Skip to content

Commit e9fc2f1

Browse files
jimrightjimright
authored
New Roles to facilitate creation of FreeIPA sudoers group and rule (#6)
* Role for creating host group for FreeIPA server * Role for adding users to FreeIPA group and creating sudo rule for this group Signed-off-by: Jim Enright <jenright@cloudera.com>
1 parent 3491d3a commit e9fc2f1

File tree

11 files changed

+336
-1
lines changed

11 files changed

+336
-1
lines changed

‎galaxy.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ dependencies:
3939
'git+https://github.com/cloudera-labs/cloudera.cloud.git': 'main'
4040
'ansible.netcommon': '>=2.0.2'
4141
'community.aws': '>=1.2.0'
42+
'community.general': '>=3.1.0'
4243
'amazon.aws': '>=1.3.0'
4344
'azure.azcollection': '>=1.4.0'
4445
'google.cloud': '>=1.0.2'

‎roles/common/defaults/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@ common__env_name_suffix: "{{ env.suffix | default(common__env_s
122122
common__datalake_name: "{{ env.datalake.name | default([common__namespace_cdp, common__datalake_name_suffix] | join('-')) }}"
123123
common__datalake_name_suffix: "{{ env.datalake.suffix | default(common__datalake_suffix) }}"
124124

125+
common__env_admin_password: "{{ globals.admin_password | mandatory }}"
125126
# Deploy
126127
common__include_ml: "{{ ml is defined | bool }}"
127128
common__include_dw: "{{ dw is defined | bool }}"

‎roles/freeipa_host_group/defaults/main.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
3+
# Copyright 2021 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# global file for freeipa_host_group
18+
19+
# Role prefix is 'freeipa_host_group__'
20+
21+
# Variables used as inputs in main.yml
22+
freeipa_host_group__env_name: "{{ common__env_name }}"
23+
freeipa_host_group__infra_type: "{{ common__infra_type }}"
24+
freeipa_host_group__region: "{{ common__region }}"
25+
26+
# Outputs
27+
freeipa_host_group__host_group_name: "freeipa_server_hosts"

‎roles/freeipa_host_group/meta/main.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Copyright 2021 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
galaxy_info:
16+
author: Jim Enright (jenright@cloudera.com)
17+
description: >
18+
Creation of FreeIPA host group.
19+
company: Cloudera
20+
license: Apache-2.0
21+
22+
min_ansible_version: 2.10
23+
24+
platforms:
25+
- name: Debian
26+
versions: all
27+
- name: Fedora
28+
versions: all
29+
- name: GenericLinux
30+
versions: all
31+
- name: MacOSX
32+
versions: all
33+
- name: Ubuntu
34+
versions: all
35+
36+
galaxy_tags:
37+
- cloudera
38+
- cdp
39+
- freeipa
40+
41+
dependencies: ['cloudera.exe.common']

‎roles/freeipa_host_group/tasks/main.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
3+
# Copyright 2021 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# Get the FreeIPA server details in order to find its public IP address
18+
- name: Query the FreeIPA status
19+
cloudera.cloud.freeipa_info:
20+
name: "{{ freeipa_host_group__env_name }}"
21+
register: __freeipa_info
22+
23+
# Extract the instance ID for the FreeIPA server
24+
- name: Set facts for FreeIPA server instance ID
25+
ansible.builtin.set_fact:
26+
__freeipa_server_instance_id: "{{ __freeipa_info.environments.instances.keys() | first }}"
27+
28+
# Get instance details for specific infra_type - AWS
29+
- name: Gather FreeIPA instance details on AWS
30+
when: freeipa_host_group__infra_type == "aws"
31+
block:
32+
- name: Gather EC2 instance information using ID
33+
community.aws.ec2_instance_info:
34+
region: "{{ freeipa_host_group__region }}"
35+
instance_ids:
36+
- "{{ __freeipa_server_instance_id }}"
37+
register: __ec2_node_info
38+
39+
- name: Set facts for the FreeIPA server IP
40+
ansible.builtin.set_fact:
41+
__freeipa_server_public_ip: "{{ __ec2_node_info.instances | map(attribute='public_ip_address') }}"
42+
43+
# TODO: A block per cloud provider - azure
44+
# Get instance details for specific infra_type - Azure
45+
# - name: Gather FreeIPA instance details on Azure
46+
# when: freeipa_host_group__infra_type == "azure"
47+
# block:
48+
49+
# TODO: A block per cloud provider - GCP
50+
# Get instance details for specific infra_type - GCP
51+
# - name: Gather FreeIPA instance details on GCP
52+
# when: freeipa_host_group__infra_type == "gcp"
53+
# block:
54+
55+
# Add the FreeIPA server and username to the inventory
56+
- name: Add FreeIPA servers to inventory
57+
ansible.builtin.add_host:
58+
name: "{{ item }}"
59+
groups: "{{ freeipa_host_group__host_group_name }}"
60+
loop: "{{ __freeipa_server_public_ip }}"
61+

‎roles/platform/defaults/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ plat__xacccount_credential_name: "{{ common__xaccount_credential_na
6363
plat__workload_analytics: "{{ env.workload_analytics | default(True) }}"
6464
plat__tunnel: "{{ env.tunnel | default(True) }}"
6565

