Skip to content

Commit 4976897

Browse files
emepegeemepege
authored
Merge pull request #209 from idealista/develop
release 8.1.0
2 parents 9dd870c + f886c01 commit 4976897

27 files changed

+255
-0
lines changed

‎.travis.yml

+3
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ env:
5454
- DOCKER_IMAGE_BASE=quay.io/centos/centos:stream8 JDK_MAJOR=11 JDK_VERSION=11.0.13.0.8
5555
DOCKER_TAG_TO_PUBLISH=11.0.13.0.8-centos8-openjdk-headless
5656

57+
# SSL certificates scenario
58+
- DOCKER_IMAGE_BASE=debian:buster-slim JDK_VENDOR=openjdk-certs
59+
5760
# Java 17
5861
- DOCKER_IMAGE_BASE=debian:bullseye-slim DOCKER_TAG_TO_PUBLISH=17-bullseye-openjdk-headless
5962
- DOCKER_IMAGE_BASE=debian:bullseye-slim JDK_MAJOR=17 JDK_VERSION=17.0.6+10-1~deb11u1

‎CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ This project adheres to [Semantic Versioning](http://semver.org/) and [Keep a ch
44

55
## [Unreleased](https://github.com/idealista/java_role/tree/develop)
66

7+
## [8.1.0](https://github.com/idealista/java_role/tree/8.1.0) (2023-06-22)
8+
### Added
9+
- *[#207](https://github.com/idealista/java_role/issues/207) Add support for import SSL certificates into Java's truststore* @emepege
10+
711
## [8.0.0](https://github.com/idealista/java_role/tree/8.0.0) (2022-08-10)
812
[Full Changelog](https://github.com/idealista/java_role/compare/7.1.0...8.0.0)
913
### Added

‎README.md

+10
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,16 @@ CentOS 8 | `1.8.0`
124124
CentOS 8 | `11` (default)
125125

126126
Other OpenJDK implementations out of GNU/Linux distributions streams are not officially supported, but it's easy use this role too adding extra repositories (see vars/ in AdoptOpenJDK and Corretto directories).
127+
128+
### Adding certificates into Java's truststore
129+
130+
This role supports adding certificates into Java's truststore. Truststore location may change depending on Java version:
131+
132+
- Truststore location for Java 9 onwards: $JAVA_HOME/lib/security/cacerts
133+
- Truststore location for Java prior to 9: $JAVA_HOME/jre/lib/security/cacerts
134+
135+
A specific truststore location should be selected overriding `java_keystore_dir` variable using group vars/host vars. In addition, you must to set which certificates you want to add setting `java_certs` variable and the truststore password setting `java_cert_keystore_pass`
136+
127137
## Testing
128138

