From 1a69ead36d24c9f6fe1a815aeb6183b9f7f03ecf Mon Sep 17 00:00:00 2001 From: nazunalika Date: Sat, 12 Feb 2022 22:39:32 -0700 Subject: [PATCH] quick fixes --- adhoc-ipadnsrecord.yml | 2 - adhoc-ipadnszone.yml | 2 - adhoc-ipagetkeytab.yml | 2 - adhoc-ipaservice.yml | 2 - adhoc-ipauser-disable-pdr.yml | 2 - adhoc-ipauser-disable.yml | 2 - adhoc-ipauser-enable.yml | 2 - adhoc-ipauser.yml | 2 - init-rocky-ipa-internal-dns.yml | 1 - init-rocky-ipa-team.yml | 1 - role-rocky-ipa-client.yml | 1 - role-rocky-ipa-replica.yml | 2 - role-rocky-ipa.yml | 2 - vars/ipa/adminusers.yml | 63 +++++++++++++++++++++ vars/ipa/agreements.yml | 3 + vars/ipa/fdns.yml | 5 ++ vars/ipa/groups.yml | 99 +++++++++++++++++++++++++++++++++ vars/ipa/ipaclient.yml | 11 ++++ vars/ipa/ipaprivs.yml | 43 ++++++++++++++ vars/ipa/ipareplica.yml | 14 +++++ vars/ipa/ipaserver.yml | 16 ++++++ vars/ipa/rdns.yml | 4 ++ vars/ipa/sudorules.yml | 2 + vars/ipa/svcusers.yml | 45 +++++++++++++++ vars/ipa/users.yml | 73 ++++++++++++++++++++++++ vars/ipaserver.yml | 3 + 26 files changed, 381 insertions(+), 23 deletions(-) create mode 100644 vars/ipa/adminusers.yml create mode 100644 vars/ipa/agreements.yml create mode 100644 vars/ipa/fdns.yml create mode 100644 vars/ipa/groups.yml create mode 100644 vars/ipa/ipaclient.yml create mode 100644 vars/ipa/ipaprivs.yml create mode 100644 vars/ipa/ipareplica.yml create mode 100644 vars/ipa/ipaserver.yml create mode 100644 vars/ipa/rdns.yml create mode 100644 vars/ipa/sudorules.yml create mode 100644 vars/ipa/svcusers.yml create mode 100644 vars/ipa/users.yml create mode 100644 vars/ipaserver.yml diff --git a/adhoc-ipadnsrecord.yml b/adhoc-ipadnsrecord.yml index 85cbcde..3edf935 100644 --- a/adhoc-ipadnsrecord.yml +++ b/adhoc-ipadnsrecord.yml @@ -15,8 +15,6 @@ hosts: all become: false gather_facts: false - vars_files: - - vars/vaults/hostman.yml tasks: - name: "Checking for user variables" diff --git a/adhoc-ipadnszone.yml b/adhoc-ipadnszone.yml index b66d655..23c75ff 100644 --- a/adhoc-ipadnszone.yml +++ b/adhoc-ipadnszone.yml @@ -7,8 +7,6 @@ hosts: all become: false gather_facts: false - vars_files: - - vars/vaults/hostman.yml tasks: - name: "Checking for user variables" diff --git a/adhoc-ipagetkeytab.yml b/adhoc-ipagetkeytab.yml index 850b37d..ef24c63 100644 --- a/adhoc-ipagetkeytab.yml +++ b/adhoc-ipagetkeytab.yml @@ -17,8 +17,6 @@ hosts: all become: true gather_facts: false - vars_files: - - vars/vaults/kerbman.yml tasks: - name: "Checking for user variables" diff --git a/adhoc-ipaservice.yml b/adhoc-ipaservice.yml index 7f9fbff..05bcb07 100644 --- a/adhoc-ipaservice.yml +++ b/adhoc-ipaservice.yml @@ -6,8 +6,6 @@ hosts: all become: false gather_facts: false - vars_files: - - vars/vaults/kerbman.yml tasks: - name: "Checking for user variables" diff --git a/adhoc-ipauser-disable-pdr.yml b/adhoc-ipauser-disable-pdr.yml index 991f6d9..4623e86 100644 --- a/adhoc-ipauser-disable-pdr.yml +++ b/adhoc-ipauser-disable-pdr.yml @@ -10,8 +10,6 @@ hosts: all become: false gather_facts: false - vars_files: - - vars/vaults/userman.yml tasks: - name: "Checking for user variables" diff --git