Gecko [ goons4good.org ]

Name	Size	Permission	Date
__pycache__	[ DIR ]	drwxr-xr-x	2022-10-11 05:09
__init__.py	48.88 KB	-rw-r--r--	2022-05-16 09:16
azureblob.py	13.88 KB	-rw-r--r--	2022-05-16 09:16
cmd_json.py	787 B	-rw-r--r--	2022-05-16 09:16
cmd_yaml.py	893 B	-rw-r--r--	2022-05-16 09:16
cmd_yamlex.py	674 B	-rw-r--r--	2022-05-16 09:16
cobbler.py	1.64 KB	-rw-r--r--	2022-05-16 09:16
confidant.py	3.29 KB	-rw-r--r--	2022-05-16 09:16
consul_pillar.py	11.61 KB	-rw-r--r--	2022-05-16 09:16
csvpillar.py	1.85 KB	-rw-r--r--	2022-05-16 09:16
digicert.py	1007 B	-rw-r--r--	2022-05-16 09:16
django_orm.py	7.74 KB	-rw-r--r--	2022-05-16 09:16
ec2_pillar.py	10.12 KB	-rw-r--r--	2022-05-16 09:16
etcd_pillar.py	2.36 KB	-rw-r--r--	2022-05-16 09:16
extra_minion_data_in_pillar.py	2.18 KB	-rw-r--r--	2022-05-16 09:16
file_tree.py	18.03 KB	-rw-r--r--	2022-05-16 09:16
foreman.py	3.66 KB	-rw-r--r--	2022-05-16 09:16
git_pillar.py	19.61 KB	-rw-r--r--	2022-05-16 09:16
gpg.py	560 B	-rw-r--r--	2022-05-16 09:16
hg_pillar.py	3.19 KB	-rw-r--r--	2022-05-16 09:16
hiera.py	846 B	-rw-r--r--	2022-05-16 09:16
http_json.py	2.43 KB	-rw-r--r--	2022-05-16 09:16
http_yaml.py	2.43 KB	-rw-r--r--	2022-05-16 09:16
libvirt.py	5.78 KB	-rw-r--r--	2022-05-16 09:16
makostack.py	21.99 KB	-rw-r--r--	2022-05-16 09:16
mongo.py	5.6 KB	-rw-r--r--	2022-05-16 09:16
mysql.py	3.76 KB	-rw-r--r--	2022-05-16 09:16
nacl.py	744 B	-rw-r--r--	2022-05-16 09:16
netbox.py	29.5 KB	-rw-r--r--	2022-05-16 09:16
neutron.py	2.41 KB	-rw-r--r--	2022-05-16 09:16
nodegroups.py	1.7 KB	-rw-r--r--	2022-05-16 09:16
pepa.py	20.98 KB	-rw-r--r--	2022-05-16 09:16
pillar_ldap.py	10.95 KB	-rw-r--r--	2022-05-16 09:16
postgres.py	2.82 KB	-rw-r--r--	2022-05-16 09:16
puppet.py	846 B	-rw-r--r--	2022-05-16 09:16
reclass_adapter.py	4 KB	-rw-r--r--	2022-05-16 09:16
redismod.py	3.28 KB	-rw-r--r--	2022-05-16 09:16
rethinkdb_pillar.py	4.71 KB	-rw-r--r--	2022-05-16 09:16
s3.py	14.4 KB	-rw-r--r--	2022-05-16 09:16
saltclass.py	1.49 KB	-rw-r--r--	2022-05-16 09:16
sql_base.py	15.38 KB	-rw-r--r--	2022-05-16 09:16
sqlcipher.py	3.42 KB	-rw-r--r--	2022-05-16 09:16
sqlite3.py	2.67 KB	-rw-r--r--	2022-05-16 09:16
stack.py	22.07 KB	-rw-r--r--	2022-05-16 09:16
svn_pillar.py	5.74 KB	-rw-r--r--	2022-05-16 09:16
varstack_pillar.py	1.1 KB	-rw-r--r--	2022-05-16 09:16
vault.py	4.03 KB	-rw-r--r--	2022-05-16 09:16
venafi.py	966 B	-rw-r--r--	2022-05-16 09:16
virtkey.py	586 B	-rw-r--r--	2022-05-16 09:16
vmware_pillar.py	16.83 KB	-rw-r--r--	2022-05-16 09:16

Rename

"""
Load up the libvirt keys into Pillar for a given minion if said keys have been
generated using the libvirt key runner

:depends: certtool
"""
import os
import subprocess

import salt.utils.files
import salt.utils.path
import salt.utils.stringutils

# Don't "fix" the above docstring to put it on two lines, as the sphinx
# autosummary pulls only the first line for its description.

