Function certificate_managed_wrapper

salt/client/ssh/wrapper/ssh_pki.py:296–650

This function essentially behaves like a sophisticated Jinja macro. It is intended to provide a replacement for the ``ssh_pki.certificate_managed`` state with peer publishing or some backends, which does not work via salt-ssh. It performs necessary checks during rendering and return

(
    name,
    ca_server,
    signing_policy,
    backend=None,
    backend_args=None,
    private_key_managed=None,
    private_key=None,
    private_key_passphrase=None,
    public_key=None,
    certificate_managed=None,
    test=None,
)

def certificate_managed_wrapper(
    name,
    ca_server,
    signing_policy,
    backend=None,
    backend_args=None,
    private_key_managed=None,
    private_key=None,
    private_key_passphrase=None,
    public_key=None,
    certificate_managed=None,
    test=None,
):
    """
    This function essentially behaves like a sophisticated Jinja macro.
    It is intended to provide a replacement for the ``ssh_pki.certificate_managed``
    state with peer publishing or some backends, which does not work via salt-ssh.
    It performs necessary checks during rendering and returns an appropriate
    highstate structure that does work via salt-ssh (if a certificate needs to be
    reissued, it is done during rendering and the actual state just manages the file).

    Required arguments are ``name``, ``ca_server`` and ``signing_policy``.
    If you want this function to manage a private key, it should be specified
    in ``private_key_managed``, which should contain all arguments to the
    respective state. Note that the private key will not be checked for changes.
    If you want to use a public key as a source, it must exist during state
    rendering and you cannot manage a private key.

    All optional keyword arguments to ``certificate_managed`` can be specified
    in the dict param ``certificate_managed``.
    Key rotation can be activated by including ``new: true`` in the dict for
    ``private_key_managed``.

    As an example, for Jinja templates, you can serialize this function's output
    directly into the state file. Note that you need to pass ``opts.get("test")``
    explicitly for test mode to work reliably!

    .. code-block:: jinja

        {%- set private_key_params = {
                "name": "/root/.ssh/id_foo",
                "algo": "ed25519",
                "new": true
        } %}
        {%- set certificate_params = {
                "ttl_remaining": "7d",
                "ttl": "30d",
                "valid_principals": ["min.ion.example.org"]
        } %}
        {{
            salt["ssh_pki.certificate_managed_wrapper"](
                "/root/.ssh/id_foo.crt",
                ca_server="ca_minion",
                signing_policy="user_cert",
                private_key_managed=private_key_params,
                certificate_managed=certificate_params,
                test=opts.get("test")
            ) | yaml(false)