129139
```sh

‎defaults/main.yml

+6
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,9 @@ java_jdk_vendor: openjdk
33

44
java_open_jdk_apt_extra_packages: []
55
java_open_jdk_home: /usr/lib/jvm/{{ java_open_jdk_home_dir }}
6+
7+
# java_certs:
8+
# - java_cert_path: /path/to/cert/ssl.crt
9+
# java_cert_alias: ssl
10+
#
11+
# java_cert_keystore_pass: changeit

‎molecule/openjdk-certs/Dockerfile.j2

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Molecule managed
2+
3+
{% if item.registry is defined %}
4+
FROM {{ item.registry.url }}/{{ item.image }}
5+
{% else %}
6+
FROM {{ item.image }}
7+
{% endif %}
8+
9+
RUN mkdir -p /usr/share/man/man1
10+
RUN if [ $(command -v apt-get) ]; then sed -i -e 's/^APT/# APT/' -e 's/^DPkg/# DPkg/' /etc/apt/apt.conf.d/docker-clean; fi
11+
12+
RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get upgrade -y && apt-get install -y python3 sudo bash ca-certificates && apt-get clean; \
13+
elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python36 sudo python3-dnf bash && dnf clean all; \
14+
elif [ $(command -v yum) ]; then yum makecache fast && yum update -y && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
15+
elif [ $(command -v zypper) ]; then zypper refresh && zypper update -y && zypper install -y python sudo bash python-xml && zypper clean -a; \
16+
elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; fi

‎molecule/openjdk-certs/converge.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
3+
- name: Converge
4+
hosts: openjdk
5+
roles:
6+
- java_role

‎molecule/openjdk-certs/files/ssl.crt

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDETCCAfkCFCDQip+sJfpHN2tcLCd8SgKRWlcEMA0GCSqGSIb3DQEBCwUAMEUx
3+
CzAJBgNVBAYTAkVTMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRl
4+
cm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMjMwNjA1MTEwNTE3WhcNMjMwNzA1MTEw
5+
NTE3WjBFMQswCQYDVQQGEwJFUzETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UE
6+
CgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOC
7+
AQ8AMIIBCgKCAQEAsZotx9CdrUH2SwzmKlRQJVeD40tvnP/tX66i2gNgkFy4hpac
8+
kl9fcdTKNkLdLpl5hola+FJNQpDnUGToQRY2x2XtmnqKA/vGpXZVLizH6rxy5YAj
9+
5cjR2tYt89P2URXGVU5+8AJWANh1bONln4Qu8UOP6/AVlTrWl79nlOBqj+6rsVOW
10+
HgzdqE0hJnoKcVlTGb0OPnYNjDcsfLz9FJYgbPognhDk4EBD3GqJt5+J9ijXaiWh
11+
Q4rJ8/vInJt6Boqdz7KtCfD/VeWwLJDmtihJ6lseyo9WU2umPdOPz20Thk1k+VkN
12+
zpUvDS+bmQqQxlOiZi+1Z7OZaTNRfxVytEy3IwIDAQABMA0GCSqGSIb3DQEBCwUA
13+
A4IBAQA85o3erbRCnqJg70E7z19+F/o8Tg0cnl3oHU1GbAOrkzcxzcHLH05dN+BT
14+
bUGr//E+hgICeh14bDBCwtO3K2oDBRC82pYnTsDIK1my90fEQmvDMi+K/o4xw0pM
15+
yQBYmpnggS5+NJExx+MNBUUnAdQ0eH/wTyABz9PJL8MT8VR5K5/XIQCZYLwxyWYb
16+
4ga5ZQN5Jg9J2Dc/BIfLUXJavkIT2TINYDB6uhu6XeT5Qa0l+n621bMTle8ygleP
17+
CjasBNJsjgYNJi/1rO2DChKCPAAiObqHL+Wu0fdcHk+H5bDxoHXqil7s9l9hhv74
18+
oZFRmw2LG75mEonyXB90R2e9ZPXi
19+
-----END CERTIFICATE-----

‎molecule/openjdk-certs/group_vars/all.yml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
3+
java_certs:
4+
- java_cert_path: /tmp/ssl.crt
5+
java_cert_alias: ssl
6+
7+
java_cert_keystore_pass: changeit

‎molecule/openjdk-certs/molecule.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
dependency:
3+
name: galaxy
4+
driver:
5+
name: docker
6+
7+
lint: |
8+
yamllint .
9+
ansible-lint .
10+
11+
platforms:
12+
- name: openjdktest
13+
groups:
14+
- openjdk
15+
image: ${DOCKER_IMAGE_BASE:-debian:buster-slim}
16+
17+
provisioner:
18+
name: ansible
19+
inventory:
20+
group_vars:
21+
openjdk:
22+
java_jdk_vendor: openjdk
23+
java_open_jdk_version: ${JDK_VERSION}
24+
java_open_jdk_version_major: ${JDK_MAJOR}
25+
scenario:
26+
name: openjdk-certs
27+
verifier:
28+
name: ansible

‎molecule/openjdk-certs/prepare.yml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
- name: Prepare
3+
hosts: openjdktest
4+
gather_facts: false
5+
tasks:
6+
- name: Copy SSL certificate
7+
copy:
8+
src: "{{ playbook_dir }}/files/ssl.crt"
9+
dest: /tmp/ssl.crt

‎molecule/openjdk-certs/tests/test_openjdk.yml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
3+
file:
4+
{{ java_open_jdk_home }}/lib:
5+
exists: true
6+
filetype: directory
7+
package:
8+
{% if java_open_jdk_version is defined and java_open_jdk_version is not sameas None and java_open_jdk_version != "" %}
9+
{{ java_open_jdk_package }}:
10+
installed: true
11+
versions:
12+
- {{ java_open_jdk_version }}
13+
{% else %}
14+
{{ java_open_jdk_package }}:
15+
installed: true
16+
{% endif %}

‎molecule/openjdk-certs/verify.yml

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
---
2+
# This is an example playbook to execute goss tests.
3+
# Tests need distributed to the appropriate ansible host/groups
4+
# prior to execution by `goss validate`.
5+
