Blame SPECS/ansible-freeipa.spec

7d56d3
# Turn off automatic python byte compilation because these are Ansible
7d56d3
# roles and the files are transferred to the node and compiled there with
7d56d3
# the python verison used in the node
7d56d3
%define __brp_python_bytecompile %{nil}
7d56d3
7d56d3
Summary: Roles and playbooks to deploy FreeIPA servers, replicas and clients
7d56d3
Name: ansible-freeipa
9b7d12
Version: 0.1.10
9b7d12
Release: 1%{?dist}
7d56d3
URL: https://github.com/freeipa/ansible-freeipa
7d56d3
License: GPLv3+
7d56d3
Source: https://github.com/freeipa/ansible-freeipa/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
7d56d3
BuildArch: noarch
7d56d3
7d56d3
#Requires: ansible
7d56d3
7d56d3
%description
7d56d3
ansible-freeipa provides Ansible roles and playbooks to install and uninstall
9b7d12
FreeIPA servers, replicas and clients. Also modules for group, host, topology
9b7d12
and user management.
7d56d3
7d56d3
Note: The ansible playbooks and roles require a configured ansible environment
7d56d3
where the ansible nodes are reachable and are properly set up to have an IP
7d56d3
address and a working package manager.
7d56d3
7d56d3
Features
7d56d3
7d56d3
- Server, replica and client deployment
7d56d3
- Cluster deployments: Server, replicas and clients in one playbook
7d56d3
- One-time-password (OTP) support for client installation
7d56d3
- Repair mode for clients
9b7d12
- Modules for dns forwarder management
9b7d12
- Modules for dns zone management
7d56d3
- Modules for group management
7d56d3
- Modules for hbacrule management
7d56d3
- Modules for hbacsvc management
7d56d3
- Modules for hbacsvcgroup management
7d56d3
- Modules for host management
7d56d3
- Modules for hostgroup management
7d56d3
- Modules for pwpolicy management
9b7d12
- Modules for service management
7d56d3
- Modules for sudocmd management
7d56d3
- Modules for sudocmdgroup management
7d56d3
- Modules for sudorule management
7d56d3
- Modules for topology management
7d56d3
- Modules for user management
9b7d12
- Modules for vault management
7d56d3
7d56d3
Supported FreeIPA Versions
7d56d3
7d56d3
FreeIPA versions 4.6 and up are supported by all roles.
7d56d3
7d56d3
The client role supports versions 4.4 and up, the server role is working with
7d56d3
versions 4.5 and up, the replica role is currently only working with versions
7d56d3
4.6 and up.
7d56d3
7d56d3
Supported Distributions
7d56d3
7d56d3
- RHEL/CentOS 7.4+
7d56d3
- Fedora 26+
7d56d3
- Ubuntu
7d56d3
- Debian 10+ (ipaclient only, no server or replica!)
7d56d3
7d56d3
Requirements
7d56d3
7d56d3
  Controller
9b7d12
7d56d3
  - Ansible version: 2.8+ (ansible-freeipa is an Ansible Collection)
9b7d12
    /usr/bin/kinit is required on the controller if a one time password (OTP)
7d56d3
    is used
7d56d3
  - python3-gssapi is required on the controller if a one time password (OTP)
7d56d3
    is used with keytab to install the client.
7d56d3
7d56d3
  Node
9b7d12
7d56d3
  - Supported FreeIPA version (see above)
7d56d3
  - Supported distribution (needed for package installation only, see above)
7d56d3
7d56d3
Limitations
7d56d3
9b7d12
External signed CA is now supported. But the currently needed two step process
9b7d12
is an issue for the processing in a simple playbook.
9b7d12
Work is planned to have a new method to handle CSR for external signed CAs in
9b7d12
a separate step before starting the server installation.
