Skip to content

Commit 9cb07d4

Browse files
keithquinnperconakeithquinnpercona
authored
PSMDB-1776: Adding Kerberos Docker Role (#449)
1 parent 8143e2d commit 9cb07d4

File tree

10 files changed

+222
-17
lines changed

10 files changed

+222
-17
lines changed

‎jstests/test_kerberos_simple.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
}
4040

4141
//add principal
42-
_runCmd("kadmin.local -q 'addprinc -pw exttestrw exttestrw'");
42+
_runCmd('docker exec kerberos sh -lc "kadmin.local -q \'addprinc -pw exttestrw exttestrw@PERCONATEST.COM\'"');
4343
_runCmd("kinit exttestrw <<<'exttestrw'");
4444

4545
//check connection

‎psmdb-tarball/psmdb-tarball/playbooks/playbook.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,4 +77,4 @@
7777
- role: '../../../roles/docker'
7878
- role: '../../../roles/openldap'
7979
- role: '../../../roles/kmip-vault'
80-
- role: '../../../roles/kerberos'
80+
- role: '../../../roles/kerberos-docker'

‎psmdb-tarball/psmdb-tarball/playbooks/prepare.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -211,4 +211,3 @@
211211
virtualenv: /opt/venv
212212
virtualenv_command: /opt/python/bin/virtualenv
213213
virtualenv_python: /opt/python/bin/python3
214-

‎psmdb/psmdb/playbooks/playbook.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@
1010
- role: '../../../roles/easyrsa'
1111
- role: '../../../roles/openldap'
1212
- role: '../../../roles/kmip-vault'
13-
- role: '../../../roles/kerberos'
13+
- role: '../../../roles/kerberos-docker'

‎psmdb/psmdb/tests/test_psmdb_install.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -321,7 +321,7 @@ def test_auth(host,auth):
321321
if auth == 'GSSAPI':
322322
with host.sudo():
323323
hostname = host.check_output('hostname')
324-
host.check_output('kadmin.local -q "addprinc -pw exttestrw exttestrw"')
324+
host.check_output('docker exec kerberos sh -c "kadmin.local -q \'addprinc -pw exttestrw exttestrw\'"')
325325
host.check_output('bash -c "kinit exttestrw <<<\'exttestrw\'"')
326326
result = host.check_output('mongo -u [email protected] --host '+ hostname +' --authenticationMechanism=GSSAPI --authenticationDatabase \'$external\' --quiet --eval "db.runCommand({connectionStatus : 1})"')
327327
print(result)
@@ -378,7 +378,7 @@ def test_encryption(host,encryption,cipher):
378378
conf['security']['kmip']['clientCertificateFile'] = MONGO_PEM_FILE
379379
conf['security']['kmip']['serverCAFile'] = CA_KMIP_FILE
380380

381-
#erase data and setup config
381+
#erase data and setup config
382382
apply_conf(host,conf,True)
383383

384384
#check startup with encryption

‎roles/kerberos-docker/tasks/Debian.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
- name: Install dependencies (Debian)
2+
apt:
3+
update_cache: yes
4+
name:
5+
- krb5-user
6+
- python3-docker
7+
state: present
8+
become: yes
9+
when: ansible_os_family == "Debian"

‎roles/kerberos-docker/tasks/RedHat.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
- name: Install pip (RedHat)
2+
become: true
3+
package:
4+
name: python3-pip
5+
state: present
6+
when: ansible_os_family == "RedHat"
7+
8+
- name: Create venv (RedHat)
9+
become: true
10+
command: /usr/bin/python3 -m venv /opt/ansible-venv
11+
args:
12+
creates: /opt/ansible-venv/bin/python
13+
when: ansible_os_family == "RedHat"
14+
15+
- name: Upgrade pip in venv (RedHat)
16+
become: true
17+
command: /opt/ansible-venv/bin/python -m pip install --upgrade pip
18+
when: ansible_os_family == "RedHat"
19+
20+
- name: Install packages in venv (RedHat)
21+
become: true
22+
command: /opt/ansible-venv/bin/python -m pip install --upgrade --ignore-installed docker requests
23+
when: ansible_os_family == "RedHat"
24+
25+
- name: Use venv interpreter (RedHat)
26+
set_fact:
27+
ansible_python_interpreter: /opt/ansible-venv/bin/python
28+
when: ansible_os_family == "RedHat"
29+
30+
- name: Install dependencies (Redhat)
31+
yum:
32+
update_cache: yes
33+
name:
34+
- krb5-workstation
35+
state: present
36+
become: yes
37+
when: ansible_os_family == "RedHat"

