4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
# File 'manifests/component/identity.pp', line 4
class complyadm::component::identity (
Complyadm::Config::Comply_identity $config,
) {
$container = $config['container']
$keycloak_import = '/etc/puppetlabs/comply/puppet-realm.json'
file { $keycloak_import:
ensure => 'file',
content => epp('complyadm/identity/puppet-realm.json.epp', {
'account' => $config['identity_account'],
'account_console' => $config['identity_account_console'],
'admin_cli' => $config['identity_admin_cli'],
'broker' => $config['identity_broker'],
'realm_management' => $config['identity_realm_management'],
'security_admin_console' => $config['identity_security_admin_console'],
'comply' => $config['client_secret'],
'host_fqdn' => $config['hostname'],
'https_port' => 3001,
}),
owner => 'root',
group => 'root',
seltype => 'container_file_t',
notify => Complyadm::Runtime::Run[$container['name']],
}
$identity_env = '/etc/puppetlabs/comply/identity.env'
file { $identity_env:
ensure => file,
owner => 'root',
group => 'root',
seltype => 'container_file_t',
show_diff => false,
content => epp('complyadm/comply_env.epp', { env_vars => $container['env_vars'] }),
notify => Complyadm::Runtime::Run[$container['name']],
}
# copy of file is maintained so that identity restarted if ca crt updated
$ca_cert_identity = '/etc/puppetlabs/comply/pe_certs/.ca.crt.identity'
file { $ca_cert_identity:
ensure => file,
content => $config['ca_crt'],
notify => Complyadm::Runtime::Run[$container['name']],
}
$healthcheck_file = "/etc/puppetlabs/comply/${container['name']}-healthcheck.sh"
file { $healthcheck_file:
ensure => file,
owner => 'root',
group => 'root',
mode => '+x',
seltype => 'container_file_t',
show_diff => false,
content => epp('complyadm/runtime/service-watchdog.epp', { healthcheck => "${container['runtime']} exec ${container['name']} ${container['healthcheck']}" }),
notify => Complyadm::Runtime::Run[$container['name']],
}
complyadm::runtime::run { $container['name']:
runtime => $container['runtime'],
install_runtime => $container['install_runtime'],
image => $container['image'],
net => $container['net'],
ports => $container['ports'],
extra_parameters => $container['extra_parameters'],
after_create => $healthcheck_file,
extra_systemd_parameters => $container['extra_systemd_parameters'],
env_file => [$identity_env],
volumes => [
"${keycloak_import}:/opt/keycloak/data/import/puppet-realm.json",
'/etc/puppetlabs/comply/pe_certs:/certs',
],
require => [
File[$keycloak_import],
File[$identity_env],
],
pull_on_start => false,
after => $container['after'],
}
}
|