9b7d12
7d56d3
7d56d3
%prep
7d56d3
%setup -q
7d56d3
# Do not create backup files with patches
7d56d3
# Fix python modules and module utils:
7d56d3
# - Remove shebang
7d56d3
# - Remove execute flag
7d56d3
for i in roles/ipa*/library/*.py roles/ipa*/module_utils/*.py plugins/*/*.py; do
7d56d3
    sed -i '/\/usr\/bin\/python*/d' $i
7d56d3
    chmod a-x $i
7d56d3
done
7d56d3
# Add execute flag to py3test.py scripts
7d56d3
chmod a+x roles/ipa*/files/py3test.py
7d56d3
7d56d3
%build
7d56d3
7d56d3
%install
7d56d3
install -m 755 -d %{buildroot}%{_datadir}/ansible/roles/
7d56d3
cp -rp roles/ipaserver %{buildroot}%{_datadir}/ansible/roles/
7d56d3
cp -rp roles/ipaserver/README.md README-server.md
7d56d3
cp -rp roles/ipareplica %{buildroot}%{_datadir}/ansible/roles/
7d56d3
cp -rp roles/ipareplica/README.md README-replica.md
7d56d3
cp -rp roles/ipaclient %{buildroot}%{_datadir}/ansible/roles/
7d56d3
cp -rp roles/ipaclient/README.md README-client.md
7d56d3
install -m 755 -d %{buildroot}%{_datadir}/ansible/plugins/
7d56d3
cp -rp plugins/* %{buildroot}%{_datadir}/ansible/plugins/
7d56d3
7d56d3
%files
7d56d3
%license COPYING
7d56d3
%{_datadir}/ansible/roles/ipaserver
7d56d3
%{_datadir}/ansible/roles/ipareplica
7d56d3
%{_datadir}/ansible/roles/ipaclient
7d56d3
%{_datadir}/ansible/plugins/module_utils
7d56d3
%{_datadir}/ansible/plugins/modules
9b7d12
%doc README*.md
7d56d3
%doc playbooks
7d56d3
7d56d3
%changelog
9b7d12
* Mon Apr 27 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.10-1
9b7d12
- Update to version 0.1.10:
9b7d12
  - ipaclient: Not delete keytab when ipaclient_on_master is true
9b7d12
  - New module to manage dns forwarder zones in ipa
9b7d12
  - Enhancements of sudorule module tests
9b7d12
  - Gracefully handle RuntimeError raised during parameter validation in
9b7d12
    fail_jso
9b7d12
  - ipareplica_prepare: Fix module DOCUMENTATION
9b7d12
  - ipa[server,replica,client]: setup_logging wrapper for
9b7d12
    standard_logging_setup
9b7d12
  - Created FreeIPABaseModule class to facilitate creation of new modules
9b7d12
  - New IPADNSZone module
9b7d12
  - Add admin password to the ipadnsconfig module tests
9b7d12
  - Added alias module arguments in dnszone module
9b7d12
  - Fixed a bug in AnsibleFreeIPAParams
9b7d12
  - utils/build-galaxy-release: Do not add release tag to version for galaxy
9b7d12
  - ipaserver docs: Calm down module linter
9b7d12
  - galaxy.yml: Add system tag
9b7d12
  - ipareplica_setup_kra: Remove unused ccache parameter
9b7d12
  - ipareplica_setup_krb: krb is assigned to but never used
9b7d12
  - utils/galaxy: Make galaxy scripts more generic
9b7d12
  - galaxyfy-playbook.py: Fixed script name
9b7d12
  Related: RHBZ#1818768
9b7d12
7d56d3
* Thu Feb 20 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.8-3
7d56d3
- ipahost: Do not fail on missing DNS or zone when no IP address given
7d56d3
  Resolves: RHBZ#1804838
7d56d3
7d56d3
* Fri Feb 14 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.8-2
7d56d3
- Updated RPM description for ansible-freeipa 0.1.8
7d56d3
  Related: RHBZ#1748986
7d56d3
- ipahost: Fix choices of auth_ind parameter, allow to reset parameter
7d56d3
  Resolves: RHBZ#1783992
7d56d3
- ipauser: Allow reset of userauthtype, do not depend on first,last for mod
7d56d3
  Resolves: RHBZ#1784474
7d56d3
- ipahost: Enhanced failure msg for member params used without member action
7d56d3
  Resolves: RHBZ#1783948
7d56d3
- Add missing attributes to ipasudorule
7d56d3
  Resolves: RHBZ#1788168
7d56d3
  Resolves: RHBZ#1788035
7d56d3
  Resolves: RHBZ#1788024
7d56d3
- ipapwpolicy: Use global_policy if name is not set
7d56d3
  Resolves: RHBZ#1797532
7d56d3
- ipahbacrule: Fix handing of members with action hbacrule
7d56d3
  Resolves: RHBZ#1787996
7d56d3
- ansible_freeipa_module: Fix comparison of bool parameters in compare_args_isa
7d56d3
  Resolves: RHBZ#1784514
7d56d3
- ipahost: Add support for several IP addresses and also to change them
7d56d3
  Resolves: RHBZ#1783979
7d56d3
  Resolves: RHBZ#1783976
7d56d3
- ipahost: Fail on action member for new hosts, fix dnsrecord_add reverse flag
7d56d3
  Resolves: RHBZ#1803026
7d56d3
7d56d3
* Sat Dec 14 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.8-1
7d56d3
- Update to version 0.1.8 (bug fix release)
7d56d3
  - roles/ipaclient/README.md: Add information about ipaclient_otp
7d56d3
  - Install and enable firewalld if it is configured for ipaserver and
7d56d3
    ipareplica roles
7d56d3
  - ipaserver_test: Do not use zone_overlap_check for domain name validation
7d56d3