#
6+
# The goss ansible module is installed with molecule. The ANSIBLE_LIBRARY
7+
# path is updated appropriately on `molecule verify`.
8+
9+
# Details about ansible module:
10+
# - https://github.com/indusbox/goss-ansible
11+
12+
- name: Verify
13+
hosts: all
14+
vars:
15+
goss_version: v0.3.16
16+
goss_sha256sum: 827e354b48f93bce933f5efcd1f00dc82569c42a179cf2d384b040d8a80bfbfb
17+
goss_arch: amd64
18+
goss_dst: /usr/local/bin/goss
19+
goss_url: "https://github.com/aelsabbahy/goss/releases/download/{{ goss_version }}/goss-linux-{{ goss_arch }}"
20+
goss_test_directory: /tmp
21+
goss_format: documentation
22+
molecule_file: "{{ lookup('env', 'MOLECULE_FILE') }}"
23+
molecule_yml: "{{ lookup('file', molecule_file) | molecule_from_yaml }}"
24+
25+
vars_files:
26+
- ../../defaults/main.yml
27+
28+
tasks:
29+
- name: Java | Gather OS specific variables
30+
include_vars: "../../vars/{{ java_jdk_vendor }}/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"
31+
32+
- name: Gather architecture specific variables
33+
include_vars: "../../vars/architecture.yml"
34+
35+
# Using pattern described in Ansible Best Practices and Conventions (Appendix B), Ansible for Devops (p. 406)
36+
# Allowing to 'override' variables that are defined using include_vars
37+
38+
- name: Java | Setting OS specific variables
39+
set_fact:
40+
java_open_jdk_version: "{{ java_open_jdk_version if java_open_jdk_version is defined and java_open_jdk_version is not sameas None }}"
41+
java_open_jdk_version_major: "{{ java_open_jdk_version_major if java_open_jdk_version_major is defined and java_open_jdk_version_major is not sameas None and java_open_jdk_version_major else __java_open_jdk_version_major }}" # noqa 204
42+
43+
- name: Java | Setting OS specific variables (II)
44+
set_fact:
45+
java_open_jdk_home_dir: "{{ java_open_jdk_home_dir if java_open_jdk_home_dir is defined and java_open_jdk_home_dir is not sameas None and java_open_jdk_home_dir else __java_open_jdk_home_dir }}" # noqa 204
46+
java_open_jdk_package: "{{ java_open_jdk_package if java_open_jdk_package is defined and java_open_jdk_package is not sameas None and java_open_jdk_package else __java_open_jdk_package }}" # noqa 204
47+
48+
- name: Java | Setting specific variables
49+
set_fact:
50+
java_home: "{{ java_open_jdk_home }}"
51+
52+
- name: Download and install goss
53+
get_url:
54+
url: "{{ goss_url }}"
55+
dest: "{{ goss_dst }}"
56+
mode: 0755
57+
58+
- name: Copy tests to remote
59+
template:
60+
src: "{{ item }}"
61+
dest: "{{ goss_test_directory }}/{{ item | basename }}"
62+
with_fileglob:
63+
- "{{ playbook_dir }}/tests/test_*.yml"
64+
65+
- name: Register test files
66+
shell: "ls {{ goss_test_directory }}/test_*.yml"
67+
register: test_files
68+
changed_when: false
69+
70+
- name: Execute Goss tests
71+
command: "goss -g {{ item }} validate --format {{ goss_format }}"
72+
register: test_results
73+
with_items: "{{ test_files.stdout_lines }}"
74+
ignore_errors: true
75+
changed_when: false
76+
77+
- name: Display details about the goss results
78+
debug:
79+
msg: "{{ item.stdout_lines }}"
80+
with_items: "{{ test_results.results }}"
81+
82+
- name: Fail when tests fail
83+
fail:
84+
msg: "Goss failed to validate"
85+
when: item.rc != 0
86+
with_items: "{{ test_results.results }}"

‎tasks/import_certs.yml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
3+
- name: Java | Check if certificates exists
4+
stat:
5+
path: "{{ item.java_cert_path }}"
6+
with_items: "{{ java_certs }}"
7+
register: check_java_certs
8+
9+
- name: Java | Fail if some cert doesn't exist
10+
fail:
11+
msg: "Certificate {{ item.item.java_cert_path }} doesn't exist"
12+
with_items: "{{ check_java_certs.results }}"
13+
when: not item.stat.exists
14+
15+
- name: Java | Setting keystore variables
16+
set_fact:
17+
java_keystore_dir: "{{ java_keystore_dir if java_keystore_dir is defined and java_keystore_dir is not sameas None and java_keystore_dir else __java_keystore_dir }}"
18+
19+
- name: Java | Import SSL certificates
20+
java_cert:
21+
cert_path: "{{ item.java_cert_path }}"
22+
keystore_path: "{{ java_open_jdk_home }}/{{ java_keystore_dir }}/cacerts"
23+
keystore_pass: "{{ java_cert_keystore_pass }}"
24+
state: present
25+
cert_alias: "{{ item.java_cert_alias }}"
26+
with_items: "{{ java_certs }}"

‎tasks/main.yml

+6
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,9 @@
44
include_tasks: install_openjdk.yml
55
tags:
66
- install
7+
8+
- name: Java | Import certificates into Java Keystore
9+
include_tasks: import_certs.yml
10+
when: java_certs is defined
11+
tags:
12+
- certs

‎vars/adoptopenjdk/CentOS-8.yml

