-
-
Notifications
You must be signed in to change notification settings - Fork 432
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Enabled TLS encrypted communication for etcd (#857)
- Loading branch information
Showing
15 changed files
with
251 additions
and
121 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,13 @@ | ||
| --- | ||
| - name: Check etcd health | ||
| ansible.builtin.uri: | ||
| url: "http://{{ inventory_hostname }}:2379/health" | ||
| url: "{{ patroni_etcd_protocol | default('http', true) }}://{{ inventory_hostname }}:2379/health" | ||
| method: GET | ||
| return_content: true | ||
| validate_certs: "{{ tls_cert_generate | default(false) | bool }}" | ||
| ca_path: "{{ tls_etcd_ca_cert_path if tls_cert_generate | default(false) | bool else omit }}" | ||
| client_cert: "{{ tls_etcd_cert_path if tls_cert_generate | default(false) | bool else omit }}" | ||
| client_key: "{{ tls_etcd_privatekey_path if tls_cert_generate | default(false) | bool else omit }}" | ||
| register: etcd_health_status | ||
| failed_when: "(etcd_health_status.content | from_json).health != 'true'" | ||
| when: dcs_type == "etcd" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,22 +1,26 @@ | ||
| backend = "etcdv3" | ||
| interval = 10 | ||
| watch = true | ||
| nodes = [ | ||
| {% if not dcs_exists|bool and dcs_type == 'etcd' %} | ||
| {% if not dcs_exists|bool %} | ||
| {% for host in groups['etcd_cluster'] %} | ||
| "http://{{ hostvars[host]['inventory_hostname'] }}:2379", | ||
| "{{ patroni_etcd_protocol | default('http', true) }}://{{ hostvars[host]['inventory_hostname'] }}:2379", | ||
| {% endfor %} | ||
| {% endif %} | ||
| {% if dcs_exists|bool and dcs_type == 'etcd' %} | ||
| {% if dcs_exists|bool %} | ||
| {% for etcd_hosts in patroni_etcd_hosts %} | ||
| "{{ patroni_etcd_protocol | default('http', true) }}://{{etcd_hosts.host}}:{{etcd_hosts.port}}", | ||
| {% endfor %} | ||
| {% endif %} | ||
| ] | ||
| {% if dcs_exists|bool and dcs_type == 'etcd' %} | ||
| {% if tls_cert_generate | default(false) | bool %} | ||
| scheme = "https" | ||
| client_cakeys = "{{ tls_ca_cert_path | default('/etc/tls/ca.crt') }}" | ||
| client_cert = "{{ tls_cert_path | default('/etc/tls/server.crt') }}" | ||
| client_key = "{{ tls_privatekey_path | default('/etc/tls/server.key') }}" | ||
| {% endif %} | ||
| {% if patroni_etcd_username | default('') | length > 0 %} | ||
| basic_auth = true | ||
| username = "{{ patroni_etcd_username | default('') }}" | ||
| password = "{{ patroni_etcd_password | default('') }}" | ||
| {% endif %} | ||
| {% endif %} | ||
| watch = true | ||
| interval = 10 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,13 +1,24 @@ | ||
| ETCD_NAME="{{ ansible_hostname }}" | ||
| ETCD_LISTEN_CLIENT_URLS="http://{{ inventory_hostname }}:2379,http://127.0.0.1:2379" | ||
| ETCD_ADVERTISE_CLIENT_URLS="http://{{ inventory_hostname }}:2379" | ||
| ETCD_LISTEN_PEER_URLS="http://{{ inventory_hostname }}:2380" | ||
| ETCD_INITIAL_ADVERTISE_PEER_URLS="http://{{ inventory_hostname }}:2380" | ||
| ETCD_LISTEN_CLIENT_URLS="{{ patroni_etcd_protocol | default('http', true) }}://{{ inventory_hostname }}:2379,{{ patroni_etcd_protocol | default('http', true) }}://127.0.0.1:2379" | ||
| ETCD_ADVERTISE_CLIENT_URLS="{{ patroni_etcd_protocol | default('http', true) }}://{{ inventory_hostname }}:2379" | ||
| ETCD_LISTEN_PEER_URLS="{{ patroni_etcd_protocol | default('http', true) }}://{{ inventory_hostname }}:2380" | ||
| ETCD_INITIAL_ADVERTISE_PEER_URLS="{{ patroni_etcd_protocol | default('http', true) }}://{{ inventory_hostname }}:2380" | ||
| ETCD_INITIAL_CLUSTER_TOKEN="{{ etcd_cluster_name }}" | ||
| ETCD_INITIAL_CLUSTER="{% for host in groups['etcd_cluster'] %}{{ hostvars[host]['ansible_hostname'] }}=http://{{ hostvars[host]['inventory_hostname'] }}:2380{% if not loop.last %},{% endif %}{% endfor %}" | ||
| ETCD_INITIAL_CLUSTER="{% for host in groups['etcd_cluster'] %}{{ hostvars[host]['ansible_hostname'] }}={{ patroni_etcd_protocol | default('http', true) }}://{{ hostvars[host]['inventory_hostname'] }}:2380{% if not loop.last %},{% endif %}{% endfor %}" | ||
| ETCD_INITIAL_CLUSTER_STATE="new" | ||