a/adhoc-ipauser-disable.yml b/adhoc-ipauser-disable.yml index 179b708..7aac935 100644 --- a/adhoc-ipauser-disable.yml +++ b/adhoc-ipauser-disable.yml @@ -6,8 +6,6 @@ hosts: all become: false gather_facts: false - vars_files: - - vars/vaults/userman.yml tasks: - name: "Checking for user variables" diff --git a/adhoc-ipauser-enable.yml b/adhoc-ipauser-enable.yml index 197133e..21c8fd7 100644 --- a/adhoc-ipauser-enable.yml +++ b/adhoc-ipauser-enable.yml @@ -6,8 +6,6 @@ hosts: all become: false gather_facts: false - vars_files: - - vars/vaults/userman.yml tasks: - name: "Checking for user variables" diff --git a/adhoc-ipauser.yml b/adhoc-ipauser.yml index e64cb16..e1cb0aa 100644 --- a/adhoc-ipauser.yml +++ b/adhoc-ipauser.yml @@ -6,8 +6,6 @@ hosts: all become: false gather_facts: false - vars_files: - - vars/vaults/userman.yml tasks: - name: "Checking for user variables" diff --git a/init-rocky-ipa-internal-dns.yml b/init-rocky-ipa-internal-dns.yml index c555a6c..fc87eef 100644 --- a/init-rocky-ipa-internal-dns.yml +++ b/init-rocky-ipa-internal-dns.yml @@ -5,7 +5,6 @@ become: false gather_facts: false vars_files: - - vars/vaults/encpass.yml - vars/ipa/rdns.yml - vars/ipa/fdns.yml diff --git a/init-rocky-ipa-team.yml b/init-rocky-ipa-team.yml index 5c30230..48f5155 100644 --- a/init-rocky-ipa-team.yml +++ b/init-rocky-ipa-team.yml @@ -5,7 +5,6 @@ become: true gather_facts: false vars_files: - - vars/vaults/encpass.yml - vars/ipa/users.yml - vars/ipa/adminusers.yml - vars/ipa/svcusers.yml diff --git a/role-rocky-ipa-client.yml b/role-rocky-ipa-client.yml index e12793c..bb43e38 100644 --- a/role-rocky-ipa-client.yml +++ b/role-rocky-ipa-client.yml @@ -5,7 +5,6 @@ hosts: all become: true vars_files: - - vars/vaults/encpass.yml - vars/ipa/ipaclient.yml pre_tasks: diff --git a/role-rocky-ipa-replica.yml b/role-rocky-ipa-replica.yml index ec5e827..ea5b033 100644 --- a/role-rocky-ipa-replica.yml +++ b/role-rocky-ipa-replica.yml @@ -4,8 +4,6 @@ - name: Configure IPA server hosts: all become: true - vars_files: - - vars/vaults/encpass.yml # This is to try to avoid the handler issue in pre/post tasks handlers: diff --git a/role-rocky-ipa.yml b/role-rocky-ipa.yml index ffdc2dc..e2055f8 100644 --- a/role-rocky-ipa.yml +++ b/role-rocky-ipa.yml @@ -9,8 +9,6 @@ - name: Configure IPA server hosts: all become: true - vars_files: - - vars/vaults/encpass.yml # This is to try to avoid the handler issue in pre/post tasks handlers: diff --git a/vars/ipa/adminusers.yml b/vars/ipa/adminusers.yml new file mode 100644 index 0000000..4fd54d7 --- /dev/null +++ b/vars/ipa/adminusers.yml @@ -0,0 +1,63 @@ +--- +adminusers: + - name: label2 + first: Louis + last: Abel + password: ThisIsNotMyPassword1! + title: Infrastructure IdM Manager + loginshell: /bin/bash + - name: gmk2 + first: Gregory + last: Kurtzer + password: ThisIsNotMyPassword1! + title: Executive Director + loginshell: /bin/bash + - name: brian2 + first: Brian + last: Clemens + password: ThisIsNotMyPassword1! + title: Project Manager + loginshell: /bin/bash + - name: hbjy2 + first: Hayden + last: Young + password: ThisIsNotMyPassword1! + title: Web & Branding Manager + loginshell: /bin/bash + - name: jorp2 + first: Jordan + last: Pisaniello + password: ThisIsNotMyPassword1! + title: Community Manager + loginshell: /bin/bash + - name: neil2 + first: Neil + last: Hanlon + password: ThisIsNotMyPassword1! + title: Infrastructure Manager + loginshell: /bin/bash + - name: rlh2 + first: R. Leigh + last: Hennig + password: ThisIsNotMyPassword1! + title: Operations Manager + loginshell: /bin/bash + - name: rfelsburg2 + first: Rob + last: Felsburg + password: ThisIsNotMyPassword1! + title: Operations Manager + loginshell: /bin/bash + - name: tg2 + first: Taylor + last: Goodwill + password: ThisIsNotMyPassword1! + title: Infrastructure Manager + loginshell: /bin/bash + - name: bagner2 + first: Benjamin + last: Agner + password: ThisIsNotMyPassword1! + title: Security Director + loginshell: /bin/bash +... diff --git a/vars/ipa/agreements.yml b/vars/ipa/agreements.yml new file mode 100644 index 0000000..2640c2c --- /dev/null +++ b/vars/ipa/agreements.yml @@ -0,0 +1,3 @@ +--- +# Vars for Agreements for the Rocky Linux Project +... diff --git a/vars/ipa/fdns.yml b/vars/ipa/fdns.yml new file mode 100644 index 0000000..06bc340 --- /dev/null +++ b/vars/ipa/fdns.yml @@ -0,0 +1,5 @@ +--- +fdns: + - rockylinux.org. + - aws.rockylinux.org. +... diff --git a/vars/ipa/groups.yml b/vars/ipa/groups.yml new file mode 100644 index 0000000..e3723a9 --- /dev/null +++ b/vars/ipa/groups.yml @@ -0,0 +1,99 @@ +--- +ipagroups: + - group: infrastructure + description: Infrastructure Team + user: + - label + - neil + - rlh + - rfelsburg + - tg + - bagner + - group: operations + description: Operations Team + user: + - rlh + - rfelsburg + - group: development + description: Development Team + - group: qa + description: Quality Assurance Team + - group: marketing + description: Marketing + - group: rocky + description: Rocky Linux Team + user: + - label + - gmk + - brian + - hbjy + - jorp + - neil + - rlh + - rfelsburg + - tg + - bagner + - group: rockyadm + description: Rocky Linux Administrators - Only Admin Accounts + user: + - label2 + - gmk2 + - brian2 + - hbjy2 + - jorp2 + - neil2 + - rlh2 + - rfelsburg2 + - tg2 + - bagner2 + - group: gitadm + description: Rocky Linux GitLab Admins + user: + - label + - neil + - rlh + - rfelsburg + - tg + - hbjy + - group: gitusers + description: Rocky Linux GitLab Users + user: + - label + - neil + - rlh + - rfelsburg + - tg + - hbjy + - rockyautomation + managers_users: + - label + - neil + - rlh + - rfelsburg + - tg + - hbjy + - group: services + description: Rocky Linux Service Accounts + user: + - userman + - hostman + - kerbman + - rockykoji + - pubsub_federation + - rockypubsub + - rockyautomation + - group: iam + description: Rocky Linux Identity Management + user: + - label + managers_users: + - label + - group: releng + description: Rocky Linux Release Engineering + user: + - label + managers_users: + - label + - group: mq_pub_readonly + description: RabbitMQ ReadOnly +... diff --git a/vars/ipa/ipaclient.yml b/vars/ipa/ipaclient.yml new file mode 100644 index 0000000..682098c --- /dev/null +++ b/vars/ipa/ipaclient.yml @@ -0,0 +1,11 @@ +--- +# IPA Client Vars +ipaclient_domain: rockylinux.org +ipaclient_realm: ROCKYLINUX.ORG +ipaadmin_principal: admin +ipaclient_no_ntp: true +ipaclient_mkhomedir: true +ipaclient_ssh_trust_dns: true +ipasssd_enable_dns_updates: true +ipatype: client +... diff --git a/vars/ipa/ipaprivs.yml b/vars/ipa/ipaprivs.yml new file mode 100644 index 0000000..c8bed98 --- /dev/null +++ b/vars/ipa/ipaprivs.yml @@ -0,0 +1,43 @@ +--- +# privileges +ipaprivileges: + - privilege: Privileges - Kerberos Managers + description: Kerberos Key Managers + permissions: + - "System: Manage Host Keytab" + - "System: Manage Host Keytab Permissions" + - "System: Manage Service Keytab" + - "System: Manage Service Keytab Permissions" + - "System: Manage User Principals" + role: Kerberos Managers + user: + - kerbman + +# Standalone Roles +iparoles: + - role: IPA Client Managers + description: IPA Client Managers + privileges: + - "DNS Administrators" + - "DNS Servers" + - "Host Administrators" + - "Host Enrollment" + - "Host Group Administrators" + - "Netgroups Administrators" + user: + - hostman + - role: Kerberos Managers + description: Kerberos Key Managers + privileges: + - "Privileges - Kerberos Managers" + - "Service Administrators" + user: + - kerbman + - role: IPA User Managers + description: Rocky IPA User Managers responsible for idm flow + privileges: + - "Group Administrators" + - "Stage User Administrators" + - "User Administrators" + - "FAS Agreement Administrators" +... diff --git a/vars/ipa/ipareplica.yml b/vars/ipa/ipareplica.yml new file mode 100644 index 0000000..38dd5f4 --- /dev/null +++ b/vars/ipa/ipareplica.yml @@ -0,0 +1,14 @@ +--- +# IPA Replica +ipaadmin_principal: admin +ipaclient_no_ntp: true +ipaclient_mkhomedir: true +ipaserver_realm: ROCKYLINUX.ORG +ipareplica_domain: rockylinux.org +ipareplica_auto_forwarders: true +ipareplica_setup_firewalld: true +ipareplica_setup_ca: true +ipareplica_setup_kra: true +ipareplica_setup_dns: true +ipatype: replica +... diff --git a/vars/ipa/ipaserver.yml b/vars/ipa/ipaserver.yml new file mode 100644 index 0000000..efaefbb --- /dev/null +++ b/vars/ipa/ipaserver.yml @@ -0,0 +1,16 @@ +--- +# IPA Server +ipaserver_domain: rockylinux.org +ipaserver_realm: ROCKYLINUX.ORG +ipaserver_setup_dns: true +ipaserver_setup_kra: true +ipaserver_auto_forwarders: true +ipaserver_no_host_dns: true +ipaserver_allow_zone_overlap: true +ipaserver_setup_firewalld: true +ipaclient_no_ntp: true +ipaclient_mkhomedir: true +ipaserver_no_hbac_allow: true +ipaserver_reverse_zones: ["32.10.in-addr.arpa."] +ipatype: server +... diff --git a/vars/ipa/rdns.yml b/vars/ipa/rdns.yml new file mode 100644 index 0000000..2e52d7b --- /dev/null +++ b/vars/ipa/rdns.yml @@ -0,0 +1,4 @@ +--- +rdns: + - 32.10.in-addr.arpa. +... diff --git a/vars/ipa/sudorules.yml b/vars/ipa/sudorules.yml new file mode 100644 index 0000000..91da2a7 --- /dev/null +++ b/vars/ipa/sudorules.yml @@ -0,0 +1,2 @@ +--- +... diff --git a/vars/ipa/svcusers.yml b/vars/ipa/svcusers.yml new file mode 100644 index 0000000..d5bf8e1 --- /dev/null +++ b/vars/ipa/svcusers.yml @@ -0,0 +1,45 @@ +--- +svcusers: + - name: hostman + first: Host + last: Manager + password: ThisIsNotMyPassword1! + title: System Account - Host Manager + loginshell: /sbin/nologin + - name: kerbman + first: Kerberos + last: Manager + password: ThisIsNotMyPassword1! + title: System Account - Kerberos Key Manager + loginshell: /sbin/nologin + - name: userman + first: User + last: Manager + password: ThisIsNotMyPassword1! + title: System Account - User Manager + loginshell: /sbin/nologin + - name: rockykoji + first: Koji + last: Manager + password: ThisIsNotMyPassword1! + title: System Account - Koji Manager + loginshell: /sbin/nologin + - name: pubsub_federation + first: pubsub + last: federation + password: ThisIsNotMyPassword1! + title: System Account - pubsub federator + loginshell: /sbin/nologin + - name: rockypubsub + first: rocky + last: pubsub + password: ThisIsNotMyPassword1! + title: System Account - pubsub + loginshell: /sbin/nologin + - name: rockyautomation + first: Rocky + last: Automation + password: ThisIsNotMyPassword1! + title: System Account - Automation + loginshell: /sbin/nologin +... diff --git a/vars/ipa/users.yml b/vars/ipa/users.yml new file mode 100644 index 0000000..a291293 --- /dev/null +++ b/vars/ipa/users.yml @@ -0,0 +1,73 @@ +--- +users: + - name: label + first: Louis + last: Abel + email: label@rockylinux.org + password: ThisIsNotMyPassword1! + title: Infrastructure IdM Manager + loginshell: /bin/bash + - name: gmk + first: Gregory + last: Kurtzer + email: gmk@rockylinux.org + password: ThisIsNotMyPassword1! + title: Executive Director + loginshell: /bin/bash + - name: brian + first: Brian + last: Clemens + email: brian@rockylinux.org + password: ThisIsNotMyPassword1! + title: Project Manager + loginshell: /bin/bash + - name: hbjy + first: Hayden + last: Young + email: hbjy@rockylinux.org + password: ThisIsNotMyPassword1! + title: Web & Branding Manager + loginshell: /bin/bash + - name: jorp + first: Jordan + last: Pisaniello + email: jorp@rockylinux.org + password: ThisIsNotMyPassword1! + title: Community Manager + loginshell: /bin/bash + - name: neil + first: Neil + last: Hanlon + email: neil@rockylinux.org + password: ThisIsNotMyPassword1! + title: Infrastructure Manager + loginshell: /bin/bash + - name: rlh + first: R. Leigh + last: Hennig + email: rlh@rockylinux.org + password: ThisIsNotMyPassword1! + title: Operations Manager + loginshell: /bin/bash + - name: rfelsburg + first: Rob + last: Felsburg + email: rfelsburg@rockylinux.org + password: ThisIsNotMyPassword1! + title: Operations Manager + loginshell: /bin/bash + - name: tg + first: Taylor + last: Goodwill + email: tg@rockylinux.org + password: ThisIsNotMyPassword1! + title: Infrastructure Manager + loginshell: /bin/bash + - name: bagner + first: Benjamin + last: Agner + email: bagner@rockylinux.org + password: ThisIsNotMyPassword1! + title: Security Director + loginshell: /bin/bash +... diff --git a/vars/ipaserver.yml b/vars/ipaserver.yml new file mode 100644 index 0000000..b4216b4 --- /dev/null +++ b/vars/ipaserver.yml @@ -0,0 +1,3 @@ +--- +ipatype: server +...