From 828a542896c7a2f75ced859858667ebb780cf9b8 Mon Sep 17 00:00:00 2001 From: Tyler Hale Date: Thu, 1 Aug 2024 14:43:13 -0600 Subject: [PATCH] Adding SSL Support --- README.md | 9 ++- collections/requirements.yml | 4 ++ roles/mariadb_cluster/defaults/main.yml | 4 ++ roles/mariadb_cluster/handlers/main.yml | 1 + .../tasks/bootstrap-galera.yml | 6 +- .../tasks/certificates-server.yml | 39 +++++++++++ roles/mariadb_cluster/tasks/certificates.yml | 67 +++++++++++++++++++ roles/mariadb_cluster/tasks/main.yml | 22 +++++- roles/mariadb_cluster/templates/galera.cnf.j2 | 4 ++ roles/mariadb_cluster/templates/ssl.cnf.j2 | 12 ++++ 10 files changed, 162 insertions(+), 6 deletions(-) create mode 100644 collections/requirements.yml create mode 100644 roles/mariadb_cluster/tasks/certificates-server.yml create mode 100644 roles/mariadb_cluster/tasks/certificates.yml create mode 100644 roles/mariadb_cluster/templates/ssl.cnf.j2 diff --git a/README.md b/README.md index f176f6c..d6846b5 100644 --- a/README.md +++ b/README.md @@ -4,12 +4,16 @@ Ansible playbook that provisions a group of servers to run mariadb as a Galera C ## Requirements -If you are using HaProxy as a front end to the cluster, you will need to create a user for the health checks to work properly. The user does not need to be able to access any databases, it just needs to be able to authenticate against the server. +If you are using HaProxy as a front end to the cluster **without SSL**, you will need to create a user for the health checks to work properly. The user does not need to be able to access any databases, it just needs to be able to authenticate against the server. ```sql CREATE USER 'haproxy_check'@'10.10.10.253' WITH MAX_QUERIES_PER_HOUR 1 MAX_UPDATES_PER_HOUR 0 MAX_STATEMENT_TIME 0.0000000001; ``` +If you are using HaProxy as a front end to the cluster **with SSL**, use default tcp checks to validate the service is available as HaProxy does not support the SSL settings for mysql. + +If this is the first install, the `mariadb_cluster_bootstrap` variable will need to be set to true to bootstrap the cluster. + ## Variables | Variable | Required | Default | Description | @@ -43,6 +47,9 @@ You can view the status of the cluster by running the following command. ```sql SHOW GLOBAL STATUS LIKE 'wsrep_%'; +SHOW GLOBAL VARIABLES LIKE 'have_ssl'; +SHOW SESSION STATUS LIKE 'Ssl_cipher'; +SHOW GLOBAL VARIABLES LIKE 'require_secure_transport'; ``` ## License diff --git a/collections/requirements.yml b/collections/requirements.yml new file mode 100644 index 0000000..2c4c856 --- /dev/null +++ b/collections/requirements.yml @@ -0,0 +1,4 @@ +--- +collections: +- community.general +- community.crypto \ No newline at end of file diff --git a/roles/mariadb_cluster/defaults/main.yml b/roles/mariadb_cluster/defaults/main.yml index 70b9b51..6a694d2 100644 --- a/roles/mariadb_cluster/defaults/main.yml +++ b/roles/mariadb_cluster/defaults/main.yml @@ -3,3 +3,7 @@ mariadb_cluster_wsrep_cluster_name: "my_wsrep_cluster" mariadb_cluster_access_ip: "" +mariadb_cluster_master: "{{ groups['mariadb_cluster'][0] }}" +mariadb_cluster_ssl: true +mariadb_cluster_bootstrap: false +mariadb_cluster_cert_length: "+7300d" diff --git a/roles/mariadb_cluster/handlers/main.yml b/roles/mariadb_cluster/handlers/main.yml index f21ee31..413b365 100644 --- a/roles/mariadb_cluster/handlers/main.yml +++ b/roles/mariadb_cluster/handlers/main.yml @@ -17,3 +17,4 @@ - name: Bootstrap Galera include_tasks: tasks/bootstrap-galera.yml + when: mariadb_cluster_bootstrap == true diff --git a/roles/mariadb_cluster/tasks/bootstrap-galera.yml