman_proxy::config'] ~> Class['foreman_proxy::plugin::remote_execution::mosquitto']
91112
}

‎templates/plugin/ansible.env.erb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@ export FOREMAN_SSL_CERT="<%= @foreman_ssl_cert %>"
1010
export FOREMAN_SSL_KEY="<%= @foreman_ssl_key %>"
1111
export FOREMAN_SSL_VERIFY="<%= @foreman_ssl_ca %>"
1212

13-
export ANSIBLE_SSH_ARGS="<%= @ssh_args %>"
13+
export ANSIBLE_SSH_ARGS="<%= @ansible_ssh_args %>"

‎templates/plugin/remote_execution_ssh.yml.erb‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,13 @@
1010

1111
:cockpit_integration: <%= scope.lookupvar('::foreman_proxy::plugin::remote_execution::script::cockpit_integration') %>
1212

13+
<% if ssh_user_ca_public_key_file = scope.lookupvar('::foreman_proxy::plugin::remote_execution::script::ssh_user_ca_public_key_file') -%>
14+
:ssh_user_ca_public_key_file: <%= ssh_user_ca_public_key_file %>
15+
<% end -%>
16+
<% if ssh_ca_known_hosts_file = scope.lookupvar('::foreman_proxy::plugin::remote_execution::script::ssh_ca_known_hosts_file') -%>
17+
:ssh_ca_known_hosts_file: <%= ssh_ca_known_hosts_file %>
18+
<% end -%>
19+
1320
# Whether to run remote execution jobs asynchronously
1421
:mode: <%= scope.lookupvar("::foreman_proxy::plugin::remote_execution::script::mode") %>
1522
<% if scope.lookupvar("::foreman_proxy::plugin::remote_execution::script::mode") == 'pull-mqtt' -%>

0 commit comments

Comments
 (0)