Skip to content

Commit 6b1507d

Browse files
rsuplinarsuplina
authored
Add Cloudera Edge Flow Manager role (#295)
Signed-off-by: rsuplina <[email protected]>
1 parent 4464a35 commit 6b1507d

File tree

7 files changed

+854
-0
lines changed

7 files changed

+854
-0
lines changed

‎roles/efm/README.md‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
# Edge Flow Manager
2+
3+
## Requirements
4+
5+
- Network access from the target host to the URL specified in `efm_tarball_url`
6+
- When `efm_tls_enabled: true`, all TLS-related variables must be defined in your playbook
7+
- When `efm_ldap_enabled: true`, all LDAP-related variables must be defined in your playbookr
8+
9+
This role streamlines the deployment and configuration of Cloudera Edge Flow Manager (EFM) on designeted host. It covers the full installation workflow, from fetching the EFM package to setting up the service and applying configuration templates.
10+
11+
## What this role does
12+
13+
- Validates required configuration variables based on enabled features (TLS, LDAP)
14+
- Retrieves the EFM tarball from a user-defined or default source
15+
- Installs EFM into a configurable directory
16+
- Sets up the required system user and group for EFM
17+
- Applies configuration using a Jinja2 template for `efm.properties`
18+
- Installs and manages the EFM systemd service unit
19+
- Adjusts permissions for all relevant files and directories
20+
- Supports authentication for protected download sources
21+
22+
# Requirements
23+
24+
- Network access from the target host to the URL specified in `efm_tarball_url`.
25+
26+
## Variables
27+
28+
| Name | Purpose | Default (see `defaults/main.yml`) |
29+
|----------------------------------|--------------------------------------------------------------|---------------------------------------------|
30+
| `efm_tarball_url` | Download link for the EFM tarball | (default provided in role) |
31+
| `efm_directory` | Installation directory for EFM | `/opt/cloudera/cem` |
32+
| `efm_properties_directory` | Path to the EFM properties file | `/opt/cloudera/cem/efm/conf/efm.properties` |
33+
| `efm_service_directory` | Location for the systemd service file | `/etc/systemd/system/efm.service` |
34+
| `efm_user` | System user for EFM | `efm` |
35+
| `efm_group` | System group for EFM | `efm` |
36+
| `efm_repo_username` | Username for protected repositories (optional) | |
37+
| `efm_repo_password` | Password for protected repositories (optional) | |
38+
| `efm_tls_enabled` | Enable/disable TLS for EFM server | `false` |
39+
| `efm_ssl_client_auth` | SSL client authentication mode | `WANT` |
40+
| `efm_ssl_keystore_type` | Type of keystore (jks, pkcs12) | `jks` |
41+
| `efm_ssl_truststore_type` | Type of truststore (jks, pkcs12) | `jks` |
42+
| `efm_ssl_keystore_path` | Path to SSL keystore (must be defined when TLS enabled) |
43+
| `efm_ssl_keystore_password` | SSL keystore password (must be defined when TLS enabled) |
44+
| `efm_ssl_key_password` | SSL private key password (must be defined when TLS enabled) |
45+
| `efm_ssl_truststore_path` | Path to SSL truststore (must be defined when TLS enabled) |
46+
| `efm_ssl_truststore_password` | SSL truststore password (must be defined when TLS enabled) |
47+
| `efm_ldap_enabled` | Enable/disable LDAP authentication | `false` |
48+
| `efm_ldap_url` | LDAP server URL (must be defined when LDAP enabled) |
49+
| `efm_ldap_authentication_strategy` | LDAP authentication strategy (must be defined when LDAP enabled) |
50+
| `efm_ldap_user_auth_groups_manager` | Authentication groups manager (must be defined when LDAP enabled) |