66-
plat__env_admin_password: "{{ globals.admin_password | mandatory }}"
66+
plat__env_admin_password: "{{ common__env_admin_password }}"
6767

6868
plat__vpc_public_subnet_cidrs: "{{ common__vpc_public_subnet_cidrs }}"
6969
plat__vpc_private_subnet_cidrs: "{{ common__vpc_private_subnet_cidrs }}"

‎roles/sudoers/defaults/main.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
3+
# Copyright 2021 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# global file for sudoers
18+
19+
# Role prefix is 'sudoers__'
20+
21+
# Variables used as inputs in main.yml
22+
sudoers__env_admin_password: "{{ common__env_admin_password }}"
23+
24+
sudoers__sudo_group_name: sudoers
25+
sudoers__sudo_group_users: []
26+
# Flag to determine if we want to remove (=True) or retain (=False) existing users in sudoers group
27+
sudoers__purge_users_in_group: False
28+
29+
sudoers__sudorule_name: admin_all_rule

‎roles/sudoers/meta/main.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Copyright 2021 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
galaxy_info:
16+
author: Jim Enright (jenright@cloudera.com)
17+
description: >
18+
Add specified users to FreeIPA sudoers group and create a passwordless sudo rule for the group.
19+
Existing group members can be purged or retained depending on the value of the sudoers__purge_users_in_group flag.
20+
company: Cloudera
21+
license: Apache-2.0
22+
23+
min_ansible_version: 2.10
24+
25+
platforms:
26+
- name: Debian
27+
versions: all
28+
- name: Fedora
29+
versions: all
30+
- name: GenericLinux
31+
versions: all
32+
- name: MacOSX
33+
versions: all
34+
- name: Ubuntu
35+
versions: all
36+
37+
galaxy_tags:
38+
- cloudera
39+
- cdp
40+
- freeipa
41+
42+
dependencies: ['cloudera.exe.common']

‎roles/sudoers/tasks/initialize.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
3+
# Copyright 2021 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# Find the current CDP username.
18+
# This is used in the tasks to create the FreeIPA group and sudo rule.
19+
# Note - the user is required to have PowerUser role in the CDP environment.
20+
- name: Query CDP Caller to save user info
21+
cloudera.cloud.iam_user_info:
22+
current_user: yes
23+
register: __cdp_iam_current_user_info
24+
25+
- name: Set fact for CDP Environment Admin User
26+
ansible.builtin.set_fact:
27+
sudoers__env_admin_username: "{{ __cdp_iam_current_user_info.users[0].workloadUsername }}"
28+
29+
- name: Print Environment Admin Username
30+
ansible.builtin.debug:
31+
msg: "CDP Environment Admin Username is {{ sudoers__env_admin_username }}"
32+
verbosity: 1

‎roles/sudoers/tasks/main.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
3+
# Copyright 2021 Cloudera, Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# Find the current CDP username.
18+
- name: Find and set env_admin_username
19+
include_tasks: initialize.yml
20+
21+
# If don't want to purge existing users from the FreeIPA group,
22+
# we'll query the group to get current users
23+
- name: Query sudoers group for list of users
24+
when: not sudoers__purge_users_in_group
25+
block:
26+
# Note - below creates the group if it doesn't already exist
27+
- name: Create or query the sudoers group
28+
community.general.ipa_group:
29+
ipa_user: "{{ sudoers__env_admin_username }}"
30+
ipa_pass: "{{ sudoers__env_admin_password }}"
31+
name: "{{ sudoers__sudo_group_name }}"
32+
state: present
33+
register: sudoers_group
34+
35+
- name: Set facts for current user members of the group
36+
ansible.builtin.set_fact:
37+
__sudo_existing_group_users: "{{ sudoers_group.group.member_user | default([]) }}"
38+
39+
# Final list of users to add to sudoers group -
40+
# either combined with existing group members or overrides
41+
- name: Create list of users to add to sudoers group
42+
ansible.builtin.set_fact:
43+
__sudo_group_users: "{{ sudoers__sudo_group_users | union(__sudo_existing_group_users) if not sudoers__purge_users_in_group else sudoers__sudo_group_users }}"
44+
45+
# Create a FreeIPA group for sudo and add users
46+
- name: Add users to the sudoers group
47+
community.general.ipa_group:
48+
ipa_user: "{{ sudoers__env_admin_username }}"
49+
ipa_pass: "{{ sudoers__env_admin_password }}"
50+
name: "{{ sudoers__sudo_group_name }}"
51+
user: "{{ __sudo_group_users }}"
52+
state: present
53+
54+
# Create FreeIPA sudo rule
55+
- name: Add sudo rule for passwordless sudo
56+
community.general.ipa_sudorule:
57+
ipa_user: "{{ sudoers__env_admin_username }}"
58+
ipa_pass: "{{ sudoers__env_admin_password }}"
59+
name: "{{ sudoers__sudorule_name }}"
60+
cmdcategory: all
61+
hostcategory: all
62+
sudoopt: "!authenticate"
63+
usergroup:
64+
- "{{ sudoers__sudo_group_name }}"
65+
state: present

0 commit comments

Comments
 (0)