Puppet Class: iop::core_gateway

Defined in:
manifests/core_gateway.pp

Overview

Class: iop::core_gateway

Install and configure the core gateway

Parameters:

$foreman_servername

FQDN of the Foreman server

$image

The container image

$ensure

Ensure service is present or absent

Parameters:

  • foreman_servername (Stdlib::Fqdn) (defaults to: $facts['networking']['fqdn'])
  • image (String[1]) (defaults to: 'quay.io/iop/gateway')
  • ensure (Enum['present', 'absent']) (defaults to: 'present') 


13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
 
# File 'manifests/core_gateway.pp', line 13

class iop::core_gateway (
  Stdlib::Fqdn $foreman_servername = $facts['networking']['fqdn'],
  String[1] $image = 'quay.io/iop/gateway',
  Enum['present', 'absent'] $ensure = 'present',
) {
  include podman
  require iop::core_network
  include certs::iop

  $service_name = 'iop-core-gateway'
  $relay_conf_secret_name = "${service_name}-relay-conf"

  $server_cert_secret_name = "${service_name}-server-cert"
  $server_key_secret_name = "${service_name}-server-key"
  $server_ca_cert_secret_name = "${service_name}-server-ca-cert"

  $client_cert_secret_name = "${service_name}-client-cert"
  $client_key_secret_name = "${service_name}-client-key"
  $client_ca_cert_secret_name = "${service_name}-client-ca-cert"

  podman::secret { $server_cert_secret_name:
    ensure => $ensure,
    path   => $certs::iop::server_cert,
  }

  podman::secret { $server_key_secret_name:
    ensure => $ensure,
    path   => $certs::iop::server_key,
  }

  podman::secret { $server_ca_cert_secret_name:
    ensure => $ensure,
    path   => $certs::iop::server_ca_cert,
  }

  podman::secret { $client_cert_secret_name:
    ensure => $ensure,
    path   => $certs::iop::client_cert,
  }

  podman::secret { $client_key_secret_name:
    ensure => $ensure,
    path   => $certs::iop::client_key,
  }

  podman::secret { $client_ca_cert_secret_name:
    ensure => $ensure,
    path   => $certs::iop::client_ca_cert,
  }

  podman::secret { $relay_conf_secret_name:
    ensure => $ensure,
    secret => Sensitive(
      epp('iop/gateway/relay.conf.epp', { 'foreman_servername' => $foreman_servername }),
    ),
  }

  podman::quadlet { 'iop-core-gateway':
    ensure       => $ensure,
    quadlet_type => 'container',
    user         => 'root',
    defaults     => {},
    require      => [
      Podman::Network['iop-core-network'],
      Podman::Secret[
        $server_cert_secret_name,
        $server_key_secret_name,
        $server_ca_cert_secret_name,
      ],
    ],
    settings     => {
      'Unit'      => {
        'Description' => 'IOP Core Gateway Container',
      },
      'Container' => {
        'Image'         => $image,
        'ContainerName' => 'iop-core-gateway',
        'Network'       => 'iop-core-network',
        'PublishPort'   => [
          '127.0.0.1:24443:8443',
        ],
        'Secret'        => [
          "${server_cert_secret_name},target=/etc/nginx/certs/nginx.crt,mode=0440,type=mount,uid=998,gid=998",
          "${server_key_secret_name},target=/etc/nginx/certs/nginx.key,mode=0440,type=mount,uid=998,gid=998",
          "${server_ca_cert_secret_name},target=/etc/nginx/certs/ca.crt,mode=0440,type=mount,uid=998,gid=998",
          "${client_cert_secret_name},target=/etc/nginx/smart-proxy-relay/certs/proxy.crt,mode=0440,type=mount,uid=998,gid=998",
          "${client_key_secret_name},target=/etc/nginx/smart-proxy-relay/certs/proxy.key,mode=0440,type=mount,uid=998,gid=998",
          "${client_ca_cert_secret_name},target=/etc/nginx/smart-proxy-relay/certs/ca.crt,mode=0440,type=mount,uid=998,gid=998",
          "${relay_conf_secret_name},target=/etc/nginx/smart-proxy-relay/relay.conf,mode=0440,type=mount,uid=998,gid=998",
        ],
      },
      'Service'   => {
        'Environment' => 'REGISTRY_AUTH_FILE=/etc/foreman/registry-auth.json',
        'Restart'     => 'on-failure',
      },
      'Install'   => {
        'WantedBy' => [
          'multi-user.target',
          'default.target',
        ],
      },
    },
  }
}