51+
| `efm_ldap_auth_enabled` | Enable LDAP authentication (must be defined when LDAP enabled) |
52+
| `efm_ldap_auth_search_filter` | LDAP search filter for users (must be defined when LDAP enabled) |
53+
| `efm_ldap_user_search_base` | LDAP search base for users (must be defined when LDAP enabled) |
54+
| `efm_ldap_user_object_class` | LDAP object class for users (must be defined when LDAP enabled) |
55+
| `efm_ldap_tls_protocol` | TLS protocol for LDAP connections (must be defined when LDAP enabled) |
56+
| `efm_ldap_user_search_scope` | LDAP search scope (must be defined when LDAP enabled) |
57+
| `efm_ldap_user_identity_attribute` | LDAP identity attribute (must be defined when LDAP enabled) |
58+
| `efm_db_url` | Database connection URL | `jdbc:postgresql://localhost:5432/efm` |
59+
| `efm_db_driver_class` | Database driver class | `org.postgresql.Driver` |
60+
| `efm_db_username` | Database username | `efm` |
61+
| `efm_db_password` | Database password | `efmPassword` |
62+
63+
## Example usage
64+
65+
```yaml
66+
# Basic EFM installation
67+
- hosts: efm_nodes
68+
become: true
69+
tasks:
70+
- name: Install EFM with basic configuration
71+
ansible.builtin.import_role:
72+
name: cloudera.exe.efm
73+
vars:
74+
efm_tarball_url: "https://archive.cloudera.com/p/CEM/redhat9/2.x/updates/2.2.0.0/tars/efm/efm-2.2.0.0-1-bin.tar.gz"
75+
efm_repo_username: "repo_user"
76+
efm_repo_password: "repo_pass"
77+
efm_encryption_password: "MySecurePassword123"
78+
79+
- name: Install EFM with TLS and LDAP enabled
80+
ansible.builtin.import_role:
81+
name: cloudera.exe.efm
82+
vars:
83+
efm_encryption_password: "MySecurePassword123"
84+
# TLS Configuration (ALL variables required when efm_tls_enabled: true)
85+
efm_tls_enabled: true
86+
efm_ssl_client_auth: "WANT"
87+
efm_ssl_keystore_type: "jks"
88+
efm_ssl_truststore_type: "jks"
89+
efm_ssl_keystore_path: "/opt/cloudera/cem/certs/keystore.jks"
90+
efm_ssl_keystore_password: "MyKeystorePass"
91+
efm_ssl_key_password: "MyKeyPass"
92+
efm_ssl_truststore_path: "/opt/cloudera/cem/certs/truststore.jks"
93+
efm_ssl_truststore_password: "MyTruststorePass"
94+
# LDAP Configuration (ALL variables required when efm_ldap_enabled: true)
95+
efm_ldap_enabled: true
96+
efm_ldap_url: "ldaps://your-ldap-server.example.com:636"
97+
efm_ldap_authentication_strategy: "LDAPS"
98+
efm_ldap_user_auth_groups_manager: "LDAP"
99+
efm_ldap_auth_enabled: true
100+
efm_ldap_auth_search_filter: "(uid={0})"
101+
efm_ldap_user_search_base: "cn=users,cn=accounts,dc=example,dc=com"
102+
efm_ldap_user_object_class: "person"
103+
efm_ldap_tls_protocol: "TLSv1.2"
104+
efm_ldap_user_search_scope: "ONE_LEVEL"
105+
efm_ldap_user_identity_attribute: "uid"
106+
# Database Configuration (if not using defaults)
107+
efm_db_url: "jdbc:postgresql://db-server:5432/efm_prod"
108+
efm_db_username: "efm_user"
109+
efm_db_password: "SecureDbPassword"
110+
```
111+
112+
## License
113+
114+
```
115+
Copyright 2025 Cloudera, Inc.
116+
117+
Licensed under the Apache License, Version 2.0 (the "License");
118+
you may not use this file except in compliance with the License.
119+
You may obtain a copy of the License at
120+
121+
https://www.apache.org/licenses/LICENSE-2.0
122+
123+
Unless required by applicable law or agreed to in writing, software
124+
distributed under the License is distributed on an "AS IS" BASIS,
125+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
126+
See the License for the specific language governing permissions and
127+
limitations under the License.
128+
```