‎roles/kerberos-docker/tasks/main.yml‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
- include_tasks: "RedHat.yml"
2+
- include_tasks: "Debian.yml"
3+
4+
- name: Get system hostname
5+
ansible.builtin.shell: hostname
6+
register: hostname_raw
7+
changed_when: false
8+
9+
- name: Set hostname variable
10+
ansible.builtin.set_fact:
11+
hostname: "{{ hostname_raw.stdout }}"
12+
13+
- name: Remove pre-existing kerberos container
14+
docker_container:
15+
name: kerberos
16+
state: absent
17+
keep_volumes: false
18+
19+
- name: Create required folders
20+
become: true
21+
ansible.builtin.file:
22+
path: "{{ item }}"
23+
state: directory
24+
owner: root
25+
group: root
26+
mode: '0750'
27+
loop:
28+
- /var/lib/krb5kdc
29+
- /keytabs
30+
31+
- name: Copy KDC configuration file to host
32+
template:
33+
src: krb5.conf
34+
dest: "/etc/krb5.conf"
35+
36+
- name: Start Kerberos container
37+
community.docker.docker_container:
38+
name: kerberos
39+
image: "alpine"
40+
command: >
41+
sh -c '
42+
apk add --no-cache bash krb5 krb5-server krb5-pkinit &&
43+
if [ ! -f /var/lib/krb5kdc/principal ]; then
44+
kdb5_util -P password create &&
45+
kadmin.local -q "addprinc -pw password root/admin";
46+
fi &&
47+
/usr/sbin/krb5kdc -n
48+
'
49+
restart_policy: unless-stopped
50+
published_ports:
51+
- "88:88/udp"
52+
- "88:88/tcp"
53+
volumes:
54+
- "/etc/krb5.conf:/etc/krb5.conf"
55+
- "/var/lib/krb5kdc:/var/lib/krb5kdc"
56+
- "/keytabs:/keytabs"
57+
58+
- name: Waiting for Kerberos container to be ready
59+
ansible.builtin.command:
60+
cmd: >
61+
docker exec kerberos sh -c 'test -x /usr/sbin/kadmin.local'
62+
register: kadmin_check
63+
retries: 10
64+
delay: 2
65+
until: kadmin_check.rc == 0
66+
changed_when: false
67+
68+
- name: Create MongoDB service principal for mongod
69+
ansible.builtin.command:
70+
cmd: >
71+
docker exec kerberos sh -c 'kadmin.local -q "addprinc -randkey mongodb/{{ hostname }}@PERCONATEST.COM"'
72+
register: add_service_princ
73+
failed_when: >
74+
add_service_princ.rc != 0 and
75+
("already exists" not in (add_service_princ.stderr | default(''))) and
76+
("already exists" not in (add_service_princ.stdout | default('')))
77+
78+
- name: Create Service Key and store it in the Keytab
79+
ansible.builtin.command:
80+
cmd: >
81+
docker exec kerberos sh -c 'kadmin.local -q "ktadd -k /keytabs/mongodb.keytab mongodb/{{ hostname }}@PERCONATEST.COM"'
82+
83+
- name: Copy mongodb.keytab from container to host
84+
ansible.builtin.command:
85+
cmd: >
86+
docker cp kerberos:/keytabs/mongodb.keytab /etc/mongodb.keytab
87+
register: docker_cp_keytab
88+
changed_when: docker_cp_keytab.rc == 0
89+
90+
- name: Give /etc/mongodb.keytab mongod permissions
91+
ansible.builtin.file:
92+
path: /etc/mongodb.keytab
93+
owner: mongod
94+
group: mongod
95+
mode: '0600'
96+
97+
- name: Add KRB5_KTNAME variable for PSMDB (Debian)
98+
lineinfile:
99+
path: /etc/default/mongod
100+
line: KRB5_KTNAME=/etc/mongodb.keytab
101+
create: yes
102+
when: ansible_os_family == "Debian"
103+
104+
- name: Add KRB5_KTNAME variable for PSMDB (RedHat)
105+
lineinfile:
106+
path: /etc/sysconfig/mongod
107+
line: KRB5_KTNAME=/etc/mongodb.keytab
108+
create: yes
109+
when: ansible_os_family == "RedHat"
110+
111+
- name: Check if Percona directory exists
112+
ansible.builtin.stat:
113+
path: /percona-server-mongodb
114+
register: percona_dir
115+
116+
- name: Restart mongod to pick up Kerberos keytab env
117+
ansible.builtin.service:
118+
name: mongod
119+
state: restarted
120+
enabled: yes
121+
when: not percona_dir.stat.isdir | default(false)
122+
123+
- name: Adding short form of hostname to /etc/hosts (Debian 11)
124+
become: true
125+
ansible.builtin.replace:
126+
path: /etc/hosts
127+
regexp: '^\s*(127\.0\.1\.1)\s+.*$'
128+
replace: '\1 {{ hostname }}'
129+
unsafe_writes: true
130+
when:
131+
- ansible_distribution == "Debian"
132+
- ansible_distribution_major_version | int == 11
133+
134+
- name: Add kerberos user to /etc/hosts
135+
lineinfile:
136+
state: present
137+
dest: /etc/hosts
138+
line: '127.0.0.1 {{ hostname }}'
139+
unsafe_writes: yes