def __virtual__():
    return salt.utils.path.which("certtool") is not None

def ext_pillar(minion_id, pillar, command):
    """
    Read in the generated libvirt keys
    """
    key_dir = os.path.join(__opts__["pki_dir"], "libvirt", minion_id)
    cacert = os.path.join(__opts__["pki_dir"], "libvirt", "cacert.pem")
    if not os.path.isdir(key_dir):
        # No keys have been generated
        gen_hyper_keys(
            minion_id,
            pillar.get("ext_pillar_virt.country", "US"),
            pillar.get("ext_pillar_virt.st", "Utah"),
            pillar.get("ext_pillar_virt.locality", "Salt Lake City"),
            pillar.get("ext_pillar_virt.organization", "Salted"),
            pillar.get("ext_pillar_virt.expiration_days", "365"),
        )
    ret = {}
    for key in os.listdir(key_dir):
        if not key.endswith(".pem"):
            continue
        fn_ = os.path.join(key_dir, key)
        with salt.utils.files.fopen(fn_, "r") as fp_:
            ret["libvirt.{}".format(key)] = salt.utils.stringutils.to_unicode(
                fp_.read()
            )
    with salt.utils.files.fopen(cacert, "r") as fp_:
        ret["libvirt.cacert.pem"] = salt.utils.stringutils.to_unicode(fp_.read())
    return ret

def gen_hyper_keys(
    minion_id,
    country="US",
    state="Utah",
    locality="Salt Lake City",
    organization="Salted",
    expiration_days="365",
):
    """
    Generate the keys to be used by libvirt hypervisors, this routine gens
    the keys and applies them to the pillar for the hypervisor minions
    """
    key_dir = os.path.join(__opts__["pki_dir"], "libvirt")
    if not os.path.isdir(key_dir):
        os.makedirs(key_dir)
    cakey = os.path.join(key_dir, "cakey.pem")
    cacert = os.path.join(key_dir, "cacert.pem")
    cainfo = os.path.join(key_dir, "ca.info")
    if not os.path.isfile(cainfo):
        with salt.utils.files.fopen(cainfo, "w+") as fp_:
            fp_.write("cn = salted\nca\ncert_signing_key")
    if not os.path.isfile(cakey):
        proc = subprocess.run(
            ["certtool", "--generate-privkey"],
            stdout=subprocess.PIPE,
            universal_newlines=True,
            check=True,
        )
        with salt.utils.files.fopen(cakey, "w") as wfh:
            wfh.write(proc.stdout)
    if not os.path.isfile(cacert):
        subprocess.call(
            [
                "certtool",
                "--generate-self-signed",
                "--load-privkey",
                cakey,
                "--template",
                cainfo,
                "--outfile",
                cacert,
            ]
        )
    sub_dir = os.path.join(key_dir, minion_id)
    if not os.path.isdir(sub_dir):
        os.makedirs(sub_dir)
    priv = os.path.join(sub_dir, "serverkey.pem")
    cert = os.path.join(sub_dir, "servercert.pem")
    srvinfo = os.path.join(sub_dir, "server.info")
    cpriv = os.path.join(sub_dir, "clientkey.pem")
    ccert = os.path.join(sub_dir, "clientcert.pem")
    clientinfo = os.path.join(sub_dir, "client.info")
    if not os.path.isfile(srvinfo):
        with salt.utils.files.fopen(srvinfo, "w+") as fp_:
            infodat = salt.utils.stringutils.to_str(
                "organization = salted\ncn = {}\ntls_www_server"
                "\nencryption_key\nsigning_key"
                "\ndigitalSignature\nexpiration_days = {}".format(
                    __grains__["fqdn"], expiration_days
                )
            )
            fp_.write(infodat)
    if not os.path.isfile(priv):
        proc = subprocess.run(
            ["certtool", "--generate-privkey"],
            stdout=subprocess.PIPE,
            universal_newlines=True,
            check=True,
        )
        with salt.utils.files.fopen(priv, "w") as wfh:
            wfh.write(proc.stdout)
    if not os.path.isfile(cert):
        subprocess.call(
            [
                "certtool",
                "--generate-certificate",
                "--load-privkey",
                priv,
                "--load-ca-certificate",
                cacert,
                "--load-ca-privkey",
                cakey,
                "--template",
                srvinfo,
                "--outfile",
                cert,
            ]
        )
    if not os.path.isfile(clientinfo):
        with salt.utils.files.fopen(clientinfo, "w+") as fp_:
            infodat = salt.utils.stringutils.to_str(
                "country = {}\nstate = {}\nlocality = {}\n"
                "organization = {}\ncn = {}\n"
                "tls_www_client\nencryption_key\nsigning_key\n"
                "digitalSignature".format(
                    country, state, locality, organization, __grains__["fqdn"]
                )
            )
            fp_.write(infodat)
    if not os.path.isfile(cpriv):
        proc = subprocess.run(
            ["certtool", "--generate-privkey"],
            stdout=subprocess.PIPE,
            universal_newlines=True,
            check=True,
        )
        with salt.utils.files.fopen(cpriv, "w") as wfh:
            wfh.write(proc.stdout)
    if not os.path.isfile(ccert):
        subprocess.call(
            [
                "certtool",
                "--generate-certificate",
                "--load-privkey",
                cpriv,
                "--load-ca-certificate",
                cacert,
                "--load-ca-privkey",
                cakey,
                "--template",
                clientinfo,
                "--outfile",
                ccert,
            ]
        )