20. Пример организации получения TLS-сертификата для Virtual IP (VIP) на vmauth-узлах с автообновлением

# host c-mon-vmauth-vip.example.org
is1-mon-vmauth-vip.example.org has address 10.0.77.120

# dig TXT is1-mon-vmauth-vip.example.org +short
"250130. dmr. VIP for is1-mon-vmauth."

REQUEST_SHORT_NAME='vip'
TLS_DIR="/etc/pki/tls"

TLS_KEY_FILE="${TLS_DIR}/private/${REQUEST_SHORT_NAME}.key"
TLS_CERT_FILE="${TLS_DIR}/certs/${REQUEST_SHORT_NAME}.crt"

SCRIPT_DIR="/usr/local/lib/certmonger"
SCRIPT_BEFORE="${REQUEST_SHORT_NAME}-before-savecert"
SCRIPT_AFTER="${REQUEST_SHORT_NAME}-after-savecert"
FULL_SCRIPT_BEFORE=${SCRIPT_DIR}/${SCRIPT_BEFORE}
FULL_SCRIPT_AFTER=${SCRIPT_DIR}/${SCRIPT_AFTER}

mkdir -p ${SCRIPT_DIR}

cat << EOF > ${FULL_SCRIPT_BEFORE}
#!/bin/bash
set +e
set -ux
echo "The script ${SCRIPT_BEFORE} is launching..."
KEY="${TLS_KEY_FILE}"
CERT="${TLS_CERT_FILE}"

# Your commands is here!
cp \${KEY} "\${KEY}-\$(date +%y%m%d-%H%M%S).bak"
cp \${CERT} "\${CERT}-\$(date +%y%m%d-%H%M%S).bak"

# End of script
echo "The script ${SCRIPT_BEFORE} has finished."
EOF

cat << EOF > ${FULL_SCRIPT_AFTER}
#!/bin/bash
# На сгенерированный ключ имеет права только root,
# поэтому с помощью setfacl необходимо добавить право чтения
# учётной записи, под которой работает сервис.

set +e
set -ux
echo "The script ${SCRIPT_AFTER} is launching..."
KEY="${TLS_KEY_FILE}"
CERT="${TLS_CERT_FILE}"

# Example for airflow
#echo "airflow..."
#/usr/bin/setfacl -m "u:airflow:r" \$KEY
#/usr/bin/systemctl restart airflow-webserver

# Example for nginx
#echo "nginx..."
#/usr/bin/setfacl -m "u:nginx:r" \$KEY
#systemctl reload nginx

# Your commands is here!
/usr/bin/setfacl -m "u:vmauth:r" \$KEY
systemctl restart vmauth

# End of script
echo "The script ${SCRIPT_AFTER} has finished."
EOF

FILES_PATH="${SCRIPT_DIR}/${REQUEST_SHORT_NAME}-*"
chmod 700 ${FILES_PATH}
chown root:root ${FILES_PATH}

VIP_HOSTNAME='is1-mon-vmauth-vip.example.org'

ipa-getcert request \
 -I ${REQUEST_SHORT_NAME} \
 --subject-name CN=${VIP_HOSTNAME} \
 --principal host/${VIP_HOSTNAME} \
 --keyfile "${TLS_KEY_FILE}" \
 --certfile "${TLS_CERT_FILE}" \
 --before-command="/bin/bash -c \"${FULL_SCRIPT_BEFORE} 2>&1 | /usr/bin/logger -t CERTMONGER\"" \
 --after-command="/bin/bash -c \"${FULL_SCRIPT_AFTER} 2>&1 | /usr/bin/logger -t CERTMONGER\"" \
 --key-owner root --key-perms 0600 \
 --cert-owner root --cert-perms 0644 \
 -w

Number of certificates and requests being tracked: 1.
Request ID 'vip':
        status: MONITORING
        stuck: no
        key pair storage: type=FILE,location='/etc/pki/tls/private/vip.key',owner=root,perms=0600
        certificate: type=FILE,location='/etc/pki/tls/certs/vip.crt',owner=root,perms=0644
        CA: IPA
        issuer: CN=Certificate Authority,O=EXAMPLE.ORG
        subject: CN=is1-mon-vmauth-vip.example.org,O=EXAMPLE.ORG
        issued: 2025-03-04 17:22:17 MSK
        expires: 2027-03-05 17:22:17 MSK
        dns: is1-mon-vmauth-vip.example.org
        principal name: host/is1-mon-vmauth-vip.example.org@EXAMPLE.ORG
        key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
        eku: id-kp-serverAuth,id-kp-clientAuth
        pre-save command: /bin/bash -c "/usr/local/lib/certmonger/vip-before-savecert 2>&1 | /usr/bin/logger -t CERTMONGER"
        post-save command: /bin/bash -c "/usr/local/lib/certmonger/vip-after-savecert 2>&1 | /usr/bin/logger -t CERTMONGER"
        track: yes
        auto-renew: yes

dev-vmauth → is1-mon-vmauth-vip
prod-vmauth → is1-mon-vmauth-vip
test-vmauth → is1-mon-vmauth-vip

# host dev-vmauth.example.org
dev-vmauth.example.org is an alias for is1-mon-vmauth-vip.example.org.
is1-mon-vmauth-vip.example.org has address 10.1.77.12

# dig TXT dev-vmauth.example.org +short
is1-mon-vmauth-vip.example.org.
"250130. nifantevea. VIP for is1-mon-vmauth*."

ipa-getcert resubmit -i vip \
-D dev-vmauth.example.org \
-D prod-vmauth.example.org \
-D test-vmauth.example.org

ipa-getcert list -i vip

Number of certificates and requests being tracked: 1.
Request ID 'vip':
        status: MONITORING
        stuck: no
        key pair storage: type=FILE,location='/etc/pki/tls/private/vip.key',owner=root,perms=0600
        certificate: type=FILE,location='/etc/pki/tls/certs/vip.crt',owner=root,perms=0644
        CA: IPA
        issuer: CN=Certificate Authority,O=EXAMPLE.ORG
        subject: CN=is1-mon-vmauth-vip.example.org,O=EXAMPLE.ORG
        issued: 2025-03-04 17:31:28 MSK
        expires: 2027-03-05 17:31:28 MSK
        dns: dev-vmauth.example.org,prod-vmauth.example.org,test-vmauth.example.org,is1-mon-vmauth-vip.example.org
        principal name: host/is1-mon-vmauth-vip.example.org@EXAMPLE.ORG
        key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
        eku: id-kp-serverAuth,id-kp-clientAuth
        pre-save command: /bin/bash -c "/usr/local/lib/certmonger/vip-before-savecert 2>&1 | /usr/bin/logger -t CERTMONGER"
        post-save command: /bin/bash -c "/usr/local/lib/certmonger/vip-after-savecert 2>&1 | /usr/bin/logger -t CERTMONGER"
        track: yes
        auto-renew: yes

ipa-getcert list -i vip | grep dns | sed -E 's/^\s*dns: //; s/,isbi-mon-vmauth-vip\.example\.org//' | tr ',' '\n' | sort | nl

1  dev-vmauth.example.org
2  prod-vmauth.example.org
3  test-vmauth.example.org