‎roles/kerberos-docker/templates/krb5.conf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
2+
[libdefaults]
3+
default_realm = PERCONATEST.COM
4+
forwardable = true
5+
dns_lookup_realm = false
6+
dns_lookup_kdc = false
7+
ignore_acceptor_hostname = true
8+
rdns = false
9+
ticket_lifetime = 10m
10+
renew_lifetime = 10m
11+
[realms]
12+
PERCONATEST.COM = {
13+
kdc_ports = 88
14+
kdc = 127.0.0.1
15+
}
16+
[domain_realm]
17+
.perconatest.com = PERCONATEST.COM
18+
perconatest.com = PERCONATEST.COM
19+
kerberos = PERCONATEST.COM

‎roles/kmip-vault/tasks/main.yml‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@
3939
"max_lease_ttl": "720h",
4040
"ui": true,
4141
"log_level": "debug",
42-
"log_format": "json"
42+
"log_format": "json",
43+
"api_addr": "https://127.0.0.1:8200"
4344
}
4445
VAULT_ADDR: https://127.0.0.1:8200
4546
VAULT_CACERT: /etc/vault/ca.crt
@@ -49,16 +50,17 @@
4950
capabilities:
5051
- "IPC_LOCK"
5152

52-
- name: Wait for Vault TCP port to open
53-
wait_for:
54-
host: 127.0.0.1
55-
port: 8200
56-
delay: 1
57-
timeout: 60
58-
59-
- name: Wait for 5 seconds
60-
ansible.builtin.wait_for:
61-
timeout: 5
53+
- name: Poll Vault health endpoint until API is responding
54+
ansible.builtin.uri:
55+
url: "https://127.0.0.1:8200/v1/sys/health"
56+
method: GET
57+
status_code: [200, 429, 472, 473, 501]
58+
return_content: yes
59+
validate_certs: no
60+
register: vault_health
61+
retries: 10
62+
delay: 2
63+
until: vault_health.status in [200, 429, 472, 473, 501]
6264

6365
- name: Initiate Vault
6466
community.docker.docker_container_exec:

0 commit comments

Comments
 (0)