c1aff2ed38
This adds a role and related testing to manage our Kerberos KDC servers, intended to replace the puppet modules currently performing this task. This role automates realm creation, initial setup, key material distribution and replica host configuration. None of this is intended to run on the production servers which are already setup with an active database, and the role should be effectively idempotent in production. Note that this does not yet switch the production servers into the new groups; this can be done in a separate step under controlled conditions and with related upgrades of the host OS to Focal. Change-Id: I60b40897486b29beafc76025790c501b5055313d
65 lines
1.6 KiB
YAML
65 lines
1.6 KiB
YAML
- name: Install packages
|
|
package:
|
|
name:
|
|
- krb5-kdc
|
|
- krb5-kpropd
|
|
state: present
|
|
|
|
# This is the key to unencrypt the database pushed by the primary
|
|
- name: Install stash file from primary
|
|
shell:
|
|
cmd: 'echo "{{ hostvars[groups["kerberos-kdc-primary"][0]]["kerberos_kdc_stash_file_contents"].content }}" | base64 -d > /etc/krb5kdc/stash'
|
|
creates: '/etc/krb5kdc/stash'
|
|
|
|
- name: Ensure stash file permsissions
|
|
file:
|
|
path: /etc/krb5kdc/stash
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
|
|
# Use the admin user to write out our host keytab
|
|
- name: Create host keytab
|
|
shell:
|
|
cmd: |
|
|
echo "ktadd host/{{ inventory_hostname }}" | kadmin -p admin/admin -w '{{ hostvars[groups["kerberos-kdc-primary"][0]]["kerberos_kdc_admin_password"] }}'
|
|
creates: '/etc/krb5.keytab'
|
|
|
|
# This specifies servers that are allowed to send us updates;
|
|
# i.e. the primary server
|
|
- name: Install kpropd ACL
|
|
template:
|
|
src: 'kpropd.acl.j2'
|
|
dest: '/etc/krb5kdc/kpropd.acl'
|
|
mode: 0644
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Install kpropd service
|
|
copy:
|
|
src: krb5-kpropd.service
|
|
dest: /etc/systemd/system/krb5-kpropd.service
|
|
mode: 0644
|
|
owner: root
|
|
group: root
|
|
register: _kpropd_service_installed
|
|
|
|
- name: Reload systemd
|
|
systemd:
|
|
daemon_reload: yes
|
|
when: _kpropd_service_installed.changed
|
|
|
|
- name: Ensure kpropd running
|
|
systemd:
|
|
state: started
|
|
name: krb5-kpropd
|
|
enabled: yes
|
|
|
|
# Note we can't start until replicas are distributed; the main
|
|
# service-kerberos.yaml playbook handles this.
|
|
- name: Ensure krb5-kdc is enabled
|
|
systemd:
|
|
name: krb5-kdc
|
|
enabled: yes
|
|
masked: no
|