Reusable certificates
- store cert under /srv/salt/pki
- isolate certs per cluster name
- reclass overrides (openstack, wildcard)
diff --git a/salt/minion/cert/swift/init.yml b/salt/minion/cert/swift/init.yml
new file mode 100644
index 0000000..28859cf
--- /dev/null
+++ b/salt/minion/cert/swift/init.yml
@@ -0,0 +1,11 @@
+parameters:
+ _param:
+ salt_minion_ca_authority: salt_master_ca
+ salt:
+ minion:
+ cert:
+ swift:
+ host: ${_param:salt_minion_ca_host}
+ signing_policy: cert_server
+ authority: ${_param:salt_minion_ca_authority}
+ common_name: ${_param:cluster_public_host}
diff --git a/salt/minion/cert/swift/openstack.yml b/salt/minion/cert/swift/openstack.yml
new file mode 100644
index 0000000..5560e1b
--- /dev/null
+++ b/salt/minion/cert/swift/openstack.yml
@@ -0,0 +1,11 @@
+classes:
+- system.salt.minion.cert.swift
+parameters:
+ _param:
+ salt_pki_swift_alt_names: IP:${_param:cluster_public_host},DNS:${_param:cluster_public_host}
+ salt:
+ minion:
+ cert:
+ swift:
+ common_name: swift
+ alternative_names: IP:127.0.0.1,${_param:salt_pki_swift_alt_names}
diff --git a/salt/minion/cert/swift/pki.yml b/salt/minion/cert/swift/pki.yml
new file mode 100644
index 0000000..dd24060
--- /dev/null
+++ b/salt/minion/cert/swift/pki.yml
@@ -0,0 +1,8 @@
+parameters:
+ salt:
+ minion:
+ cert:
+ swift:
+ key_file: /srv/salt/pki/${_param:cluster_name}/swift.${_param:cluster_public_host}.key
+ cert_file: /srv/salt/pki/${_param:cluster_name}/swift.${_param:cluster_public_host}.crt
+ all_file: /srv/salt/pki/${_param:cluster_name}/swift-with-key.${_param:cluster_public_host}.pem