prepare_tls.yml

# Copyright 2021 Cloudera, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---

- name: Group hosts by whether TLS is enabled
  hosts: all
  gather_facts: no
  tasks:
    - import_tasks: tasks/group_hosts_by_tls.yml

- name: Create temp directories
  hosts: localhost
  connection: local
  become: no
  gather_facts: no
  tasks:
    - file:
        path: "{{ local_temp_dir }}/{{ dir }}"
        state: directory
      loop:
        - csrs
        - certs
      loop_control:
        loop_var: dir

- name: Fetch CA certificates
  hosts: ca_server
  become: yes
  gather_facts: no
  tasks:
    - fetch:
        src: "{{ cert.src }}"
        dest: "{{ cert.dest }}"
        flat: yes
      loop:
        - src: "{{ ca_server_root_cert_path }}"
          dest: "{{ local_temp_dir }}/certs/cluster_rootca.pem"
        - src: "{{ ca_server_intermediate_cert_path }}"
          dest: "{{ local_temp_dir }}/certs/cluster_intca.pem"
      loop_control:
        loop_var: cert
  vars_files:
    vars/ca_server.yml
  tags:
    - fetch_ca

- name: Build TLS keystores and truststores
  hosts: tls
  become: yes
  roles:
    - security/tls_generate_csr
    - security/tls_signing
    - security/tls_install_certs
  vars:
    local_certs_dir: "{{ local_temp_dir }}/certs"
    local_csrs_dir: "{{ local_temp_dir }}/csrs"

- name: Delete temp directories
  hosts: localhost
  connection: local
  become: no
  gather_facts: no
  tasks:
    - file:
        path: "{{ local_temp_dir }}/{{ dir }}"
        state: absent
      loop:
        - csrs
        - certs
      loop_control:
        loop_var: dir