opendev/system-config
Code Issues Proposed changes
system-config/inventory/groups.yaml
Ian Wienand afd907c16d letsencrypt support 
This change contains the roles and testing for deploying certificates
on hosts using letsencrypt with domain authentication.

From a top level, the process is implemented in the roles as follows:

1) letsencrypt-acme-sh-install

   This role installs the acme.sh tool on hosts in the letsencrypt
   group, along with a small custom driver script to help parse output
   that is used by later roles.

2) letsencrypt-request-certs

   This role runs on each host, and reads a host variable describing
   the certificates required.  It uses the acme.sh tool (via the
   driver) to request the certificates from letsencrypt.  It populates
   a global Ansible variable with the authentication TXT records
   required.

   If the certificate exists on the host and is not within the renewal
   period, it should do nothing.

3) letsencrypt-install-txt-record

   This role runs on the adns server.  It installs the TXT records
   generated in step 2 to the acme.opendev.org domain and then
   refreshes the server.  Hosts wanting certificates will have
   pre-provisioned CNAME records for _acme-challenge.host.opendev.org
   pointing to acme.opendev.org.

4) letsencrypt-create-certs

   This role runs on each host, reading the same variable as in step
   2.  However this time the acme.sh tool is run to authenticate and
   create the certificates, which should now work correctly via the
   TXT records from step 3.  After this, the host will have the
   full certificate material.

Testing is added via testinfra.  For testing purposes requests are
made to the staging letsencrypt servers and a self-signed certificate
is provisioned in step 4 (as the authentication is not available
during CI).  We test that the DNS TXT records are created locally on
the CI adns server, however.

