fix up certs

anandkumarpatel · anandkumarpatel · commit e6e6f85767ad · 2015-10-13T12:17:33.000-07:00
diff --git a/ansible/group_vars/alpha-swarm-manager.yml b/ansible/group_vars/alpha-swarm-manager.yml
@@ -1,25 +1,21 @@
-name: "swarm"
+name: "swarm-manager"
 
 # container_kill_start settings
 container_image: swarm
 container_tag: 0.4.0
 
-# for redis
-redis_host: "{{ hostvars[groups['redis'][0]]['ansible_default_ipv4']['address'] }}"
-redis_key: "frontend:swarm.{{ domain }}"
-is_redis_update_required: 'yes'
-
 # container_kill_start vars
+log_driver: json-file
+
 container_run_opts: >
   -d
   -p {{ swarm_master_port }}:2375
-  -v /opt/ssl/docker:/etc/ssl/docker:ro
+  -v /opt/ssl/docker/{{ name }}:/etc/ssl/docker:ro
 
 container_run_args: >
+  manage
   --tlsverify
   --tlscacert={{ docker_ca_path }}
   --tlscert={{ docker_cert_path }}
   --tlskey={{ docker_key_path }}
-  manage
-  token://{{ discovery_token }}
-
+  token://{{ swarm_token }}
diff --git a/ansible/group_vars/alpha-swarm-slave.yml b/ansible/group_vars/alpha-swarm-slave.yml
@@ -9,4 +9,4 @@ container_run_opts: >
 container_run_args: >
   join
   --addr={{ ansible_default_ipv4.address }}:{{ docker_port }}
-  token://{{ discovery_token }}
+  token://{{ swarm_token }}
diff --git a/ansible/roles/container_kill_start/tasks/main.yml b/ansible/roles/container_kill_start/tasks/main.yml
@@ -40,7 +40,7 @@
 
 # start our new container with options and args
 - name: start container
-  command: sudo docker run --log-driver=none -v /var/log:/var/log:rw --restart=always {{container_run_opts}} {{container_image}}:{{container_tag}} {{container_run_args}}
+  command: sudo docker run --log-driver={{ log_driver | default("none")}} -v /var/log:/var/log:rw --restart=always {{container_run_opts}} {{container_image}}:{{container_tag}} {{container_run_args}}
   register: new_container_id
   notify:
     - get new container ports
diff --git a/ansible/roles/docker_client/ca.pem b/ansible/roles/docker_client/ca.pem
diff --git a/ansible/roles/docker_client/files/certs/script/genClientCert.sh b/ansible/roles/docker_client/files/certs/script/genClientCert.sh
diff --git a/ansible/roles/docker_client/files/certs/swarm-manager/ca.pem b/ansible/roles/docker_client/files/certs/swarm-manager/ca.pem
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEnjCCA4agAwIBAgIJAK0JF0nQ7r9xMA0GCSqGSIb3DQEBCwUAMIGQMQswCQYD
+VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5j