‎roles/efm/defaults/main.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
# Copyright 2025 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
efm_tarball_url: "https://archive.cloudera.com/p/CEM/redhat9/2.x/updates/2.1.3.0/tars/efm/efm-2.1.3.0-2-bin.tar.gz"
17+
efm_properties_directory: "/opt/cloudera/cem/efm/conf/efm.properties"
18+
efm_service_directory: "/etc/systemd/system/efm.service"
19+
efm_directory: "/opt/cloudera/cem"
20+
efm_user: efm
21+
efm_group: efm
22+
efm_server_address: "0.0.0.0"
23+
efm_server_port: "10090"
24+
efm_encryption_password: "{{ undef(hint='Please define the EFM encryption password (efm_encryption_password)') }}"
25+
26+
# TLS Configuration
27+
efm_tls_enabled: false
28+
# SSL/TLS settings (only used when efm_tls_enabled is true)
29+
# efm_ssl_client_auth: "WANT"
30+
# efm_ssl_keystore_type: "jks"
31+
# efm_ssl_truststore_type: "jks"
32+
# efm_ssl_keystore_path: /etc/pki/tls/private/keystore.jks
33+
# efm_ssl_truststore_path: /etc/pki/tls/private/truststore.jks
34+
# efm_ssl_keystore_password: keystore-passowrd
35+
# efm_ssl_key_password: keystore-passowrd
36+
# efm_ssl_truststore_password: keystore-passowrd
37+
38+
# LDAP Authentication Configuration
39+
efm_ldap_enabled: false
40+
# efm_ldap_url: "{{ undef(hint='Please define the EFM LDAP URL (efm_ldap_url)')}}"
41+
# efm_ldap_authentication_strategy: "LDAPS"
42+
# efm_ldap_user_auth_groups_manager: "LDAP"
43+
# efm_ldap_auth_enabled: true
44+
# efm_ldap_auth_search_filter: "(uid={0})"
45+
# efm_ldap_user_search_base: "cn=users,cn=accounts,dc=cldr,dc=internal"
46+
# efm_ldap_user_object_class: "person"
47+
# efm_ldap_tls_protocol: "TLSv1.2"
48+
# efm_ldap_user_search_scope: "ONE_LEVEL"
49+
# efm_ldap_user_identity_attribute: "uid"
50+
51+
# Database Configuration
52+
efm_db_url: "jdbc:postgresql://localhost:5432/efm"
53+
efm_db_driver_class: "org.postgresql.Driver"
54+
efm_db_username: "efm"
55+
efm_db_password: "efmPassword"

