Skip to content

Commit 6de48c4

Browse files
BrianSiposlinkodm1
BrianSipos
and
linkodm1
authored
Updates needed to install PKIX files needed for deployment and in CI (#80)
* Updates needed to install PKIX files needed for deployment and in CI * Add hostenv option to control FIPS mode at all * bumping version of docker to fix request issue --------- Co-authored-by: linkodm1 <[email protected]>
1 parent a0bd1f5 commit 6de48c4

File tree

10 files changed

+107
-63
lines changed

10 files changed

+107
-63
lines changed

‎.gitlab-ci.yml

+5
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ variables:
4242
DOCKER_BUILDKIT: 1
4343
# for Python/PIP
4444
PIP_CERT: /etc/pki/tls/certs/ca-bundle.crt
45+
PIP_DEFAULT_TIMEOUT: 300
4546
# for Ruby/bolt
4647
SSL_CERT_FILE: /etc/pki/tls/certs/ca-bundle.crt
4748
# Project-specific environment
@@ -346,6 +347,10 @@ deploy:
346347
anms::docker_image_tag: "${DOCKER_IMAGE_TAG}"
347348
anms::docker_registry_user: "${DOCKER_REGISTRY_USERNAME}"
348349
anms::docker_registry_pass: "${DOCKER_REGISTRY_PASSWORD}"
350+
anms::tls_server_key: 'puppet:///modules/apl_test/anms/tls/private/ammos-server-key.pem'
351+
anms::tls_server_cert: 'puppet:///modules/apl_test/anms/tls/certs/ammos-server-cert.pem'
352+
anms::tls_server_ca: 'puppet:///modules/apl_test/anms/tls/certs/ammos-ca-bundle.crt'
353+
anms::hostenv::use_fips: false
349354
selinux::mode: permissive
350355
selinux::type: targeted
351356
EOF

‎anms-core/pyproject.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ dependencies = [
2626
"asyncio ~=3.4.3",
2727
"asyncpg ~=0.27.0",
2828
"authlib ~=0.15.5",
29-
"docker ~=6.0.1",
29+
"docker ~=7.1.0",
3030
"emails ~=0.6",
3131
"email-validator ~=1.3",
3232
"fastapi ~=0.86.0",

‎puppet/.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ bolt-debug.log
99
# Files replaced by prep.sh
1010
modules/anms/files/docker-compose.yml
1111
modules/anms/files/agent-compose.yml
12+
modules/anms/files/create_volume.sh
1213

1314
# Files replaced by apply_local.sh
1415
data/override.yaml

‎puppet/Puppetfile

+2-6
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,9 @@
44
# The following directive installs modules to the managed moduledir.
55
moduledir '.modules'
66

7-
mod 'simp/crypto_policy', '0.5.0'
7+
mod 'simp/crypto_policy', '0.6.0'
88
mod 'simp/fips', '0.9.0'
99
mod 'puppetlabs/java_ks', '5.0.0'
10-
mod 'puppetlabs/docker', '7.0.0'
1110
mod 'puppetlabs/concat', '7.4.0'
1211
mod 'puppetlabs/apt', '9.0.2'
1312
mod 'puppet/trusted_ca', '4.1.0'
@@ -17,8 +16,5 @@ mod 'puppet/firewalld', '5.0.0'
1716
mod 'puppetlabs/stdlib', '8.6.0'
1817
mod 'simp/simplib', '4.12.2'
1918
mod 'puppet/augeasproviders_grub', '5.1.0'
20-
mod 'puppetlabs/powershell', '6.0.0'
21-
mod 'puppetlabs/reboot', '5.0.0'
22-
mod 'simp/simpkv', '0.12.0'
19+
mod 'simp/simpkv', '0.13.0'
2320
mod 'puppet/augeasproviders_core', '4.1.0'
24-
mod 'puppetlabs/pwshlib', '1.1.1'