+aXNjbzERMA8GA1UEChMIUnVubmFibGUxDDAKBgNVBAsTA09wczESMBAGA1UEAxMJ
+bG9jYWxob3N0MR8wHQYJKoZIhvcNAQkBFhBvcHNAcnVubmFibGUuY29tMB4XDTE1
+MDUyMjIxNDY1MloXDTE2MDUyMTIxNDY1MlowgZAxCzAJBgNVBAYTAlVTMRMwEQYD
+VQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMREwDwYDVQQK
+EwhSdW5uYWJsZTEMMAoGA1UECxMDT3BzMRIwEAYDVQQDEwlsb2NhbGhvc3QxHzAd
+BgkqhkiG9w0BCQEWEG9wc0BydW5uYWJsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCkX4cwQDcimGvnJg0HBl+A9da0zpUjJJVPbba3A2wJ/S7l
+gKlYID5TXNYpSAepdmmWO+NEXcNVPUYVhoBe4DWkJFc+lxtLPy0UOseZ+TvMac7i
+Zp0k/GSLl3ASloDPfKsBlpOpM+OhWvl5jzAzSJ1l6dGcCEAXE6dhtEUgPMUzfAfl
+bUuQ7ri8iMB67Ktix8FJCEpwczlKfebzmxw3VxwGiNQSGbbyIknuCk5eGbMVPtdY
+DBl+5R7h0S0enXxYtPtL7CRKs0uHxm8Kmvvo2htSf9bdOSsjnFzQvZdBLrrQipN+
+i8m/ZOL8IOzV/Wfwqd7Zo3w3hUE8rzrBP0Ce0f0BAgMBAAGjgfgwgfUwHQYDVR0O
+BBYEFKoY1K08hkkW4dt/bo0153ccq9sMMIHFBgNVHSMEgb0wgbqAFKoY1K08hkkW
+4dt/bo0153ccq9sMoYGWpIGTMIGQMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2Fs
+aWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzERMA8GA1UEChMIUnVubmFi
+bGUxDDAKBgNVBAsTA09wczESMBAGA1UEAxMJbG9jYWxob3N0MR8wHQYJKoZIhvcN
+AQkBFhBvcHNAcnVubmFibGUuY29tggkArQkXSdDuv3EwDAYDVR0TBAUwAwEB/zAN
+BgkqhkiG9w0BAQsFAAOCAQEAl/wOczN+5etU9iYmhNs4RmKxY33SUnnKPZwD/bFM
+gVEmHu3Gc2hFDJ/+c4BKULBB60j6K+J3In9iTZHzsUe+5HB1J1Wk5ecXMLc51xBs
++Tc3ZsX6PjSkwHWJyXlcdivmpd8O87vkjrLHg5kzeLL+bwkjGngWg/bbNGR4rGu3
+js//+b9GjSMK91lqRE2aegJyqguqDs0qoxGwzSOqlnSSjQze6YmpN9DWO9X7RGpE
+8UswjBeI9DKBIjdzwfF3Zn3ay1ChAhTBnBQE5b2rgIhf6YBw1SP935gfWdbs9AKt
+zBF55uLuWt0nBvXCJcHUBTFUnAfqiuQMZuVxBfXi4vuePg==
+-----END CERTIFICATE-----
diff --git a/ansible/roles/docker_client/files/certs/swarm-manager/cert.pem b/ansible/roles/docker_client/files/certs/swarm-manager/cert.pem
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAlCgAwIBAgIJAJ3gObWAsIjjMA0GCSqGSIb3DQEBCwUAMIGQMQswCQYD
+VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5j
+aXNjbzERMA8GA1UEChMIUnVubmFibGUxDDAKBgNVBAsTA09wczESMBAGA1UEAxMJ
+bG9jYWxob3N0MR8wHQYJKoZIhvcNAQkBFhBvcHNAcnVubmFibGUuY29tMB4XDTE1
+MTAxMzE5MTI1NVoXDTE2MTAxMjE5MTI1NVowETEPMA0GA1UEAxMGY2xpZW50MIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxnIwOEiaAiqxsv7ixToFnzHq
+0Xc4biOgx8tvEYpv0lOXCg4s7n2AS4zqQyNaWze05v/tfghLTEj2j+dFIzkLk3fN
+pmSKu0Jr6xhh1QkyoWsZ20yIgMya9T1P9/8kslqLQ263w5hsG2/z84+Aj6Ku9LYt
+pqda0lpYqXEyeh2XnyzKouP5Qcd8/e1X8mLdZt8pDkaQ4WiG2w3TQ8rbX/7ulNBX
+9PWwzS6FtYA7SeaE9OgwwK6gQLSw60A/kZE+0eLNXoIjxuIICoV69S6jI/Jztbbr
