diff options
| -rw-r--r-- | chaos-at-home/ch-mon.yml | 3 | ||||
| -rw-r--r-- | inventory/group_vars/promzone-chaos-at-home/vars.yml | 3 | ||||
| -rw-r--r-- | inventory/hosts.ini | 10 | ||||
| -rw-r--r-- | roles/monitoring/prometheus/ca/tasks/main.yml | 52 | ||||
| -rw-r--r-- | roles/monitoring/prometheus/server/tasks/tls.yml | 55 |
5 files changed, 76 insertions, 47 deletions
diff --git a/chaos-at-home/ch-mon.yml b/chaos-at-home/ch-mon.yml index a1179204..bce4adab 100644 --- a/chaos-at-home/ch-mon.yml +++ b/chaos-at-home/ch-mon.yml @@ -9,7 +9,8 @@ - role: core/ntp - role: storage/lvm/groups - role: apt-repo/spreadspace - - role: monitoring/prometheus/server + - role: monitoring/prometheus/ca - role: monitoring/prometheus/exporter/base - role: monitoring/prometheus/exporter/node - role: monitoring/prometheus/exporter/blackbox + - role: monitoring/prometheus/server diff --git a/inventory/group_vars/promzone-chaos-at-home/vars.yml b/inventory/group_vars/promzone-chaos-at-home/vars.yml new file mode 100644 index 00000000..413a6502 --- /dev/null +++ b/inventory/group_vars/promzone-chaos-at-home/vars.yml @@ -0,0 +1,3 @@ +--- +promethues_server: ch-mon +promethues_zone_name: chaos@home diff --git a/inventory/hosts.ini b/inventory/hosts.ini index 954e9374..1c1051aa 100644 --- a/inventory/hosts.ini +++ b/inventory/hosts.ini @@ -379,6 +379,16 @@ vmhost-sk-2019vm-guests vmhost-sk-tomnext-guests +## prometheus monitoring +[promzone-chaos-at-home-server] +ch-mon +[promzone-chaos-at-home] +ch-mon +ch-testvm-prometheus +[promzone-chaos-at-home:children] +promzone-chaos-at-home-server + + ## hoster [hroot] sk-2019 diff --git a/roles/monitoring/prometheus/ca/tasks/main.yml b/roles/monitoring/prometheus/ca/tasks/main.yml new file mode 100644 index 00000000..9f166321 --- /dev/null +++ b/roles/monitoring/prometheus/ca/tasks/main.yml @@ -0,0 +1,52 @@ +--- +- name: install python-cryptoraphy + apt: + name: "{{ python_basename }}-cryptography" + state: present + +- name: create base directory + file: + path: /etc/ssl/prometheus + state: directory + +- name: create CA directory + file: + path: /etc/ssl/prometheus/ca + state: directory + owner: root + group: root + mode: 0700 + +- name: create CA private key + openssl_privatekey: + path: /etc/ssl/prometheus/ca/key.pem + type: RSA + size: 4096 + owner: root + group: root + mode: 0600 + +- name: create signing request for CA certificate + openssl_csr: + path: /etc/ssl/prometheus/ca/csr.pem + privatekey_path: /etc/ssl/prometheus/ca/key.pem + CN: "CA for promethues zone {{ promethues_zone_name }}" + useCommonNameForSAN: no + key_usage: + - cRLSign + - digitalSignature + - keyCertSign + key_usage_critical: yes + basic_constraints: + - 'CA:TRUE' + - 'pathlen:0' + basic_constraints_critical: yes + +- name: create self-signed CA certificate + openssl_certificate: + path: /etc/ssl/prometheus/ca-crt.pem + csr_path: /etc/ssl/prometheus/ca/csr.pem + privatekey_path: /etc/ssl/prometheus/ca/key.pem + provider: selfsigned + selfsigned_digest: sha256 + selfsigned_not_after: "+18250d" ## 50 years diff --git a/roles/monitoring/prometheus/server/tasks/tls.yml b/roles/monitoring/prometheus/server/tasks/tls.yml index f9ad5ca3..5c112e12 100644 --- a/roles/monitoring/prometheus/server/tasks/tls.yml +++ b/roles/monitoring/prometheus/server/tasks/tls.yml @@ -9,14 +9,6 @@ path: /etc/ssl/prometheus state: directory -- name: create CA directory - file: - path: /etc/ssl/prometheus/ca - state: directory - owner: root - group: root - mode: 0700 - - name: create server cert/key directory file: path: /etc/ssl/prometheus/server @@ -25,42 +17,7 @@ group: prometheus mode: 0750 -- name: create CA private key - openssl_privatekey: - path: /etc/ssl/prometheus/ca/key.pem - type: RSA - size: 4096 - owner: root - group: root - mode: 0600 - -- name: create signing request for CA certificate - openssl_csr: - path: /etc/ssl/prometheus/ca/csr.pem - privatekey_path: /etc/ssl/prometheus/ca/key.pem - CN: "prometheus CA" - useCommonNameForSAN: no - key_usage: - - cRLSign - - digitalSignature - - keyCertSign - key_usage_critical: yes - basic_constraints: - - 'CA:TRUE' - - 'pathlen:0' - basic_constraints_critical: yes - -- name: create self-signed CA certificate - openssl_certificate: - path: /etc/ssl/prometheus/ca-crt.pem - csr_path: /etc/ssl/prometheus/ca/csr.pem - privatekey_path: /etc/ssl/prometheus/ca/key.pem - provider: selfsigned - selfsigned_digest: sha256 - selfsigned_not_after: "+18250d" ## 50 years - - -- name: create server private key to connect to exporter +- name: create private key to connect to exporter openssl_privatekey: path: /etc/ssl/prometheus/server/exporter-key.pem type: RSA @@ -68,8 +25,9 @@ owner: prometheus group: prometheus mode: 0400 + notify: reload prometheus -- name: create signing request for server certificate to connect to exporter +- name: create signing request for client certificate to connect to exporter openssl_csr: path: /etc/ssl/prometheus/server/exporter-csr.pem privatekey_path: /etc/ssl/prometheus/server/exporter-key.pem @@ -87,7 +45,9 @@ - 'CA:FALSE' basic_constraints_critical: yes -- name: create server certificate to connect to exporter +## TODO: implement remote signing? + +- name: create client certificate to connect to exporter openssl_certificate: path: /etc/ssl/prometheus/server/exporter-crt.pem csr_path: /etc/ssl/prometheus/server/exporter-csr.pem @@ -96,3 +56,6 @@ ownca_privatekey_path: /etc/ssl/prometheus/ca/key.pem ownca_digest: sha256 ownca_not_after: "+18250d" ## 50 years + notify: reload prometheus + +## TODO: install /etc/ssl/prometheus/ca-crt.pem from server |