Update for ECS 1.5.0 release (#110)

* Add ecs_accounts to be distinct from default_accounts
* No longer import rpm package postgresxx-devel to avoid dependency on epel repo rpm perl-IPC-Run in RHEL8
* Remove ECS db schemas from general list of default db's as external db is deprecated in ECS
* Process ECS TLS ACLs separately from base
* Support Postgresql 12 & higher
* Support MySQL8
* Default ecs_nodes to empty [] when not specified
* Fix for external auth when none desired
* Allow any path for autotls private key
* Refactor 'vars/' in external_auth role
* Fix ext_auth, pvc_ecs prerequisites
* Fix IPA verify when deploying ECS

Signed-off-by: Chuck Levesque <clevesque@cloudera.com>

Author: clevesque

.gitignore

@@ -162,3 +162,4 @@ dmypy.json
 # Cython debug symbols
 cython_debug/
 
+.DS_Store

roles/cloudera_manager/autotls/defaults/main.yml

@@ -16,3 +16,4 @@
 
 host_ssh_username: root
 host_ssh_password: cloudera
+sudoerUser: centos

roles/cloudera_manager/autotls/tasks/main.yml

@@ -48,7 +48,7 @@
 
 - name: Set node_key on one line
   set_fact:
-    node_key_one_line: "{{ lookup('file', '~/node_key' ) | replace('\n', '\\n') | replace('\"', '\\\"' ) }}"
+    node_key_one_line: "{{ lookup('file', private_key_path ) | replace('\n', '\\n') | replace('\"', '\\\"' ) }}"
   when: not use_password
 
 - name: DEBUG Auto-TLS using key

roles/cloudera_manager/autotls/templates/auto-tls-key.json

@@ -3,7 +3,7 @@
     "configureAllServices" : "true",
     "sshPort" : 22,
     {% if freeipa_activated %}"trustedCaCerts" : "/etc/ipa/ca.crt",{% endif %}
-    "userName" : "root",
-    "privateKey": "{{ node_key_one_line }}"
-} 
-    
+    "userName" : "{{ sudoerUser|default("root") }}",
+    "privateKey": "{{ node_key_one_line|default('~/node_key') }}"
+    "passphrase": "{{ passphrase|default("") }}"
+} 

roles/cloudera_manager/common/defaults/main.yml

@@ -27,6 +27,6 @@ cloudera_manager_database_type: "{{ database_type }}"
 cloudera_manager_database_name: scm
 cloudera_manager_database_user: scm
 cloudera_manager_database_password: changeme
-cloudera_manager_database_port: "{{ database_port | cloudera.cluster.default_database_port }}"
+cloudera_manager_database_port: "{{ database_type | cloudera.cluster.default_database_port }}"
 cloudera_manager_agent_lib_directory: /var/lib/cloudera-scm-agent
 cloudera_manager_cmf_java_opts_default: "-Xmx4G -XX:MaxPermSize=256m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/tmp"

roles/cloudera_manager/external_auth/defaults/main.yml

@@ -1,4 +1,4 @@
-# Copyright 2021 Cloudera, Inc.
+# Copyright 2023 Cloudera, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,31 +13,5 @@
 # limitations under the License.
 
 ---
-cloudera_manager_external_auth:
-  provider: "{{ 'FreeIPA' if freeipa_activated == true else omit }}"
-  external_first: no
-  external_only: no
-  external_set: "{{ 'yes' if freeipa_activated == true else 'no' }}"
-  role_mappings: "{{ default_free_ipa_role_mappings if freeipa_activated == true else omit }}"
 
-default_free_ipa_role_mappings:
-  - group: admins
-    roles: [ ROLE_ADMIN ]
-  - group: auditors
-    roles: [ ROLE_AUDITOR ]
-  - group: users
-    roles: [ ROLE_USER ]
-
-auth_providers:
-  FreeIPA:
-    type: LDAP
-    ldap_url: "{{ ipa_ldap_url }}"
-    ldap_base_dn:
-    ldap_bind_user_dn: "{{ ipa_ldap_user_bind_dn }}"
-    ldap_bind_password: "{{ ipa_ldap_user_bind_password }}"
-    ldap_search_base:
-      user: "{{ ipa_ldap_user_search_base }}"
-      group: "{{ ipa_ldap_group_search_base }}"
-    ldap_search_filter:
-      user: "{{ ipa_ldap_user_search_filter }}"
-      group: "{{ ipa_ldap_user_group_filter }}"
+freeipa_activated: False

roles/cloudera_manager/external_auth/tasks/main.yml

@@ -1,4 +1,4 @@
-# Copyright 2021 Cloudera, Inc.
+# Copyright 2023 Cloudera, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,6 +14,15 @@
 