+KKoh76oTa935sAT5KcHnJh5I8rFc+BIkZrz4e3bIyQJu2nXEqBTCjtfK9HYYvQID
+AQABo0MwQTAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwIAYDVR0RBBkw
+F4cEChQBO4cEfwAAAYIJbG9jYWxob3N0MA0GCSqGSIb3DQEBCwUAA4IBAQAUk7w/
+NtuaHmVDMKvm5lw1ow8AREzcZ3hlyugbBT8MXoMKbnPuAKqfhfwGQNn7LnXdHD1x
+Q/6ZbAuI+Q/Cf2KRwTvRslJ1ca5UEZb+t8w+LSU/loSpl3YTDJSCS12ef/W9Ln3S
+UiRVskLTbIUXhZ7I+1cjO+52lWw9aYfU/PT7xs6wUIkmZ2AHg2o5odeyLGvwcMPW
+VHpcfc9WYfgJhRXw4lPB7Hey+q/G+Y4y3yvxC57pDC/yQtvDGiLdIK7TbVfJh5DA
+oT/T5hzx/T1YnFEjjU41+8hGwrrPTavrz5ss87jcHB5k2vS3x/nBbunNhqE3sayj
+4r5bzTYODEuNbbvS
+-----END CERTIFICATE-----
diff --git a/ansible/roles/docker_client/files/certs/swarm-manager/key.pem b/ansible/roles/docker_client/files/certs/swarm-manager/key.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAxnIwOEiaAiqxsv7ixToFnzHq0Xc4biOgx8tvEYpv0lOXCg4s
+7n2AS4zqQyNaWze05v/tfghLTEj2j+dFIzkLk3fNpmSKu0Jr6xhh1QkyoWsZ20yI
+gMya9T1P9/8kslqLQ263w5hsG2/z84+Aj6Ku9LYtpqda0lpYqXEyeh2XnyzKouP5
+Qcd8/e1X8mLdZt8pDkaQ4WiG2w3TQ8rbX/7ulNBX9PWwzS6FtYA7SeaE9OgwwK6g
+QLSw60A/kZE+0eLNXoIjxuIICoV69S6jI/JztbbrKKoh76oTa935sAT5KcHnJh5I
+8rFc+BIkZrz4e3bIyQJu2nXEqBTCjtfK9HYYvQIDAQABAoIBAQCyvWULPPFipDvc
+AlIU3Nb1dYuQUXbFVVfavTR0MyHW6q1vRCdaRDYLVogmIrCe2oUZT0kFLMlNk6Zp
+JSCTwizYDZ9wkLyYQBJd9V8g+CDfXU0zxjJo+GFWJHxj3i6aao1nFlF0XlR5PhQX
+u5hLR3eYOILTyYc3UmLrc2bIsODBX4soU993Aq/ME2I8A6S5wSboPTkuiSboC7rD
+4Z3V0eOdljSubMXKoc4v/4A6v2bbe8BLvemL4wTX7TSdTzdU+cpePhPpd0P+/UbI
+tQptLR4JkvO05G7bhfsqGyurbLrwsnFOvqk96PCZjNLkYauWjoyNCw9ar4ScHIne
+/gdRTc5BAoGBAO2e4lr9QsMUMKyPqbiMD3NQZI2w4Hau7QTvayXkB711nwHQhRQd
+uh8EXKE2ODUUhL03J83zFKSarT23hLSqE+JHs8zCVImC6hUlgVA3m5lQB53DX36y
+O1C1DdV8vrRIoIc+85mqtspK7545yPRMnT5erS0GTv+EhmLNDT6zhu8NAoGBANXL
+nBokQqNFeCMf10BjPrIdSwO06rG7dDjHf44/Mcoem6c65OZCH9nFakqjP+f6pCHP
+uw7ASgGSldLnMdjJPz3ERPuEO7Hk71RrqDFeN+H6t2TH2IyX1uByeuxaIYV2QpCE
+rmqnALUXaFY7FsEw0FMMbcsXVqgDouMu1331O+RxAoGBAK7KQRdNVN7K60MEKoRm
+AreAW3cetP6YjiEjPF4S7t6etuhOypWRiGdoffrYN2BUR5AoEk+cj4LFhMnxRNzg
+ft/kfo4QJL9CXY5QmF65iOutwux52rUHxjoH9LUlneJfyjWySN6whOUpWjm5p+iM
+st4+JoUILvQmN/RVgXit9oPBAoGAVGMFvpvJYcCt5s9Omy+RM6S0U0Y5zOV8vlyg
+UHlJIcprDdsFNo2rHL37cnJ1aw9XcbEY2H21uGEvmgt/dV4aBDtQLybGmTUP8nZ7
+8OCLljrr4G+xXe0g9364XkpFKPTA2WJFpfs9ID2ZBVBVbvPhhqZFQAB6R98HkDyQ
++jqt5UECgYA4GSlK6ij+Xr9NDeIfG8xfuy6aUU792AaYcz7suQXkEUN6Q6PJe+b4
+BHd/ieUWSdl0bkD8ENzZ0GM7nCLxy4DZMNy1Pio2rEJn7M0ljATJbpmdrd1R/EPY
+0R/Tb5T0do+ARehLymgCTkTrqCF48gkYUuHeqw+ywQ2BGktnHwFUyw==
+-----END RSA PRIVATE KEY-----
