Don't rely on fqdn grain for cert generation
The FQDN grain is unrelable, and depending on the node (and it's current
state) will give us different values. It's use needs to be dropped entirely,
however this gets 1 piece of the issue resolved, and fixes bug in
the process.
Fixes bsc#1041951
@@ -2,7 +2,7 @@ include:
- crypto
{% set ip_addresses = [] -%}
-{% set extra_names = ["DNS: " + grains['fqdn']] -%}
+{% set extra_names = ["DNS: " + grains['id'] + "." + pillar['internal_infra_domain'] ] -%}
{{ pillar['paths']['ca_dir'] }}:
file.directory:
@@ -38,7 +38,7 @@ include:
- ca_server: {{ salt['mine.get']('roles:ca', 'x509.get_pem_entries', expr_form='grain').keys()[0] }}
- signing_policy: minion
- public_key: /etc/pki/minion.key
- - CN: {{ grains['fqdn'] }}
+ - CN: {{ grains['id'] }}.{{ pillar['internal_infra_domain'] }}
- C: {{ pillar['certificate_information']['subject_properties']['C']|yaml_dquote }}
- Email: {{ pillar['certificate_information']['subject_properties']['Email']|yaml_dquote }}
- GN: {{ pillar['certificate_information']['subject_properties']['GN']|yaml_dquote }}
