From c4ef48c5e80c9533b2f20a9a89c6c7319fbc28e2 Mon Sep 17 00:00:00 2001 From: Brad Thurber Date: Tue, 19 Apr 2016 12:51:17 -0400 Subject: [PATCH] add new gitfs functionality --- README.rst | 5 ++ pillar.example | 10 +++ salt/files/gitfs_key.jinja | 1 + salt/files/master.d/f_defaults.conf | 95 +++++++++++++++++++++++++++-- salt/gitfs/keys.sls | 20 ++++++ 5 files changed, 127 insertions(+), 4 deletions(-) create mode 100644 salt/files/gitfs_key.jinja create mode 100644 salt/gitfs/keys.sls diff --git a/README.rst b/README.rst index fd3948a..67e3294 100644 --- a/README.rst +++ b/README.rst @@ -63,6 +63,11 @@ Install gitfs backend dulwich dependencies. Set ``salt:master:gitfs_provider: du Install gitfs backend GitPython dependenciess. Set ``salt:master:gitfs_provider: gitpython`` in your pillar. +``salt.gitfs.keys`` +---------------------- + +Install ssh keys to be used by gitfs + ``salt.gitfs.pygit2`` ---------------------- diff --git a/pillar.example b/pillar.example index ec2c51d..db8fc55 100644 --- a/pillar.example +++ b/pillar.example @@ -115,6 +115,16 @@ salt: user: ubuntu sudo: True priv: /etc/salt/ssh_keys/sshkey.pem + gitfs: + keys: + global: + # key and pub end up being the extension used on the key file. values other than key and pub are possible + key: | + -----BEGIN RSA PRIVATE KEY----- + ........... + -----END RSA PRIVATE KEY----- + pub: | + ........... salt_cloud_certs: aws: diff --git a/salt/files/gitfs_key.jinja b/salt/files/gitfs_key.jinja new file mode 100644 index 0000000..9d11fbb --- /dev/null +++ b/salt/files/gitfs_key.jinja @@ -0,0 +1 @@ +{{ pillar['salt']['gitfs']['keys'][key][type] }} \ No newline at end of file diff --git a/salt/files/master.d/f_defaults.conf b/salt/files/master.d/f_defaults.conf index 0f35b2a..fbec0a9 100644 --- a/salt/files/master.d/f_defaults.conf +++ b/salt/files/master.d/f_defaults.conf @@ -699,9 +699,37 @@ fileserver_backend: # Git File Server Backend Configuration # -# Gitfs can be provided by one of two python modules: GitPython or pygit2. If -# using pygit2, both libgit2 and git must also be installed. -{{ get_config('gitfs_provider', 'gitpython') }} +# Optional parameter used to specify the provider to be used for gitfs. Must +# be one of the following: pygit2, gitpython, or dulwich. If unset, then each +# will be tried in that same order, and the first one with a compatible +# version installed will be the provider that is used. +{{ get_config('gitfs_provider', 'pygit2') }} + +# Along with gitfs_password, is used to authenticate to HTTPS remotes. +{{ get_config('gitfs_user', 'git') }} + +# Along with gitfs_user, is used to authenticate to HTTPS remotes. +# This parameter is not required if the repository does not use authentication. +{{ get_config('gitfs_password', 'mypassword') }} + +# By default, Salt will not authenticate to an HTTP (non-HTTPS) remote. +# This parameter enables authentication over HTTP. Enable this at your own risk. +{{ get_config('gitfs_insecure_auth', 'False') }} + +# Along with gitfs_privkey (and optionally gitfs_passphrase), is used to authenticate +# to SSH remotes. This parameter (or its per-remote counterpart) is required for SSH remotes. +{{ get_config('gitfs_pubkey', '/path/to/key.pub') }} + +# Along with gitfs_pubkey (and optionally gitfs_passphrase), is used to authenticate +# to SSH remotes. This parameter (or its per-remote counterpart) is required for SSH remotes. +{{ get_config('gitfs_privkey', '/path/to/key') }} + +# This parameter is optional, required only when the SSH key being used to +# authenticate is protected by a passphrase. +{{ get_config('gitfs_passphrase', 'mypassphrase') }} + +# Along with gitfs_user, is used to authenticate to HTTPS remotes. +# This parameter is not required if the repository does not use authentication. # When using the git fileserver backend at