‎roles/efm/handlers/main.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
# Copyright 2025 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
- name: Start efm service
17+
ansible.builtin.systemd:
18+
name: efm
19+
daemon_reload: true
20+
enabled: true
21+
state: started

‎roles/efm/meta/argument_specs.yml‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
---
2+
# Copyright 2025 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
argument_specs:
17+
main:
18+
short_description: Install and configure Cloudera Edge Flow Manager (EFM)
19+
description:
20+
- Validates required configuration variables based on enabled features (TLS, LDAP).
21+
- Downloads, installs, and configures Cloudera Edge Flow Manager (EFM) on the target host.
22+
- Sets up the EFM properties, and manages the systemd service.
23+
author: Cloudera Labs
24+
version_added: "3.2.0"
25+
options:
26+
efm_tarball_url:
27+
description: URL to the EFM tarball to download and install.
28+
type: str
29+
required: false
30+
default: "https://archive.cloudera.com/p/CEM/redhat9/2.x/updates/2.1.3.0/tars/efm/efm-2.1.3.0-2-bin.tar.gz"
31+
efm_directory:
32+
description: Directory where EFM will be installed.
33+
type: str
34+
required: false
35+
default: "/opt/cloudera/cem"
36+
efm_properties_directory:
37+
description: Path to the EFM properties file.
38+
type: str
39+
required: false
40+
default: "/opt/cloudera/cem/efm/conf/efm.properties"
41+
efm_service_directory:
42+
description: Path to the EFM systemd service file.
43+
type: str
44+
required: false
45+
default: "/etc/systemd/system/efm.service"
46+
efm_user:
47+
description: System user to own EFM files and run the service.
48+
type: str
49+
required: false
50+
default: "efm"
51+
efm_group:
52+
description: System group to own EFM files.
53+
type: str
54+
required: false
55+
default: "efm"
56+
efm_server_address:
57+
description: The address to which the EFM server will bind.
58+
type: str
59+
required: false
60+
default: "0.0.0.0"
61+
efm_server_port:
62+
description: The port on which the EFM server will listen.
63+
type: str
64+
required: false
65+
default: "10090"
66+
efm_encryption_password:
67+
description: Password used for EFM encryption. This must be provided by the user.
68+
type: str
69+
required: true
70+
efm_repo_username:
71+
description: Username for protected Cloudera repositories (if required).
72+
type: str
73+
required: false
74+
efm_repo_password:
75+
description: Password for protected Cloudera repositories (if required).
76+
type: str
77+
required: false
78+
efm_tls_enabled:
79+
description: Enable or disable TLS/SSL for EFM server.
80+
type: bool
81+
default: false
82+
efm_ssl_client_auth:
83+
description: SSL client authentication mode (NONE, WANT, NEED).
84+
type: str
85+
default: "WANT"
86+
efm_ssl_keystore_type:
87+
description: Type of keystore (jks, pkcs12).
88+
type: str
89+
default: "jks"
90+
efm_ssl_truststore_type:
91+
description: Type of truststore (jks, pkcs12).
92+
type: str
93+
default: "jks"
94+
efm_ssl_keystore_path:
95+
description: Path to the SSL keystore file. Must be defined in playbook when efm_tls_enabled is true.
96+
type: str
97+
required: false
98+
efm_ssl_keystore_password:
99+
description: Password for the SSL keystore. Must be defined in playbook when efm_tls_enabled is true.
100+
type: str
101+
required: false
102+
efm_ssl_key_password:
103+
description: Password for the SSL private key. Must be defined in playbook when efm_tls_enabled is true.
104+
type: str
105+
required: false
106+
efm_ssl_truststore_path:
107+
description: Path to the SSL truststore file. Must be defined in playbook when efm_tls_enabled is true.
108+
type: str
109+
required: false
110+
efm_ssl_truststore_password:
111+
description: Password for the SSL truststore. Must be defined in playbook when efm_tls_enabled is true.
112+
type: str
113+
required: false
114+
efm_ldap_enabled:
115+
description: Enable or disable LDAP authentication for EFM.
116+
type: bool
117+
default: false
118+
efm_ldap_url:
119+
description: LDAP server URL. Must be defined in playbook when efm_ldap_enabled is true.
120+
type: str
121+
required: false
122+
efm_ldap_authentication_strategy:
123+
description: LDAP authentication strategy. Must be defined in playbook when efm_ldap_enabled is true.
124+
type: str
125+
required: false
126+
efm_ldap_user_auth_groups_manager:
127+
description: Authentication groups manager type. Must be defined in playbook when efm_ldap_enabled is true.
128+
type: str
129+
required: false
130+
efm_ldap_auth_enabled:
131+
description: Enable LDAP authentication. Must be defined in playbook when efm_ldap_enabled is true.
132+
type: bool
133+
required: false
134+
efm_ldap_auth_search_filter:
135+
description: LDAP search filter for user authentication. Must be defined in playbook when efm_ldap_enabled is true.
136+
type: str
137+
required: false
138+
efm_ldap_user_search_base:
139+
description: LDAP search base for users. Must be defined in playbook when efm_ldap_enabled is true.
140+
type: str
141+
required: false
142+
efm_ldap_user_object_class:
143+
description: LDAP object class for users. Must be defined in playbook when efm_ldap_enabled is true.
144+
type: str
145+
required: false
146+
efm_ldap_tls_protocol:
147+
description: TLS protocol version for LDAP connections. Must be defined in playbook when efm_ldap_enabled is true.
148+
type: str
149+
required: false
150+
efm_ldap_user_search_scope:
151+
description: LDAP search scope for users. Must be defined in playbook when efm_ldap_enabled is true.
152+
type: str
153+
required: false
154+
efm_ldap_user_identity_attribute:
155+
description: LDAP attribute used for user identity. Must be defined in playbook when efm_ldap_enabled is true.
156+
type: str
157+
required: false
158+
efm_db_url:
159+
description: Database connection URL.
160+
type: str
161+
default: "jdbc:postgresql://localhost:5432/efm"
162+
efm_db_driver_class:
163+
description: Database driver class name.
164+
type: str
165+
default: "org.postgresql.Driver"
166+
efm_db_username:
167+
description: Database username.
168+
type: str
169+
default: "efm"
170+
efm_db_password:
171+
description: Database password.
172+
type: str
173+
default: "efmPassword"

0 commit comments

Comments
 (0)