Fix Salt PKI setup
diff --git a/salt/master/api.yml b/salt/master/api.yml
index 1cfeb42..1c0c3fb 100644
--- a/salt/master/api.yml
+++ b/salt/master/api.yml
@@ -1,6 +1,12 @@
parameters:
_param:
salt_master_api_port: 8000
+ salt_master_api_permissions:
+ - '.*'
+ - '@local'
+ - '@wheel' # to allow access to all wheel modules
+ - '@runner' # to allow access to all runner modules
+ - '@jobs' # to allow access to the jobs runner and/or wheel mo
salt:
api:
enabled: true
@@ -11,12 +17,7 @@
command_timeout: 600
user:
salt:
- permissions:
- - '.*'
- - '@local'
- - '@wheel' # to allow access to all wheel modules
- - '@runner' # to allow access to all runner modules
- - '@jobs' # to allow access to the jobs runner and/or wheel mo
+ permissions: ${_param:salt_master_api_permissions}
linux:
system:
user:
diff --git a/salt/minion/ca/salt_master.yml b/salt/minion/ca/salt_master.yml
new file mode 100644
index 0000000..30c9d9b
--- /dev/null
+++ b/salt/minion/ca/salt_master.yml
@@ -0,0 +1,26 @@
+parameters:
+ _param:
+ salt_minion_ca_common_name: Salt Master CA
+ salt_minion_ca_country: cz
+ salt_minion_ca_locality: Prague
+ salt_minion_ca_organization: Mirantis
+ salt_minion_ca_days_valid_authority: 3650
+ salt_minion_ca_days_valid_certificate: 365
+ salt:
+ minion:
+ ca:
+ salt_master_ca:
+ common_name: ${_param:salt_minion_ca_common_name}
+ country: ${_param:salt_minion_ca_country}
+ locality: ${_param:salt_minion_ca_locality}
+ organization: ${_param:salt_minion_ca_organization}
+ signing_policy:
+ cert_server:
+ type: v3_edge_cert_server
+ minions: '*'
+ cert_client:
+ type: v3_edge_cert_client
+ minions: '*'
+ days_valid:
+ authority: ${_param:salt_minion_ca_days_valid_authority}
+ certificate: ${_param:salt_minion_ca_days_valid_certificate}
diff --git a/salt/minion/cert/proxy.yml b/salt/minion/cert/proxy.yml
new file mode 100644
index 0000000..fac9aa5
--- /dev/null
+++ b/salt/minion/cert/proxy.yml
@@ -0,0 +1,11 @@
+parameters:
+ _param:
+ salt_minion_ca_authority: salt_master_ca
+ salt:
+ minion:
+ cert:
+ proxy:
+ host: ${_param:salt_minion_ca_host}
+ signing_policy: cert_server
+ authority: ${_param:salt_minion_ca_authority}
+ common_name: ${_param:cluster_public_host}