| ETCD_DATA_DIR="{{ etcd_data_dir }}" | ||
| ETCD_ELECTION_TIMEOUT="5000" | ||
| ETCD_HEARTBEAT_INTERVAL="1000" | ||
| ETCD_INITIAL_ELECTION_TICK_ADVANCE="false" | ||
| ETCD_AUTO_COMPACTION_RETENTION="1" | ||
| {% if tls_cert_generate | default(false) | bool %} | ||
| ETCD_CERT_FILE="{{ tls_etcd_cert_path | default('/etc/etcd/tls/server.crt') }}" | ||
| ETCD_KEY_FILE="{{ tls_etcd_privatekey_path | default('/etc/etcd/tls/server.key') }}" | ||
| ETCD_TRUSTED_CA_FILE="{{ tls_etcd_ca_cert_path | default('/etc/etcd/tls/ca.crt') }}" | ||
| ETCD_PEER_CERT_FILE="{{ tls_etcd_cert_path | default('/etc/etcd/tls/server.crt') }}" | ||
| ETCD_PEER_KEY_FILE="{{ tls_etcd_privatekey_path | default('/etc/etcd/tls/server.key') }}" | ||
| ETCD_PEER_TRUSTED_CA_FILE="{{ tls_etcd_ca_cert_path | default('/etc/etcd/tls/ca.crt') }}" | ||
| ETCD_PEER_CLIENT_CERT_AUTH="true" | ||
| ETCD_CLIENT_CERT_AUTH="true" | ||
| ETCD_TLS_MIN_VERSION="TLS1.2" | ||
| {% endif %} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,42 +1,34 @@ | ||
| --- | ||
| # for add_pgnode.yml | ||
|
|
||
| - name: Ensure TLS directories exist | ||
| ansible.builtin.file: | ||
| path: "{{ item | dirname }}" | ||
| state: directory | ||
| owner: "{{ tls_owner | default('postgres') }}" | ||
| group: "{{ tls_owner | default('postgres') }}" | ||
| mode: "0750" | ||
| loop: | ||
| - "{{ tls_privatekey_path | default('/etc/tls/server.key') }}" | ||
| - "{{ tls_cert_path | default('/etc/tls/server.crt') }}" | ||
|
|
||
| - name: Fetch TLS certificate and key from master | ||
| - name: Fetch TLS certificate, key and CA from the master node into memory | ||
| run_once: true | ||
| ansible.builtin.fetch: | ||
| ansible.builtin.slurp: | ||
| src: "{{ item }}" | ||
| dest: "files/tls/" | ||
| validate_checksum: true | ||
| flat: true | ||
| delegate_to: "{{ groups.master[0] }}" | ||
| register: tls_files | ||
| loop: | ||
| - "{{ tls_privatekey_path | default('/etc/tls/server.key') }}" | ||
| - "{{ tls_cert_path | default('/etc/tls/server.crt') }}" | ||
| - "{{ tls_ca_cert_path | default('/etc/tls/ca.crt') }}" | ||
| tags: tls, tls_cert_copy | ||
|
|
||
| - name: Create directory {{ copy_tls_privatekey_path | default(tls_privatekey_path | default('/etc/tls/server.key')) | dirname }} | ||
| ansible.builtin.file: | ||
| path: "{{ copy_tls_privatekey_path | default(tls_privatekey_path | default('/etc/tls/server.key')) | dirname }}" | ||
| state: directory | ||
| owner: "{{ copy_tls_owner | default(tls_owner | default('postgres')) }}" | ||
| group: "{{ copy_tls_owner | default(tls_owner | default('postgres')) }}" | ||
| mode: "0755" | ||
| tags: tls, tls_cert_copy | ||
|
|
||
| - name: Copy TLS certificate and key to replica | ||
| - name: Copy PostgreSQL TLS certificate, key and CA to all nodes | ||
| ansible.builtin.copy: | ||
| src: "files/tls/{{ item.path | basename }}" | ||
| content: "{{ tls_files.results[item.index].content | b64decode }}" | ||
| dest: "{{ item.path }}" | ||
| owner: "{{ tls_owner | default('postgres') }}" | ||
| group: "{{ tls_owner | default('postgres') }}" | ||
| owner: "{{ copy_tls_owner | default(tls_owner | default('postgres')) }}" | ||
| group: "{{ copy_tls_owner | default(tls_owner | default('postgres')) }}" | ||
| mode: "{{ item.mode }}" | ||
| loop: | ||
| - { path: "{{ tls_privatekey_path | default('/etc/tls/server.key') }}", mode: "{{ tls_privatekey_mode | default('0400') }}" } | ||
| - { path: "{{ tls_cert_path | default('/etc/tls/server.crt') }}", mode: "{{ tls_cert_mode | default('0644') }}" } | ||
|
|
||
| - name: Delete TLS certificate and key from the ansible controller | ||
| ansible.builtin.file: | ||
| path: "files/tls/" | ||
| state: absent | ||
| delegate_to: localhost | ||
| - { index: 1, path: "{{ copy_tls_cert_path | default(tls_cert_path | default('/etc/tls/server.crt')) }}", mode: "0644" } | ||
| - { index: 2, path: "{{ copy_tls_ca_cert_path | default(tls_ca_cert_path | default('/etc/tls/ca.crt')) }}", mode: "0644" } | ||
| - { index: 0, path: "{{ copy_tls_privatekey_path | default(tls_privatekey_path | default('/etc/tls/server.key')) }}", mode: "0400" } | ||
| tags: tls, tls_cert_copy |
Oops, something went wrong.