diff --git a/ansible/roles/docker_client/files/certs/swarm/cert.pem b/ansible/roles/docker_client/files/certs/swarm/cert.pem
diff --git a/ansible/roles/docker_client/files/certs/swarm/key.pem b/ansible/roles/docker_client/files/certs/swarm/key.pem
diff --git a/ansible/roles/docker_client/scripts/genClientCert.sh b/ansible/roles/docker_client/scripts/genClientCert.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+if [[ $1 = '' ]]; then
+  echo 'script requires a client name'
+  exit 1
+fi
+CLIENT=./files/certs/$1
+
+if [[ $2 = '' ]]; then
+  echo 'script requires a client ip address'
+  exit 1
+fi
+
+mkdir $CLIENT
+
+# generate key for client
+openssl genrsa -out "$CLIENT/key.pem" 2048
+chmod 400 "$CLIENT/key.pem"
+
+# generate CSR for client
+openssl req \
+  -subj '/CN=client' \
+  -new \
+  -key "$CLIENT/key.pem" \
+  -out "$CLIENT/client.csr"
+
+chmod 400 "$CLIENT/client.csr"
+
+echo extendedKeyUsage=clientAuth,serverAuth > "$CLIENT/extfile.cnf"
+echo subjectAltName=IP:$2,IP:127.0.0.1,DNS:localhost >> "$CLIENT/extfile.cnf"
+
+# generate cert for client
+openssl x509 \
+  -req \
+  -days 365 \
+  -sha256 \
+  -in "$CLIENT/client.csr" \
+  -CA ca.pem \
+  -CAkey ca-key.pem \
+  -CAcreateserial \
+  -out "$CLIENT/cert.pem" \
+  -extfile "$CLIENT/extfile.cnf"
+
+# set permissions for deploy
+chmod 644 "$CLIENT/cert.pem"
+chmod 644 "$CLIENT/key.pem"
+
+# cleanup files we do not need
+rm $CLIENT/extfile.cnf
+rm $CLIENT/client.csr
diff --git a/ansible/roles/docker_client/tasks/main.yml b/ansible/roles/docker_client/tasks/main.yml
@@ -2,14 +2,14 @@
 - name: create docker cert directory
   sudo: yes
   file:
-    path=/opt/ssl/docker
+    path=/opt/ssl/docker/{{ name }}
     state=directory
 
 - name: copy docker CA
   sudo: yes
   copy:
     src=certs/ca.pem
-    dest=/opt/ssl/docker
+    dest=/opt/ssl/docker/{{ name }}
     mode=0440
     owner=root
     group=root
@@ -18,7 +18,7 @@
   sudo: yes
   copy:
     src=certs/{{ name }}/
-    dest=/opt/ssl/docker
+    dest=/opt/ssl/docker/{{ name }}
     mode=0440
     owner=root
     group=root
diff --git a/ansible/swarm-manager.yml b/ansible/swarm-manager.yml
@@ -6,6 +6,5 @@
     - "group_vars/alpha-swarm-manager.yml"
   roles:
   - { role: notify, tags: "notify" }
-  - { role: redis_key, tags: ["setup", "redis_key"] }
   - { role: docker_client, tags: "docker_client" }
   - { role: container_kill_start, tags: "deploy" }
