Ensure CA fields are static (bsc#1045766)
As the DHCP domain name can change, we should avoid using
it in our CA cert in order to prevent it being unnecessarily
regenerated.
Fixes bsc#1045766
@@ -54,13 +54,7 @@ salt-minion:
/etc/pki/ca.crt:
x509.certificate_managed:
- signing_private_key: /etc/pki/ca.key
-{% if salt['grains.get']('domain', '')|length > 0 %}
- - CN: {{ grains['domain'] }}
-{% elif salt['pillar.get']('dns:domain', '')|length > 0 %}
- - CN: {{ pillar['dns']['domain'] }}
-{% else %}
- - CN: kubernetes
-{% endif %}
+ - CN: CaaSP Autogenerated CA
- C: {{ pillar['certificate_information']['subject_properties']['C']|yaml_dquote }}
- Email: {{ pillar['certificate_information']['subject_properties']['Email']|yaml_dquote }}
- GN: {{ pillar['certificate_information']['subject_properties']['GN']|yaml_dquote }}