 ---
 
+- name: Conditionally load in variables for initializing IPA
+  ansible.builtin.include_vars:
+    file: freeipa.yml
+  when: 
+  - freeipa_activated
+  - cloudera_manager_external_auth is undefined
+  - cloudera_manager_version is version('6.0.0','>=')
+
+
 - name: Select external auth provider details
   set_fact:
     auth_provider: "{{ auth_providers[cloudera_manager_external_auth.provider] }}"

roles/cloudera_manager/external_auth/vars/freeipa.yml

@@ -0,0 +1,44 @@
+# Copyright 2023 Cloudera, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+
+default_free_ipa_role_mappings:
+  - group: admins
+    roles: [ ROLE_ADMIN ]
+  - group: auditors
+    roles: [ ROLE_AUDITOR ]
+  - group: users
+    roles: [ ROLE_USER ]
+
+cloudera_manager_external_auth:
+  provider: "FreeIPA"
+  external_first: no
+  external_only: no
+  external_set: yes
+  role_mappings: "{{ default_free_ipa_role_mappings }}"
+
+auth_providers:
+  FreeIPA:
+    type: LDAP
+    ldap_url: "{{ ipa_ldap_url }}"
+    ldap_base_dn:
+    ldap_bind_user_dn: "{{ ipa_ldap_user_bind_dn }}"
+    ldap_bind_password: "{{ ipa_ldap_user_bind_password }}"
+    ldap_search_base:
+      user: "{{ ipa_ldap_user_search_base }}"
+      group: "{{ ipa_ldap_group_search_base }}"
+    ldap_search_filter:
+      user: "{{ ipa_ldap_user_search_filter }}"
+      group: "{{ ipa_ldap_user_group_filter }}"

roles/cloudera_manager/external_auth/vars/main.yml

@@ -29,3 +29,44 @@ auth_role_display_names:
   ROLE_OPERATOR: Operator
   ROLE_USER: Read-Only
   ROLE_USER_ADMIN: User Administrator
+  
+default_free_ipa_role_mappings:
+  - group: admins
+    roles: [ ROLE_ADMIN ]
+  - group: auditors
+    roles: [ ROLE_AUDITOR ]
+  - group: users
+    roles: [ ROLE_USER ]
+when: 
+  - freeipa_activated
+  - cloudera_manager_external_auth is undefined
+  - cloudera_manager_version is version('6.0.0','>=')
+
+cloudera_manager_external_auth:
+  provider: "FreeIPA"
+  external_first: no
+  external_only: no
+  external_set: yes
+  role_mappings: "{{ default_free_ipa_role_mappings }}"
+when: 
+  - freeipa_activated
+  - cloudera_manager_external_auth is undefined
+  - cloudera_manager_version is version('6.0.0','>=')
+
+auth_providers:
+  FreeIPA:
+    type: LDAP
+    ldap_url: "{{ ipa_ldap_url }}"
+    ldap_base_dn:
+    ldap_bind_user_dn: "{{ ipa_ldap_user_bind_dn }}"
+    ldap_bind_password: "{{ ipa_ldap_user_bind_password }}"
+    ldap_search_base:
+      user: "{{ ipa_ldap_user_search_base }}"
+      group: "{{ ipa_ldap_group_search_base }}"
+    ldap_search_filter:
+      user: "{{ ipa_ldap_user_search_filter }}"
+      group: "{{ ipa_ldap_user_group_filter }}"
+when: 
+  - freeipa_activated
+  - cloudera_manager_external_auth is undefined
+  - cloudera_manager_version is version('6.0.0','>=')

roles/config/services/mgmt/tasks/main.yml

@@ -1,4 +1,4 @@
-# Copyright 2021 Cloudera, Inc.
+# Copyright 2023 Cloudera, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 # This variable is used by other roles
 # please take care when changing it
 - set_fact:
-    databases: "{{ database_defaults | combine(definition.mgmt.databases | default({}), recursive=True) }}"
+    databases: "{{ databases_cm_svcs | combine(definition.mgmt.databases | default({}), recursive=True) }}"
 
 - name: Reset custom configuration dictionary
   set_fact:
@@ -35,4 +35,4 @@
 # please take care when changing it
 - name: Merge custom configurations
   set_fact:
-    merged_configs: "{{ custom_configs | combine(definition.mgmt.configs | default({}), recursive=True) }}"
+    merged_configs: "{{ custom_configs | combine(definition.mgmt.configs | default({}), recursive=True) }}"