‎puppet/modules/anms/files/selinux/authnz.cil

+1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
(block authnz
22
(blockinherit container)
33
(blockinherit restricted_net_container)
4+
(allow process container_file_t ( chr_file ( map )))
45
(allow process http_port_t ( tcp_socket ( name_bind )))
56
(allow process http_port_t ( tcp_socket ( name_connect )))
67
)

‎puppet/modules/anms/manifests/docker.pp

+10-7
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@
55
class anms::docker() {
66
case $facts['os']['family'] {
77
'RedHat': {
8-
package { ['podman', 'runc']:
8+
package { ['podman-docker', 'podman', 'runc']:
99
ensure => 'absent',
10-
before => Package['docker-ce'],
10+
before => [Package['docker-ce'], Package['docker-ce-cli']],
1111
}
1212
package { 'yum-utils':
1313
ensure => 'installed',
@@ -30,17 +30,20 @@
3030
ensure => 'installed',
3131
}
3232
service { 'docker':
33+
ensure => 'running',
34+
enable => true,
3335
require => Package['docker-ce'],
3436
}
3537

3638
file { '/usr/local/bin/docker-compose':
3739
ensure => 'absent',
3840
}
3941
file { '/etc/docker/daemon.json':
40-
source => 'puppet:///modules/anms/docker-daemon.json',
41-
owner => 'root',
42-
group => 'root',
43-
mode => '0644',
44-
notify => Service['docker'],
42+
source => 'puppet:///modules/anms/docker-daemon.json',
43+
owner => 'root',
44+
group => 'root',
45+
mode => '0644',
46+
require => Package['docker-ce'],
47+
notify => Service['docker'],
4548
}
4649
}

‎puppet/modules/anms/manifests/docker_compose.pp

+12-4
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
define anms::docker_compose(
99
Enum['present','absent'] $ensure,
1010
Array[String] $compose_files,
11+
Boolean $pull_first = true,
1112
String $up_args = '',
1213
) {
1314
require anms::docker
@@ -17,16 +18,23 @@
1718

1819
case $ensure {
1920
'present': {
21+
if $pull_first {
22+
exec { "docker-compose-${title}-pull":
23+
path => $facts['path'],
24+
command => "docker compose -p ${title} -f ${files_args} pull",
25+
before => Exec["docker-compose-${title}-up"],
26+
}
27+
}
2028
exec { "docker-compose-${title}-up":
21-
path => $facts['path'],
22-
command => "docker compose -p ${title} -f ${files_args} up --detach --remove-orphans ${up_args}",
29+
path => $facts['path'],
30+
command => "docker compose -p ${title} -f ${files_args} up --detach --remove-orphans ${up_args}",
2331
}
2432
}
2533
'absent': {
26-
exec { "docker-compose-${title}-up":
34+
exec { "docker-compose-${title}-rm":
2735
path => $facts['path'],
2836
command => "docker compose -p ${title} -f ${files_args} rm --force --stop",
29-
onlyif => $is_running,
37+
onlyif => $is_running,
3038
}
3139
}
3240
default: {

‎puppet/modules/anms/manifests/hostenv.pp

+21-15
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
11
# Define host environment configuration for ANMS installation.
22
#
3-
class anms::hostenv() {
3+
class anms::hostenv(
4+
Boolean $use_fips = true,
5+
) {
46
case $facts['os']['family'] {
57
'RedHat': {
68
# This halts on reboot_notify()
79
# instead run with:
810
# bolt apply --execute 'class {"fips": }'
9-
# class { 'fips': }
11+
if $use_fips {
12+
class { 'fips': }
13+
}
1014