+1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
---
22
java_open_jdk_apt_extra_packages: []
33
__java_open_jdk_version_major: 8
4+
__java_keystore_dir: jre/lib/security
45
# Supported major releases: 8 and from 11 to 14; hotspot and openj9 implementations
56

67
__java_required_repositories_openjdk:

‎vars/adoptopenjdk/Debian-10.yml

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ java_open_jdk_apt_extra_packages:
33
- python-apt
44
- apt-transport-https
55
__java_open_jdk_version_major: 8
6+
__java_keystore_dir: jre/lib/security
67
# Supported major releases: 8 and from 11 to 14; hotspot and openj9 implementations
78

89
# For Debian family

‎vars/adoptopenjdk/Debian-11.yml

+1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ java_open_jdk_apt_extra_packages:
44
- apt-transport-https
55
- gnupg2
66
__java_open_jdk_version_major: 8
7+
__java_keystore_dir: jre/lib/security
78
# Supported major releases: 8 and from 11 to 14; hotspot and openj9 implementations
89

910
# For Debian family

‎vars/corretto/CentOS-8.yml

+1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
__java_open_jdk_version_major: 1.8.0
3+
__java_keystore_dir: jre/lib/security
34
# Supported versions: 8 (1.8.0 in RHEL), 11
45

56
__java_required_repositories_openjdk:

‎vars/corretto/Debian-10.yml

+1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ java_open_jdk_apt_extra_packages:
44
- apt-transport-https
55

66
__java_open_jdk_version_major: 1.8.0
7+
__java_keystore_dir: jre/lib/security
78
# Supported versions: 8 (1.8.0L), 11
89

910
__java_required_repositories_openjdk:

‎vars/corretto/Debian-11.yml

+1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ java_open_jdk_apt_extra_packages:
55
- gnupg2
66

77
__java_open_jdk_version_major: 1.8.0
8+
__java_keystore_dir: jre/lib/security
89
# Supported versions: 8 (1.8.0L), 11
910

1011
__java_required_repositories_openjdk:

‎vars/openjdk/CentOS-7.yml

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
# Using pattern described in Ansible Best Practices and Conventions (Appendix B), Ansible for Devops (p. 406)
44
__java_open_jdk_version_major: 11
5+
__java_keystore_dir: lib/security
56
# Supported openjdk major releases: 1.6.0, 1.7.0, 1.8.0, 11
67
#
78
__java_required_repositories_openjdk: []

‎vars/openjdk/CentOS-8.yml

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
# Using pattern described in Ansible Best Practices and Conventions (Appendix B), Ansible for Devops (p. 406)
44
__java_open_jdk_version_major: 11
5+
__java_keystore_dir: lib/security
56
# Supported openjdk major releases: 1.8.0, 11
67

78
__java_required_repositories_openjdk: []

‎vars/openjdk/Debian-10.yml

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
# Using pattern described in Ansible Best Practices and Conventions (Appendix B), Ansible for Devops (p. 406)
44
__java_open_jdk_version_major: 11
5+
__java_keystore_dir: lib/security
56
# Supported openjdk major releases: 11
67

78
__java_required_repositories_openjdk: []

‎vars/openjdk/Debian-11.yml

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
# Using pattern described in Ansible Best Practices and Conventions (Appendix B), Ansible for Devops (p. 406)
44
__java_open_jdk_version_major: 11
5+
__java_keystore_dir: lib/security
56
# Supported openjdk major releases: 11, 17
67

78
__java_required_repositories_openjdk: []

‎vars/openjdk/Ubuntu-18.yml

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ java_open_jdk_apt_extra_packages:
66

77
# Using pattern described in Ansible Best Practices and Conventions (Appendix B), Ansible for Devops (p. 406)
88
__java_open_jdk_version_major: 11
9+
__java_keystore_dir: lib/security
910
# Supported openjdk major releases: 8, 11
1011

1112
__java_required_repositories_openjdk: []

‎vars/openjdk/Ubuntu-20.yml

+1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ java_open_jdk_apt_extra_packages:
55
- gnupg2
66
# Using pattern described in Ansible Best Practices and Conventions (Appendix B), Ansible for Devops (p. 406)
77
__java_open_jdk_version_major: 17
8+
__java_keystore_dir: lib/security
89
# Supported openjdk major releases: 8, 11, 13, 14, 17
910

1011
__java_required_repositories_openjdk: []

‎vars/openjdk/Ubuntu-22.yml

+1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ java_open_jdk_apt_extra_packages:
55
- gnupg2
66
# Using pattern described in Ansible Best Practices and Conventions (Appendix B), Ansible for Devops (p. 406)
77
__java_open_jdk_version_major: 17
8+
__java_keystore_dir: lib/security
89
# Supported openjdk major releases: 8, 11, 17, 18
910

1011
__java_required_repositories_openjdk: []

0 commit comments

Comments
 (0)