Related-Spec: https://review.openstack.org/587283

Change-Id: I1f66da614751a29cc565b37cdc9ff34d70fdfd3f
2019-04-02 15:31:41 +11:00

265 lines
6.9 KiB
YAML
Raw Blame History

plugin: yamlgroup
groups:
adns: adns*.open*.org
afs: afs[0-9]*.open*.org
afs-client:
- review-dev[0-9]*.open*.org
- mirror[0-9]*.open*.org
- files[0-9]*.open*.org
- ze[0-9]*.open*.org
- afsdb*.open*.org
- afs[0-9]*.open*.org
afsadmin: mirror-update[0-9]*.open*.org
afsdb: afsdb[0-9]*.open*.org
ask: ask*.open*.org
cacti: cacti[0-9]*.open*.org
disabled:
- ask-staging.openstack.org
- ask-staging01.openstack.org
- backup01.ord.rax.ci.openstack.org
- corvustest
- ethercalc01.openstack.org
- idp.openstackid.org
- lists-dev01.openstack.org
- mirror01.sto2.citycloud.openstack.org
- wiki-dev01.openstack.org
- wiki-upgrade-test.openstack.org
dns:
- adns*.opendev.org
- ns*.opendev.org
eavesdrop: eavesdrop[0-9]*.open*.org
elasticsearch: elasticsearch[0-9]*.open*.org
ethercalc: ethercalc*.open*.org
etherpad: etherpad[0-9]*.open*.org
etherpad-dev: etherpad-dev[0-9]*.open*.org
files: files[0-9]*.open*.org
firehose: firehose[0-9]*.open*.org
futureparser:
- afs[0-9]*.open*.org
- afsdb[0-9]*.open*.org
- ask*.open*.org
- git.openstack.org
- git[0-9]*.openstack.org
- kdc[0-9]*.open*.org
- lists*.katacontainers.io
- lists*.open*.org
- nb[0-9]*.open*.org
- nl[0-9]*.open*.org
- review[0-9]*.open*.org
- ze[0-9]*.open*.org
- zk[0-9]*.open*.org
- zm[0-9]*.open*.org
- zuul01.open*.org
gerrit:
- review-dev[0-9]*.open*.org
- review[0-9]*.open*.org
git-loadbalancer:
- git.openstack.org
git-server:
- git[0-9]*.openstack.org
gitea:
- gitea[0-9]*.opendev.org
gitea-lb:
- gitea-lb[0-9]*.opendev.org
grafana:
- grafana[0-9]*.open*.org
graphite:
- graphite*.open*.org
groups:
- groups*.open*.org
health:
- health[0-9]*.openstack.org
kdc:
- kdc[0-9]*.open*.org
kubernetes:
- opendev-k8s*.opendev.org
# letsencrypt:
# - TBD
logstash:
- logstash[0-9]*.open*.org
logstash-worker:
- logstash-worker[0-9]*.open*.org
mailman:
- lists*.katacontainers.io
- lists*.open*.org
mirror:
- mirror[0-9]*.open*.org
nodepool:
- nb[0-9]*.open*.org
- nl[0-9]*.open*.org
nodepool-builder:
- nb[0-9]*.open*.org
nodepool-launcher:
- nl[0-9]*.open*.org
ns:
- ns[0-9]*.open*.org
openstackid-dev:
- openstackid-dev*.openstack.org
openstackid:
- openstackid.org
- openstackid[0-9]*.openstack.org
paste:
- paste[0-9]*.open*.org
pbx:
- pbx[0-9]*.opendev.org
puppet:
- afs[0-9]*.open*.org
- afsdb[0-9]*.open*.org
- ask*.open*.org
- backup[0-9]*.open*.org
- cacti[0-9]*.open*.org
- codesearch[0-9]*.open*.org
- corvustest
- eavesdrop[0-9]*.open*.org
- elasticsearch[0-9]*.open*.org
- ethercalc[0-9]*.open*.org
- etherpad-dev[0-9]*.open*.org
- etherpad[0-9]*.open*.org
- files[0-9]*.open*.org
- firehose[0-9]*.open*.org
- git[0-9]*.openstack.org
- git.openstack.org
- grafana[0-9]*.open*.org
- graphite*.open*.org
- groups-dev*.open*.org
- groups*.open*.org
- health[0-9]*.openstack.org
- kdc[0-9]*.open*.org
- lists*.katacontainers.io
- lists*.open*.org
- logstash-worker[0-9]*.open*.org
- logstash[0-9]*.open*.org
- mirror-update[0-9]*.open*.org
- mirror[0-9]*.open*.org
- nb[0-9]*.open*.org
- nl[0-9]*.open*.org
- openstackid-dev*.openstack.org
- openstackid.org
- openstackid[0-9]*.openstack.org
- paste[0-9]*.open*.org
- pbx[0-9]*.opendev.org
- planet[0-9]*.open*.org
- refstack*.open*.org
- review-dev[0-9]*.open*.org
- review[0-9]*.open*.org
- static*.open*.org
- status*.open*.org
- storyboard-dev[0-9]*.opendev.org
- storyboard[0-9]*.opendev.org
- subunit-worker[0-9]*.open*.org
- survey[0-9]*.open*.org
- translate-dev[0-9]*.open*.org
- translate[0-9]*.open*.org
- wiki-dev[0-9]*.openstack.org
- wiki[0-9]*.openstack.org
- ze[0-9]*.open*.org
- zm[0-9]*.open*.org
- zuul[0-9]*.open*.org
- zk[0-9]*.open*.org
puppet4:
- ask-staging[0-9]*.open*.org
- cacti[0-9]*.open*.org
- codesearch[0-9]*.open*.org
- eavesdrop[0-9]*.open*.org
- elasticsearch[0-9]*.open*.org
- ethercalc[0-9]*.open*.org
- etherpad[0-9]*.open*.org
- etherpad-dev[0-9]*.open*.org
- files[0-9]*.open*.org
- firehose[0-9]*.open*.org
- groups-dev*.open*.org
- grafana[0-9]*.open*.org
- graphite[0-9]*.open*.org
- groups*.open*.org
- health[0-9]*.openstack.org
- lists-dev[0-9]*.open*.org
- logstash-worker[0-9]*.open*.org
- logstash[0-9]*.open*.org
- mirror-update[0-9]*.open*.org
- mirror[0-9]*.*.*.open*.org
- openstackid[0-9]*.openstack.org
- openstackid-dev[0-9]*.openstack.org
- paste[0-9]*.open*.org
- pbx[0-9]*.opendev.org
- planet[0-9]*.open*.org
- refstack*.open*.org
- review-dev[0-9]*.open*.org
- static*.open*.org
- status*.open*.org
- storyboard[0-9]*.opendev.org
- storyboard-dev[0-9]*.opendev.org
- subunit-worker[0-9]*.open*.org
- survey[0-9]*.open*.org
- translate[0-9]*.open*.org
- translate-dev[0-9]*.open*.org
- wiki[0-9]*.openstack.org
- wiki-dev[0-9]*.openstack.org
refstack:
- refstack*.open*.org
registry:
- insecure-ci-registry[0-9]*.opendev.org
review-dev:
- review-dev[0-9]*.open*.org
review:
- review[0-9]*.open*.org
static:
- static*.open*.org
status:
- status*.open*.org
storyboard:
- storyboard[0-9]*.opendev.org
storyboard-dev:
- storyboard-dev[0-9]*.opendev.org
subunit-worker:
- subunit-worker[0-9]*.open*.org
survey:
- survey[0-9]*.open*.org
translate-dev:
- translate-dev[0-9]*.open*.org
translate:
- translate[0-9]*.open*.org
webservers:
- ask*.open*.org
- cacti[0-9]*.open*.org
- codesearch[0-9]*.open*.org
- eavesdrop[0-9]*.open*.org
- ethercalc[0-9]*.open*.org
- etherpad-dev[0-9]*.open*.org
- etherpad[0-9]*.open*.org
- files[0-9]*.open*.org
- grafana[0-9]*.open*.org
- graphite*.open*.org
- groups*.open*.org
- health[0-9]*.openstack.org
- nb[0-9]*.open*.org
- nl[0-9]*.open*.org
- openstackid-dev*.openstack.org
- openstackid.org
- openstackid[0-9]*.openstack.org
- paste[0-9]*.open*.org
- planet[0-9]*.open*.org
- refstack*.open*.org
- static*.open*.org
- status*.open*.org
- storyboard-dev[0-9]*.opendev.org
- storyboard[0-9]*.opendev.org
- survey[0-9]*.open*.org
- translate-dev[0-9]*.open*.org
- translate[0-9]*.open*.org
- wiki-dev[0-9]*.openstack.org
- wiki[0-9]*.openstack.org
wiki:
- wiki[0-9]*.openstack.org
wiki-dev:
- wiki-dev[0-9]*.openstack.org
zookeeper:
- zk[0-9]*.open*.org
zuul-executor:
- ze[0-9]*.open*.org
zuul-merger:
- zm[0-9]*.open*.org
zuul-preview:
- zp[0-9]*.open*.org
zuul-scheduler:
- zuul[0-9]*.open*.org
View Git Blame Copy Permalink