Skip to content

Commit 7edfe97

Browse files
clevesqueclevesque
authored
Add FreeIPA roles for PvC pre_setup for RHEL only (#144)
* Check for edge case when using some CentosOS versions Signed-off-by: Chuck Levesque <[email protected]>
1 parent 4a34c13 commit 7edfe97

File tree

11 files changed

+515
-0
lines changed

11 files changed

+515
-0
lines changed

‎roles/freeipa_client/defaults/main.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
3+
# Copyright 2023 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# ipaserver_domain:
18+
# ipaserver_realm:
19+
# ipa_hosts: # List of FQDN of IPA hosts
20+
# ipa_server_ips: # List of IP of IPA hosts
21+
# ipaadmin_principal:
22+
# ipaadmin_password:
23+
24+
enable_dns: false
25+
fallback_nameservers: [ "8.8.8.8" ]

‎roles/freeipa_client/handlers/main.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
3+
# Copyright 2023 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
- name: restart host
18+
ansible.builtin.reboot:

‎roles/freeipa_client/meta/main.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
3+
# Copyright 2023 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
galaxy_info:
18+
role_name: freeipa_client
19+
namespace: cloudera
20+
author: Webster Mudge Jim Enright Chuck Levesque
21+
description: >
22+
Deployment of FreeIPA clients for Cloudera Data Platform (CDP) Base and ECS
23+
company: Cloudera
24+
namespace: cloudera
25+
license: Apache-2.0
26+
27+
min_ansible_version: 2.10
28+
29+
platforms:
30+
- name: Debian
31+
versions: all
32+
- name: Fedora
33+
versions: all
34+
- name: GenericLinux
35+
versions: all
36+
- name: MacOSX
37+
versions: all
38+
- name: Ubuntu
39+
versions: all
40+
41+
galaxy_tags:
42+
- cloudera
43+
- cdp
44+
- freeipa

‎roles/freeipa_client/tasks/main.yml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
---
2+
3+
# Copyright 2023 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
- name: Disable SELinux
18+
ansible.builtin.selinux:
19+
state: disabled
20+
notify: restart host
21+
22+
- name: Set up DNS and networking
23+
when: enable_dns
24+
block:
25+
- name: Update RHEL networking
26+
when: ansible_facts['os_family'] == 'RedHat'
27+
block:
28+
- name: Set cloud-init to preserve hostname (RHEL)
29+
ansible.builtin.lineinfile:
30+
path: /etc/cloud/cloud.cfg
31+
regex: "^(#)?preserve_hostname"
32+
line: "preserve_hostname: 1"
33+
state: present
34+
notify: restart host
35+
36+
- name: Set interface config to preserve resolv.conf changes (RHEL)'
37+
ansible.builtin.lineinfile:
38+
path: "/etc/sysconfig/network-scripts/ifcfg-{{ ansible_default_ipv4.interface }}"
39+
regex: "^(#)?PEERDNS"
40+
line: "PEERDNS=no"
41+
state: present
42+
notify: restart host
43+
44+
- name: Set /etc/NetworkManager/conf.d/disable-resolve.conf-managing.conf (RHEL)
45+
ansible.builtin.copy:
46+
dest: /etc/NetworkManager/conf.d/disable-resolve.conf-managing.conf
47+
content: |
48+
# Generated by Ansible
49+
[main]
50+
dns=none
51+
notify: restart host
52+
53+
- name: Set /etc/resolv.conf directly
54+
ansible.builtin.copy:
55+
dest: /etc/resolv.conf
56+
content: |
57+
# Generated by Ansible
58+
search {{ ipaserver_domain }}
59+
{{ ['nameserver '] | product(ipa_server_ips | sort) | map('join') | join('\n') }}
60+
notify: restart host
61+
62+
- name: Set /etc/hostname to the FQDN
63+
ansible.builtin.copy:
64+
content: "{{ inventory_hostname }}"
65+
dest: /etc/hostname
66+
notify: restart host
67+
68+
- name: Set /etc/hosts
69+
ansible.builtin.copy:
70+
dest: /etc/hosts
71+
content: |
72+
# Set by Ansible
73+
{{ ansible_default_ipv4.address }} {{ inventory_hostname }} {{ inventory_hostname_short }}
74+
notify: restart host
75+
76+
- name: Set /etc/dhcp/dhclient.conf for domain search and name servers
77+
ansible.builtin.lineinfile:
78+
path: /etc/dhcp/dhclient.conf
79+
regex: "^(#)?{{ dhclient_entry.value }}"
80+
line: "{{ dhclient_entry.value }}"
81+
state: present
82+
loop: "{{ entries | dict2items }}"
83+
loop_control:
84+
loop_var: dhclient_entry
85+
label: "{{ dhclient_entry.key }}"
86+
vars:
87+
entries:
88+
domain_search: supersede domain-search "{{ ipaserver_domain }}";
89+
domain_name_servers: supersede domain-name-servers {{ ipa_server_ips | sort | union(fallback_nameservers) | join(', ') }};
90+
notify: restart host
91+
92+
- name: Flush handlers
93+
ansible.builtin.meta: flush_handlers
94+
95+
- name: Set up the FreeIPA Client
96+
ansible.builtin.include_role:
97+
name: freeipa.ansible_freeipa.ipaclient
98+
vars:
99+
state: present
100+
ipaclient_hostname: "{{ inventory_hostname }}"
101+
ipaclient_servers: "{{ ipa_hosts }}"
102+
ipaserver_setup_dns: "{{ enable_dns }}"
103+
ipasssd_enable_dns_updates: "{{ enable_dns }}"
104+
ipaclient_mkhomedir: yes

‎roles/freeipa_server/defaults/main.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
3+
# Copyright 2023 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
#ipaserver_realm: "{{ krb5_realm | upper }}"
18+
#ipaserver_domain: "{{ krb5_domain | default(krb5_realm | lower) }}"
19+
#ipaserver_setup_firewalld: "no"
20+
#ipaserver_setup_dns: "{{ freeipa_autodns | default(omit) }}"
21+
#ipaserver_auto_forwarders:
22+
#ipadm_password:
23+
24+
# ipaserver_recursion_acl_cidr:
25+
ipaserver_resolv_nameservers: [ '8.8.8.8' ]
26+
ipaserver_server_recursion: true
27+
enable_dns: false

‎roles/freeipa_server/handlers/main.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
3+
# Copyright 2023 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
- name: restart host
18+
ansible.builtin.reboot:
19+
20+
- name: restart dns
21+
ansible.builtin.service:
22+
name: named-pkcs11
23+
state: restarted

‎roles/freeipa_server/meta/main.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
3+
# Copyright 2023 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
galaxy_info:
18+
role_name: freeipa_server
19+
namespace: cloudera
20+
author: Webster Mudge Jim Enright Chuck Levesque
21+
description: >
22+
Deployment of sidecar FreeIPA Server for Cloudera Data Platform (CDP) Base and ECS
23+
company: Cloudera
24+
namespace: cloudera
25+
license: Apache-2.0
26+
27+
min_ansible_version: 2.10
28+
29+
platforms:
30+
- name: Debian
31+
versions: all
32+
- name: Fedora
33+
versions: all
34+
- name: GenericLinux
35+
versions: all
36+
- name: MacOSX
37+
versions: all
38+
- name: Ubuntu
39+
versions: all
40+
41+
galaxy_tags:
42+
- cloudera
43+
- cdp
44+
- freeipa

0 commit comments

Comments
 (0)