1115
file { '/var/cache/puppet':
1216
ensure => 'directory',
@@ -60,20 +64,22 @@
6064
'Debian': {
6165
case $facts['os']['distro']['codename'] {
6266
'focal': {
63-
# Based on guidance at: https://aplwiki.jhuapl.edu/confluence/pages/viewpage.action?spaceKey=LAPLKEY&title=Ubuntu+FIPS+Packages
64-
apt::source { 'focal-fips':
65-
location => 'https://apllinuxdepot.jhuapl.edu/linux/apl-software/focal-fips/',
66-
release => '',
67-
repos => '/',
68-
key => {
69-
id => '6F6B15509CF8E59E6E469F327F438280EF8D349F',
70-
server => 'https://apllinuxdepot.jhuapl.edu/linux/apl-software/focal-fips/apl-software-repo.gpg',
71-
},
72-
}
67+
if $use_fips {
68+
# Based on guidance at: https://aplwiki.jhuapl.edu/confluence/pages/viewpage.action?spaceKey=LAPLKEY&title=Ubuntu+FIPS+Packages
69+
apt::source { 'focal-fips':
70+
location => 'https://apllinuxdepot.jhuapl.edu/linux/apl-software/focal-fips/',
71+
release => '',
72+
repos => '/',
73+
key => {
74+
id => '6F6B15509CF8E59E6E469F327F438280EF8D349F',
75+
server => 'https://apllinuxdepot.jhuapl.edu/linux/apl-software/focal-fips/apl-software-repo.gpg',
76+
},
77+
}
7378

74-
package { 'ubuntu-fips':
75-
ensure => 'installed',
76-
require => Apt::Source['focal-fips'],
79+
package { 'ubuntu-fips':
80+
ensure => 'installed',
81+
require => Apt::Source['focal-fips'],
82+
}
7783
}
7884
}
7985
default: {

‎puppet/modules/anms/manifests/init.pp

+49-28
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@
1212
String $cam_admin_password = '',
1313
String $cam_agent_name = $facts['networking']['fqdn'],
1414
String $cam_agent_password = '',
15-
# String $tls_server_key,
16-
# String $tls_server_cert,
17-
# String $tls_server_ca,
15+
Optional[String] $tls_server_key = undef,
16+
Optional[String] $tls_server_cert = undef,
17+
Optional[String] $tls_server_ca = undef,
1818
) {
1919
require Class['anms::hostenv']
2020

