The role uses openssl_privatekey, openssl_csr, x509_certificate and x509_certificate_info, but neither declared
that collection anywhere nor mentioned it in the readme. A standalone role cannot express collection dependencies in
its metadata, so a requirements file next to the readme section is the usual way.
The section also documents two requirements that arose from the recent changes and were undocumented as well. Facts
have to be gathered, because the package names, the trust store anchor and the update command are resolved by
distribution, os_family and architecture. And the role needs become, since it writes into /etc and updates the trust
store.
No version is pinned. All used modules exist since community.crypto 1.0.0, so a lower bound would be arbitrary.
Co-authored-by: Copilot <copilot@github.com>
The scenario was only runnable by hand so far, which defeats its purpose. Podman is already installed and
configured on the runners, so the job only has to add molecule itself.
The repository is named ansible-role-certificate-authority while the role is named certificate_authority. Since the
scenario includes the role by its name and uses the parent of the project directory as roles path, the checkout has
to happen into a directory matching the role.
The collections are declared in molecule/default/collections.yml instead of being installed by an explicit step.
That is the path the collections invoker of molecule looks at by default, so the dependency action of the test
sequence installs them for the workflow and for local runs alike.
Co-authored-by: Copilot <copilot@github.com>
The scenario was added without any hint in the readme, so a contributor had to read molecule.yml to find out
which tools are needed and how to invoke them. Molecule ships only its default driver, therefore podman and the
collection containers.podman are prerequisites that are not obvious.
The section is placed above the parameters, because the readme generator treats the parameter section as the last
one in the file and replaces everything below it.
Co-authored-by: Copilot <copilot@github.com>
Several parameter descriptions were carried over from unrelated variables and
described the wrong attribute. Both country name parameters claimed to document
a Common Name, the client organizational unit name repeated the Common Name text
and the two client content parameters described a passphrase and a key
algorithm.
The client content parameters now follow the wording already used for their root
and intermediate counterparts. The README tables were regenerated with
readme-generator, which also normalises the column padding of the previously
hand-edited rows.
Additionally fix the misspelled repository owner in the homepage URL and a typo
in the galaxy description.
Co-authored-by: Copilot <copilot@github.com>
The previous wording exceeded the description column width generated by
readme-generator, so markdownlint reported MD060/table-column-style for all
three parameter tables. Shorten the hint to an `Example:` clause that fits the
existing column width and pad the cells accordingly, keeping the README stable
across regeneration.
Co-authored-by: Copilot <copilot@github.com>
The variables `certificate_authority_root_ca_subject_alternative_names` and
`certificate_authority_intermediate_ca_subject_alternative_names` were
documented but never referenced by any task, so both CA certificates were always
issued without SANs. Wire them into the corresponding CSR tasks and fall back to
`omit` when the list is empty.
SAN entries are now passed to `openssl_csr` unchanged instead of being prefixed
with `DNS:` by the role. This allows other types such as `IP:` or `email:`,
which the previous rewrite would have corrupted into values like `DNS:IP:...`.
The client tasks additionally dropped `join(',') | quote`, because `quote`
performs shell escaping and `openssl_csr` expects a list.
Since both client CSR tasks only differed in `subject_alt_name`, they collapse
into a single task per file.
BREAKING CHANGE: Entries of all `*_subject_alternative_names` variables must now
carry their type prefix, for example `DNS:example.local` instead of
`example.local`.
Co-authored-by: Copilot <copilot@github.com>
volker.raschekandCopilot