Skip to content

Commit 4464a35

Browse files
rsuplinarsuplina
authored
Add tls_keystores role (#308)
Signed-off-by: rsuplina <[email protected]>
1 parent 7fe771e commit 4464a35

File tree

11 files changed

+834
-0
lines changed

11 files changed

+834
-0
lines changed

‎roles/tls_keystores/README.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# tls_keystores
2+
3+
Creates Java keystores (JKS) and truststores from TLS certificates and private keys. It is designed to work with certificates issued by FreeIPA.
4+
5+
## Features
6+
- Creates JKS keystores from certificate and private key files
7+
- Creates JKS truststores with CA certificates
8+
- Configurable keystore and truststore paths and aliases
9+
10+
## Requirements
11+
- Java keytool (part of Java installation)
12+
- community.general Ansible collection
13+
- Certificate and private key files must exist on target host
14+
15+
## Role Variables
16+
17+
| Variable | Type | Required | Default | Description |
18+
|----------|------|----------|---------|-------------|
19+
| `keystore_password` | `str` | Yes | `undef` | Password for both keystore and truststore |
20+
| `keystore_alias` | `str` | Yes | `undef` | Alias name for the certificate in the keystore |
21+
| `keystore_output_path` | `str` | No | `/etc/pki/tls/private/keystore.jks` | Path to output JKS keystore file |
22+
| `keystore_cert_path` | `str` | No | `/etc/pki/tls/certs/host.crt` | Path to the certificate file |
23+
| `keystore_key_path` | `str` | No | `/etc/pki/tls/private/host.key` | Path to the private key file |
24+
| `truststore_alias` | `str` | No | `ipa-ca` | Alias name for the CA certificate in the truststore |
25+
| `truststore_path` | `str` | No | `/etc/pki/tls/private/truststore.jks` | Path to output JKS truststore file |
26+
| `ca_cert_path` | `str` | No | `/etc/ipa/ca.crt` | Path to the CA certificate file |
27+
28+
## Example Playbook
29+
30+
```yaml
31+
- hosts: java_servers
32+
tasks:
33+
- name: Create Java keystores and truststores with default paths
34+
ansible.builtin.import_role:
35+
name: tls_keystores
36+
vars:
37+
keystore_password: "MySecurePassword123"
38+
keystore_alias: "service-cert"
39+
keystore_cert_path: "/etc/pki/tls/certs/host.crt"
40+
keystore_key_path: "/etc/pki/tls/private/host.key"
41+
truststore_alias: "ipa-ca"
42+
ca_cert_path: "/etc/ipa/ca.crt"
43+
44+
- name: Create Java keystores for EFM Gateway with custom paths
45+
ansible.builtin.import_role:
46+
name: tls_keystores
47+
vars:
48+
keystore_password: "MySecurePassword123"
49+
keystore_alias: "efm-gateway"
50+
keystore_output_path: "/opt/cloudera/cem/certs/keystore.jks"
51+
truststore_path: "/opt/cloudera/cem/certs/truststore.jks"
52+
keystore_cert_path: "/etc/pki/tls/certs/gateway.crt"
53+
keystore_key_path: "/etc/pki/tls/private/gateway.key"
54+
truststore_alias: "freeipa-ca"
55+
ca_cert_path: "/etc/ipa/ca.crt"
56+
```
57+
58+
## License
59+
60+
```
61+
Copyright 2025 Cloudera, Inc.
62+
63+
Licensed under the Apache License, Version 2.0 (the "License");
64+
you may not use this file except in compliance with the License.
65+
You may obtain a copy of the License at
66+
67+
https://www.apache.org/licenses/LICENSE-2.0
68+
69+
Unless required by applicable law or agreed to in writing, software
70+
distributed under the License is distributed on an "AS IS" BASIS,
71+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
72+
See the License for the specific language governing permissions and
73+
limitations under the License.
74+
```

‎roles/tls_keystores/defaults/main.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
# Copyright 2025 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
keystore_alias: "{{ undef(hint='Please define the Keystore alias') }}"
17+
keystore_password: "{{ undef(hint='Please define the Keystore password') }}"
18+
19+
keystore_cert_path: /etc/pki/tls/certs/host.crt
20+
keystore_key_path: /etc/pki/tls/private/host.key
21+
truststore_alias: ipa-ca
22+
ca_cert_path: /etc/ipa/ca.crt
23+
24+
keystore_output_path: /etc/pki/tls/private/keystore.jks
25+
truststore_path: /etc/pki/tls/private/truststore.jks

‎roles/tls_keystores/meta/argument_specs.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
argument_specs:
3+
main:
4+
short_description: Create Java keystores and truststores from TLS certificates
5+
description:
6+
- Creates JKS keystores from certificate and private key files
7+
- Creates JKS truststores with CA certificates
8+
author: Cloudera Labs
9+
version_added: "3.2.0"
10+
options:
11+
keystore_alias:
12+
description: Alias name for the certificate in the keystore
13+
type: str
14+
required: true
15+
keystore_password:
16+
description: Password for both keystore and truststore
17+
type: str
18+
required: true
19+
keystore_output_path:
20+
description: Path to output JKS keystore file
21+
type: str
22+
default: /etc/pki/tls/private/keystore.jks
23+
keystore_cert_path:
24+
description: Path to the certificate file
25+
type: str
26+
default: /etc/pki/tls/certs/host.crt
27+
keystore_key_path:
28+
description: Path to the private key file
29+
type: str
30+
default: /etc/pki/tls/private/host.key
31+
truststore_alias:
32+
description: Alias name for the CA certificate in the truststore
33+
type: str
34+
default: ipa-ca
35+
truststore_path:
36+
description: Path to output JKS truststore file
37+
type: str
38+
default: /etc/pki/tls/private/truststore.jks
39+
ca_cert_path:
40+
description: Path to the CA certificate file
41+
type: str
42+
default: /etc/ipa/ca.crt

‎roles/tls_keystores/molecule/default/converge.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
# Copyright 2025 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
- name: Converge
17+
hosts: all
18+
gather_facts: true
19+
tasks:
20+
- name: Provision JKS and truststore from TLS certificate and key
21+
ansible.builtin.import_role:
22+
name: cloudera.exe.tls_keystores

0 commit comments

Comments
 (0)