[trust_ca_minions] Revert cacert generation fix
In case of trust_salt_ca usage, the salt.minion.cert state
generates broken certs body due to a space replacing.
Change-Id: Id49e42807ddbc2addaf59a4c4541b720bbf87527
diff --git a/salt/minion/cert.sls b/salt/minion/cert.sls
index 0999127..416c036 100644
--- a/salt/minion/cert.sls
+++ b/salt/minion/cert.sls
@@ -18,9 +18,9 @@
{%- set key_file = cert.get('key_file', '/etc/ssl/private/' + cert.common_name + '.key') %}
{%- set cert_file = cert.get('cert_file', '/etc/ssl/certs/' + cert.common_name + '.crt') %}
{%- set ca_file = cert.get('ca_file', '/etc/ssl/certs/ca-' + cert.authority + '.crt') %}
-{%- set key_dir = key_file|replace(key_file.split('/')[-1], "") %}
-{%- set cert_dir = cert_file|replace(cert_file.split('/')[-1], "") %}
-{%- set ca_dir = ca_file|replace(ca_file.split('/')[-1], "") %}
+{%- set key_dir = salt['file.dirname'](key_file) %}
+{%- set cert_dir = salt['file.dirname'](cert_file) %}
+{%- set ca_dir = salt['file.dirname'](ca_file) %}
{# Only ensure directories exists, don't touch permissions, etc. #}
salt_minion_cert_{{ cert_name }}_dirs:
@@ -181,27 +181,32 @@
- require:
- pkg: salt_ca_certificates_packages
-{%- if minion.get('cert', {}).get('trust_salt_ca', 'True') %}
+{%- if minion.get('trust_salt_ca', True) %}
{%- for trusted_ca_minion in minion.get('trusted_ca_minions', []) %}
{%- for ca_host, certs in salt['mine.get'](trusted_ca_minion+'*', 'x509.get_pem_entries').iteritems() %}
-
{%- for ca_path, ca_cert in certs.iteritems() %}
-{%- if not 'ca.crt' in ca_path %}{% continue %}{% endif %}
+{%- if ca_path.startswith('/etc/pki/ca/') and ca_path.endswith('ca.crt') %}
-{%- set cacert_file="ca-"+ca_path.split("/")[4]+".crt" %}
+{# authority name can be obtained only from a cacert path in case of mine.get #}
+{%- set ca_authority = ca_path.split("/")[4] %}
+{%- set cacert_file="%s/ca-%s.crt" % (cacerts_dir,ca_authority) %}
-salt_cert_{{ cacerts_dir }}/{{ cacert_file }}:
+salt_trust_ca_{{ cacert_file }}:
+ x509.pem_managed:
+ - name: {{ cacert_file }}
+ - text: {{ ca_cert|replace('\n', '') }}
+ - makedirs: True
+ - watch_in:
+ - file: salt_trust_ca_{{ cacert_file }}_permissions
+ - cmd: salt_update_certificates
+
+salt_trust_ca_{{ cacert_file }}_permissions:
file.managed:
- - name: {{ cacerts_dir }}/{{ cacert_file }}
- - contents: |
- {{ ca_cert|replace(' ', '')|indent(6) }}
- - makedirs: True
- - show_changes: True
- - follow_symlinks: True
- - watch_in:
- - cmd: salt_update_certificates
+ - name: {{ cacert_file }}
+ - mode: 0444
+{%- endif %}
{%- endfor %}
{%- endfor %}
{%- endfor %}