@@ -24,29 +24,31 @@
2424
file { '/ammos/anms/.env':
2525
ensure => 'file',
2626
content => epp('anms/env.epp'),
27-
}
28-
file { '/ammos/anms/docker-compose.yml':
29-
ensure => 'file',
30-
source => 'puppet:///modules/anms/docker-compose.yml',
27+
owner => 'root',
28+
group => 'root',
29+
mode => '0644',
3130
}
3231
file { ['/ammos/etc', '/ammos/etc/pki', '/ammos/etc/pki/tls',
3332
'/ammos/etc/pki/tls/private', '/ammos/etc/pki/tls/certs']:
3433
ensure => 'directory'
3534
}
3635
file { '/ammos/etc/pki/tls/private/ammos-server-key.pem':
3736
ensure => 'file',
37+
source => $tls_server_key,
3838
owner => 'root',
3939
group => 'root',
4040
mode => '0644',
4141
}
4242
file { '/ammos/etc/pki/tls/certs/ammos-server-cert.pem':
4343
ensure => 'file',
44+
source => $tls_server_cert,
4445
owner => 'root',
4546
group => 'root',
4647
mode => '0644',
4748
}
4849
file { '/ammos/etc/pki/tls/certs/ammos-ca-bundle.crt':
4950
ensure => 'file',
51+
source => $tls_server_ca,
5052
owner => 'root',
5153
group => 'root',
5254
mode => '0644',
@@ -101,32 +103,48 @@
101103
# Images pulled from remote registry
102104
if !empty($docker_image_prefix) and !empty($docker_registry_user) and !empty($docker_registry_pass) {
103105
exec { 'docker-login':
104-
command => "docker login ${docker_image_prefix} --username \"${docker_registry_user}\" --password \"${docker_registry_pass}\"",
105106
path => $facts['path'],
107+
command => "docker login ${docker_image_prefix} --username \"${docker_registry_user}\" --password \"${docker_registry_pass}\"",
108+
require => Service['docker'],
106109
before => [
107-
Exec['anms-pull'],
108-
Exec['agents-pull'],
109-
],
110-
}
111-
exec { 'anms-pull':
112-
command => 'docker-compose -f /ammos/anms/docker-compose.yml pull',
113-
path => $facts['path'],
114-
require => [
115-
File['/ammos/anms/docker-compose.yml'],
116-
File['/ammos/anms/.env'],
117-
],
118-
before => Anms::Docker_compose['anms'],
119-
}
120-
exec { 'agents-pull':
121-
command => 'docker-compose -f /ammos/anms/agent-compose.yml pull',
122-
path => $facts['path'],
123-
require => [
124-
File['/ammos/anms/agent-compose.yml'],
125-
File['/ammos/anms/.env'],
110+
Anms::Docker_compose['anms'],
111+
Anms::Docker_compose['agents'],
126112
],
127-
before => Anms::Docker_compose['agents'],
128113
}
129114
}
115+
116+
# volume for TLS-related PKIX files
117+
file { '/ammos/anms/create_volume.sh':
118+
ensure => 'file',
119+
source => 'puppet:///modules/anms/create_volume.sh',
120+
owner => 'root',
121+
group => 'root',
122+
mode => '0755',
123+
}
124+
exec { 'volume-ammos-tls':
125+
path => $facts['path'],
126+
command => '/ammos/anms/create_volume.sh',
127+
unless => 'docker volume inspect ammos-tls',
128+
require => [
129+
Service['docker'],
130+
File['/ammos/anms/create_volume.sh'],
131+
],
132+
subscribe => [
133+
File['/ammos/etc/pki/tls/private/ammos-server-key.pem'],
134+
File['/ammos/etc/pki/tls/certs/ammos-server-cert.pem'],
135+
File['/ammos/etc/pki/tls/certs/ammos-ca-bundle.crt'],
136+
],
137+
before => Anms::Docker_compose['anms'],
138+
notify => Anms::Docker_compose['anms'],
139+
}
140+
141+
file { '/ammos/anms/docker-compose.yml':
142+
ensure => 'file',
143+
source => 'puppet:///modules/anms/docker-compose.yml',
144+
owner => 'root',
145+
group => 'root',
146+
mode => '0644',
147+
}
130148
anms::docker_compose { 'anms':
131149
ensure => 'present',
132150
compose_files => ['/ammos/anms/docker-compose.yml'],
@@ -140,6 +158,9 @@
140158
file { '/ammos/anms/agent-compose.yml':
141159
ensure => 'file',
142160
source => 'puppet:///modules/anms/agent-compose.yml',
161+
owner => 'root',
162+
group => 'root',
163+
mode => '0644',
143164
}
144165
anms::docker_compose { 'agents':
145166
ensure => 'present',

‎puppet/prep.sh

+5-2
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,11 @@ set -e
2828
SELFDIR=$(dirname "${BASH_SOURCE[0]}")
2929
source ${SELFDIR}/getenv.sh
3030

31-
rm -f ${SELFDIR}/modules/anms/files/*-compose.yml
32-
cp "${SELFDIR}/../docker-compose.yml" "${SELFDIR}/../agent-compose.yml" "${SELFDIR}/modules/anms/files/"
31+
rm -f "${SELFDIR}"/modules/anms/files/*-compose.yml
32+
cp "${SELFDIR}/../docker-compose.yml" \
33+
"${SELFDIR}/../agent-compose.yml" \
34+
"${SELFDIR}/../create_volume.sh" \
35+
"${SELFDIR}/modules/anms/files/"
3336

3437
export BOLT_PROJECT="${SELFDIR}"
3538
bolt module install --force

0 commit comments

Comments
 (0)