b/roles/mariadb_cluster/tasks/bootstrap-galera.yml index d625e63..9d815d6 100644 --- a/roles/mariadb_cluster/tasks/bootstrap-galera.yml +++ b/roles/mariadb_cluster/tasks/bootstrap-galera.yml @@ -3,12 +3,12 @@ - name: Stop MariaDB on first MariaDB Galera cluster node service: name=mariadb state=stopped - when: inventory_hostname == groups['mariadb_cluster'][0] + when: inventory_hostname == mariadb_cluster_master - name: Bootstrap first MariaDB Galera cluster node command: galera_new_cluster - when: inventory_hostname == groups['mariadb_cluster'][0] + when: inventory_hostname == mariadb_cluster_master - name: Restart the other MariaDB Galera cluster nodes service: name=mariadb state=restarted - when: inventory_hostname != groups['mariadb_cluster'][0] + when: inventory_hostname != mariadb_cluster_master diff --git a/roles/mariadb_cluster/tasks/certificates-server.yml b/roles/mariadb_cluster/tasks/certificates-server.yml new file mode 100644 index 0000000..d776fe3 --- /dev/null +++ b/roles/mariadb_cluster/tasks/certificates-server.yml @@ -0,0 +1,39 @@ +--- +# file: roles/mariadb_cluster/tasks/certificates-server.yml + + +- name: "{{ hostvars[item]['ansible_hostname'] }} - Create private key" + community.crypto.openssl_privatekey: + path: /etc/ssl/galera/server.key + +- name: "{{ hostvars[item]['ansible_hostname'] }} - Check if server certificate exists" + stat: + path: "/etc/ssl/galera/server.pem" + register: serverCertCheck + +- name: "{{ hostvars[item]['ansible_hostname'] }} - CSR" + block: + - name: "{{ hostvars[item]['ansible_hostname'] }} - Create CSR for new certificate" + community.crypto.openssl_csr_pipe: + privatekey_path: /etc/ssl/galera/server.key + common_name: "{{ hostvars[item]['ansible_hostname'] }}" + subject_alt_name: + - "DNS:{{ mariadb_cluster_wsrep_cluster_name }}" + register: csr + + - name: "{{ hostvars[item]['ansible_hostname'] }} - Sign certificate with CA" + community.crypto.x509_certificate_pipe: + csr_content: "{{ csr.csr }}" + provider: ownca + ownca_path: /etc/ssl/galera/ca-certificate.pem + ownca_privatekey_path: /etc/ssl/galera/ca-certificate.key + ownca_not_after: "{{ mariadb_cluster_cert_length }}" + ownca_not_before: "-1d" + delegate_to: "{{ mariadb_cluster_master }}" + register: certificate + + - name: "{{ hostvars[item]['ansible_hostname'] }} - Write certificate file" + copy: + dest: /etc/ssl/galera/server.pem + content: "{{ certificate.certificate }}" + when: not serverCertCheck.stat.exists diff --git a/roles/mariadb_cluster/tasks/certificates.yml b/roles/mariadb_cluster/tasks/certificates.yml new file mode 100644 index 0000000..84c5c20 --- /dev/null +++ b/roles/mariadb_cluster/tasks/certificates.yml @@ -0,0 +1,67 @@ +--- +# file: roles/mariadb_cluster/tasks/certificates.yml + +- name: Ensure directory exists for local self-signed TLS certs + file: + path: /etc/ssl/galera/ + state: directory + owner: mysql + group: mysql + recurse: true + +- name: CA Setup + block: + - name: Generate an OpenSSL private key + community.crypto.openssl_privatekey: + path: /etc/ssl/galera/ca-certificate.key + + - name: Create certificate signing request (CSR) for CA certificate + community.crypto.openssl_csr_pipe: + privatekey_path: /etc/ssl/galera/ca-certificate.key + common_name: Galera-Ansible + use_common_name_for_san: false + basic_constraints: + - 'CA:TRUE' + basic_constraints_critical: true + key_usage: + - keyCertSign + key_usage_critical: true + register: ca_csr + changed_when: false + + - name: Create self-signed CA certificate from CSR + community.crypto.x509_certificate: + path: /etc/ssl/galera/ca-certificate.pem + csr_content: "{{ ca_csr.csr }}" + privatekey_path: /etc/ssl/galera/ca-certificate.key + selfsigned_not_after: "{{ mariadb_cluster_cert_length }}" + provider: selfsigned + + - name: Copy ca-certificate locally for transfer + fetch: + src: /etc/ssl/galera/ca-certificate.pem + dest: /tmp/galera-ca-certificate.pem + flat: yes + when: inventory_hostname == mariadb_cluster_master + +- name: Transfer ca cert to other members + copy: + src: /tmp/galera-ca-certificate.pem + dest: /etc/ssl/galera/ca-certificate.pem + owner: mysql + group: mysql + mode: '0644' + +- name: Server Certificates + include_tasks: certificates-server.yml + loop: "{{ groups['mariadb_cluster'] }}" + loop_control: + extended: yes + +- name: Ensure mysql has permissions to access certs + file: + path: /etc/ssl/galera/ + state: directory + owner: mysql + group: mysql + recurse: true diff --git a/roles/mariadb_cluster/tasks/main.yml b/roles/mariadb_cluster/tasks/main.yml index 0b3e10b..b4c62ad 100644 --- a/roles/mariadb_cluster/tasks/main.yml +++ b/roles/mariadb_cluster/tasks/main.yml @@ -11,13 +11,24 @@ - mariadb-server - galera state: latest + tags: packages - name: Update galera config template: src: "galera.cnf.j2" - dest: "/etc/my.cnf.d/galera.cnf" + dest: "/etc/my.cnf.d/z-galera.cnf" notify: Bootstrap Galera +- name: Certificates tasks + include_tasks: certificates.yml + when: mariadb_cluster_ssl == true + +- name: Update ssl config + template: + src: "ssl.cnf.j2" + dest: "/etc/my.cnf.d/z-ssl.cnf" + when: mariadb_cluster_ssl == true + - name: Enable firewall rule for MySQL access firewalld: port: 3306/tcp @@ -29,11 +40,12 @@ - name: "Enable firewall rule for MySQL access to Access IP" firewalld: - rich_rule: 'rule family="ipv4" source address="{{ mariadb_cluster_access_ip }}" port port="3306" protocol="tcp" accept' + rich_rule: 'rule family="ipv4" source address="{{ item }}" port port="3306" protocol="tcp" accept' permanent: yes state: enabled immediate: yes notify: Reload firewalld + loop: "{{ mariadb_cluster_access_ip }}" when: mariadb_cluster_access_ip != "" - name: Setup access for other servers @@ -66,6 +78,12 @@ dest: /etc/systemd/system/mariadb.service.d/override.conf notify: Daemon Reload +- name: Set selinux nis_enabled + seboolean: + name: nis_enabled + state: true + persistent: true + - name: Flush handlers meta: flush_handlers diff --git a/roles/mariadb_cluster/templates/galera.cnf.j2 b/roles/mariadb_cluster/templates/galera.cnf.j2 index acc6f05..52d41f2 100644 --- a/roles/mariadb_cluster/templates/galera.cnf.j2 +++ b/roles/mariadb_cluster/templates/galera.cnf.j2 @@ -37,7 +37,11 @@ wsrep_on=1 wsrep_provider=/usr/lib64/galera/libgalera_smm.so # Provider specific configuration options +{% if mariadb_cluster_ssl == true %} +wsrep_provider_options="socket.ssl_key=/etc/ssl/galera/server.key;socket.ssl_cert=/etc/ssl/galera/server.pem;socket.ssl_ca=/etc/ssl/galera/ca-certificate.pem" +{% else %} #wsrep_provider_options= +{% endif %} # Logical cluster name. Should be the same for all nodes. wsrep_cluster_name="{{ mariadb_cluster_wsrep_cluster_name }}" diff --git a/roles/mariadb_cluster/templates/ssl.cnf.j2 b/roles/mariadb_cluster/templates/ssl.cnf.j2 new file mode 100644 index 0000000..119b971 --- /dev/null +++ b/roles/mariadb_cluster/templates/ssl.cnf.j2 @@ -0,0 +1,12 @@ +# MySQL Server +[mysqld] +ssl-ca = /etc/ssl/galera/ca-certificate.pem +ssl-key = /etc/ssl/galera/server.key +ssl-cert = /etc/ssl/galera/server.pem +require_secure_transport = 1 + +# MySQL Client Configuration +[mysql] +ssl-ca = /etc/ssl/galera/ca-certificate.pem +ssl-key = /etc/ssl/galera/server.key +ssl-cert = /etc/ssl/galera/server.pem