Add tls support

This adds TLS support for zookeeper

Change-Id: I08c847d1d47a2ebd81f089befbef9a54ea1f6d4c
Signed-off-by: Paul Belanger <pabelanger@redhat.com>

defaults/main.yaml

@@ -40,6 +40,20 @@ zookeeper_file_zoo_conf_group: zookeeper
 zookeeper_file_zoo_conf_mode: 0644
 zookeeper_file_zoo_conf_owner: zookeeper
 
+zookeeper_file_ssl_truststore_content:
+zookeeper_file_ssl_truststore_dest: /etc/zookeeper/ca/certs/cacert.pem
+zookeeper_file_ssl_truststore_group: "{{ zookeeper_user_group }}"
+zookeeper_file_ssl_truststore_mode: 0644
+zookeeper_file_ssl_truststore_owner: "{{ zookeeper_user_name }}"
+zookeeper_file_ssl_truststore_src: etc/zookeeper/ca/certs/cacert.pem
+
+zookeeper_file_ssl_keystore_content:
+zookeeper_file_ssl_keystore_dest: /etc/zookeeper/ca/keystores/server.pem
+zookeeper_file_ssl_keystore_group: "{{ zookeeper_user_group }}"
+zookeeper_file_ssl_keystore_mode: 0600
+zookeeper_file_ssl_keystore_owner: "{{ zookeeper_user_name }}"
+zookeeper_file_ssl_keystore_src: etc/zookeeper/ca/keystores/server.pem
+
 # tasks/install.yaml
 zookeeper_package_state: present
 

tasks/config.yaml

@@ -42,6 +42,9 @@
   with_items:
     - /etc/zookeeper
     - /etc/zookeeper/conf
+    - /etc/zookeeper/ca
+    - /etc/zookeeper/ca/certs
+    - /etc/zookeeper/ca/keystores
     - /var/log/zookeeper
 
 - name: Install zookeeper log4j.properties
@@ -54,6 +57,26 @@
     src: "{{ zookeeper_file_log4j_properties_src }}"
   register: zookeeper_file_log4j_properties
 
+- name: Install zookeeper ssl truststore configuration
+  become: true
+  template:
+    dest: "{{ zookeeper_file_ssl_truststore_dest }}"
+    group: "{{ zookeeper_file_ssl_truststore_group }}"
+    mode: "{{ zookeeper_file_ssl_truststore_mode }}"
+    owner: "{{ zookeeper_file_ssl_truststore_owner }}"
+    src: "{{ zookeeper_file_ssl_truststore_src }}"
+  register: zookeeper_file_ssl_truststore
+
+- name: Install zookeeper ssl keystore configuration
+  become: true
+  template:
+    dest: "{{ zookeeper_file_ssl_keystore_dest }}"
+    group: "{{ zookeeper_file_ssl_keystore_group }}"
+    mode: "{{ zookeeper_file_ssl_keystore_mode }}"
+    owner: "{{ zookeeper_file_ssl_keystore_owner }}"
+    src: "{{ zookeeper_file_ssl_keystore_src }}"
+  register: zookeeper_file_ssl_keystore
+
 - name: Install zookeeper myid
   become: yes
   template:

templates/etc/zookeeper/ca/certs/cacert.pem

@@ -0,0 +1,4 @@
+# This file is generated by Ansible
+#  DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
+#
+{{ zookeeper_file_ssl_truststore_content }}

templates/etc/zookeeper/ca/keystores/server.pem

@@ -0,0 +1,4 @@
+# This file is generated by Ansible
+#  DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
+#
+{{ zookeeper_file_ssl_keystore_content }}

tests/playbooks/run.yaml

@@ -23,8 +23,38 @@
     - name: Assert results are registered.
       assert:
         that:
+          - zookeeper_file_ssl_keystore
+          - zookeeper_file_ssl_truststore
           - zookeeper_service_zookeeper
 
+    - name: Register /etc/zookeeper/ca/certs/cacert.pem
+      stat:
+        path: /etc/zookeeper/ca/certs/cacert.pem
+      register: _zookeeper_file_ssl_truststore_stat
+
+    - name: Assert _zookeeper_file_ssl_truststore_stat tests.
+      assert:
+        that:
+          - _zookeeper_file_ssl_truststore_stat.stat.exists
+          - _zookeeper_file_ssl_truststore_stat.stat.isreg
+          - _zookeeper_file_ssl_truststore_stat.stat.pw_name == 'zookeeper'
+          - _zookeeper_file_ssl_truststore_stat.stat.gr_name == 'zookeeper'
+          - _zookeeper_file_ssl_truststore_stat.stat.mode == '0644'
+
+    - name: Register /etc/zookeeper/ca/keystores/server.pem
+      stat:
+        path: /etc/zookeeper/ca/keystores/server.pem
+      register: _zookeeper_file_ssl_keystore_stat
+
+    - name: Assert _zookeeper_file_ssl_keystore_stat tests.
+      assert:
+        that:
+          - _zookeeper_file_ssl_keystore_stat.stat.exists
+          - _zookeeper_file_ssl_keystore_stat.stat.isreg
+          - _zookeeper_file_ssl_keystore_stat.stat.pw_name == 'zookeeper'
+          - _zookeeper_file_ssl_keystore_stat.stat.gr_name == 'zookeeper'
+          - _zookeeper_file_ssl_keystore_stat.stat.mode == '0600'
+
     - name: Ensure zookeeper is running.
       become: yes
       shell: /usr/sbin/service zookeeper status