python/psf-salt — pull request #10 by dstufft (2014-10-19 19:11:29+00:00)
Title: Enable Authentication of Services

Right now we find services by either hardcoding their IP addresses or using the salt mine. While this means we can be reasonably sure that the IP address may be correct it does not however do anything to ensure that the service we are communicating with is the one we mean to be talking to. The canonical way to handle this is by using TLS, so this PR adds machinery to do that.

* Generates a 5 year CA on the first attempt to use it and distributes the root cert to all servers.
* Generates certificates signed by the above CA for the defined services and ensure they are available only to the servers for a specific role.
* All certificates created are short lived certificates (default of 1 day) and will be automatically replaced when they are at 25% of their lifetime.
* Moves the TLS certificates for the HTTPS load balancers (the ones signed by public CAs) so it's handled by the same system and setup haproxy to use them.
* Centralizes the cipher settings into a pillar.
* Switches PostgreSQL over to using the new system.
* Remove the now outdated attempt at a CA, ``psf-ca``.

The CA file is located at ``/etc/ssl/certs/PSF_CA.pem``. An example of validating it would be something like ``psql "postgresql://monitoring:insecurepasswordlol@postgresql.psf.io/monitoring?sslmode=verify-full&sslrootcert=/etc/ssl/certs/PSF_CA.pem&hostaddr=192.168.50.20"``

New certificates can be added by editing ``pillar/base/tls.sls`` and adding a new dictionary under ``gen_certs``.