least one git remote needs to be # defined. The user running the salt master will need read access to the repo. @@ -865,8 +893,67 @@ ext_pillar: {{ get_config('pillar_source_merging_strategy', 'smart') }} # Recursively merge lists by aggregating them instead of replacing them. -{{ get_config('pillar_merge_lists', 'False') }} +{{ get_config('pillar_merge_lists', False) }} +# Git External Pillar (git_pillar) Configuration Options +# +# Specify the provider to be used for git_pillar. Must be either pygit2 or +# gitpython. If unset, then both will be tried in that same order, and the +# first one with a compatible version installed will be the provider that +# is used. +{{ get_config('git_pillar_provider', 'pygit2') }} + +# If the desired branch matches this value, and the environment is omitted +# from the git_pillar configuration, then the environment for that git_pillar +# remote will be base. +{{ get_config('git_pillar_base', 'master') }} + +# If the branch is omitted from a git_pillar remote, then this branch will +# be used instead. +{{ get_config('git_pillar_branch', 'master') }} + +# Environment to use for git_pillar remotes. This is normally derived from +# the branch/tag (or from a per-remote env parameter), but if set this will +# override the process of deriving the env from the branch/tag name. +{{ get_config('git_pillar_env', '') }} + +# Path relative to the root of the repository where the git_pillar top file +# and SLS files are located. +{{ get_config('git_pillar_root', 'pillar') }} + +# Specifies whether or not to ignore SSL certificate errors when contacting +# the remote repository. +{{ get_config('git_pillar_ssl_verify', True) }} + +# When set to False, if there is an update/checkout lock for a git_pillar +# remote and the pid written to it is not running on the master, the lock +# file will be automatically cleared and a new lock will be obtained. +{{ get_config('git_pillar_global_lock', False) }} + +# Git External Pillar Authentication Options +# +# Along with git_pillar_password, is used to authenticate to HTTPS remotes. +{{ get_config('git_pillar_user', '') }} + +# Along with git_pillar_user, is used to authenticate to HTTPS remotes. +# This parameter is not required if the repository does not use authentication. +{{ get_config('git_pillar_password', '') }} + +# By default, Salt will not authenticate to an HTTP (non-HTTPS) remote. +# This parameter enables authentication over HTTP. +{{ get_config('git_pillar_insecure_auth', False) }} + +# Along with git_pillar_privkey (and optionally git_pillar_passphrase), +# is used to authenticate to SSH remotes. +{{ get_config('git_pillar_pubkey', '/path/to/key.pub') }} + +# Along with git_pillar_pubkey (and optionally git_pillar_passphrase), +# is used to authenticate to SSH remotes. +{{ get_config('git_pillar_privkey', '/path/to/key') }} + +# This parameter is optional, required only when the SSH key being used +# to authenticate is protected by a passphrase. +{{ get_config('git_pillar_passphrase', '') }} ##### Syndic settings ##### ########################################## diff --git a/salt/gitfs/keys.sls b/salt/gitfs/keys.sls new file mode 100644 index 0000000..badc467 --- /dev/null +++ b/salt/gitfs/keys.sls @@ -0,0 +1,20 @@ +{%- from "salt/map.jinja" import salt_settings with context %} + +{%- set gitfs_keys=salt['pillar.get']('salt:gitfs:keys') %} + +{%- for key, keyvalues in gitfs_keys.items() %} +{%- for type, keydata in keyvalues.items() %} +gitfs-key-{{ key }}-{{ type }}: + file.managed: + - name: {{ salt_settings.config_path }}/pki/gitfs/{{ key }}.{{ type }} + - source: salt://salt/files/gitfs_key.jinja + - template: jinja + - user: root + - group: root + - mode: 600 + - makedirs: True + - defaults: + key: {{ key }} + type: {{ type }} +{%- endfor %} +{%- endfor %} \ No newline at end of file