  - Allow execution of API commands that do not require a name
7d56d3
  - Update README-host: Drop options from allow_*keytab parameters docs
7d56d3
  - ipauser: Extend email addresses with default email domain if no domain is
7d56d3
    given
7d56d3
    Resolves: RHBZ#1747413
7d56d3
  Related: RHBZ#1748986
7d56d3
7d56d3
* Mon Dec  2 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.7-1
7d56d3
- Update to version 0.1.7
7d56d3
  - Add debian support for ipaclient
7d56d3
  - Added support for predefining client OTP using ipaclient_otp
7d56d3
  - ipatopologysegment: Store suffix for commands in command list
7d56d3
  - ipatopologysegment: Fail for missing entry with reinitialized
7d56d3
  - Utils scripts: ansible-ipa-[server,replica,client]-install
7d56d3
  - ipaserver_test,ipareplica_prepare: Do not return _pkcs12_file settings
7d56d3
  - ansible_freeipa_module: Add support for GSSAPI
7d56d3
  - ansible_ipa_client: Drop import of configure_nsswitch_database
7d56d3
  - New host management module
7d56d3
  - New hostgroup management module
7d56d3
  - ipagroup: Remove unused member_[present,absent] states
7d56d3
  - external-ca tests: Fix typo in inventory files
7d56d3
  - tests/external-signed-ca tests: Fix external-ca.sh to use proper serials
7d56d3
  - ipagroup: Rework to use same mechanisms as ipahostgroup module
7d56d3
  - ansible_freeipa_module: api_command should not have extra try clause
7d56d3
  - ansible_freeipa_module: compare_args_ipa needs to compare lists orderless
7d56d3
  - ansible_freeipa_module: New function api_check_param
7d56d3
  - ansible_freeipa_module: New functions module_params_get and _afm_convert
7d56d3
  - ansible_freeipa_module: Add missing to_text import for _afm_convert
7d56d3
  - ansible_freeipa_module: Convert tuple to list in compare_args_ipa
7d56d3
  - ansible_freeipa_module: New function api_get_realm
7d56d3
  - ipauser: User module extension
7d56d3
  - New sudocmd management module
7d56d3
  - New sudocmdgroup management module
7d56d3
  - ansible_freeipa_module: Convert int to string in compare_args_ipa
7d56d3
  - New pwpolicy management module
7d56d3
  - New hbacsvc (HBAC Service) management module
7d56d3
  - New hbacsvcgroup (HBAC Service Group) management module
7d56d3
  - ipagroup: Properly support IPA versions 4.6 and RHEL-7
7d56d3
  - ipagroup: Fix changed flag, new test cases
7d56d3
  - ipauser: Add info about version limitation of passwordexpiration
7d56d3
  - New hbacrule (HBAC Rule) management module
7d56d3
  - ipahostgroup: Fix changed flag, support IPA 4.6 on RHEL-7, new test cases
7d56d3
  - New sudorule (Sudo Rule) management module
7d56d3
  - ipauser: Support 'sn' alias of 'last' for surname
7d56d3
  - Update galaxy.yml: Update description, drop empty dependencies
7d56d3
  - Update ipauser.py: Fix typo in users.name description
7d56d3
  - ipaclient: Fix misspelled sssd options
7d56d3
  - ipauser: Return generated random password
7d56d3
  - ipahost: Return generated random password
7d56d3
  - Added context configuration to api_connect
7d56d3
  - ansible_freeipa_module: Better support for KRB5CCNAME environment variable
7d56d3
  - ipa[server,replica,client]: Add support for CentOS-8
7d56d3
  - ipahost: Extension to be able handle several hosts and all settings
7d56d3
  - Flake8 fixes
7d56d3
  - Documentation updates
7d56d3
  - Cleanup
7d56d3
  Resolves: RHBZ#1748986
7d56d3
7d56d3
* Fri Sep  6 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.6-4
7d56d3
- ansible_ipa_client: Drop import of configure_nsswitch_database
7d56d3
  (RHBZ#1748905)
7d56d3
7d56d3
* Wed Jul 31 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.6-3
7d56d3
- ipatopologysegment: Store suffix for commands in command list (RHBZ#1733547)
7d56d3
- ipatopologysegment: Fail for missing entry with reinitialized (RHBZ#1733559)
7d56d3
7d56d3
* Tue Jul 23 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.6-2
7d56d3
- Drop dirserv_cert_files key from utils/gen_module_docs.py for covscan
7d56d3
7d56d3
* Tue Jul 23 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.6-1
7d56d3
- update to version 0.1.6
7d56d3
  - Lots of documentation updates in READMEs and modules
7d56d3
  - library/ipaclient_get_otp: Enable force mode for host_add call (fixes #74)
7d56d3
  - Flake8 and pylint reated fixes
7d56d3
  - Fixed wrong path to CheckedIPAddress class in ipareplica_test
7d56d3
  - Remove unused ipaserver/library/ipaserver.py
7d56d3
  - No not use wildcard imports for modules
7d56d3
  - ipareplica: Add support for pki_config_override
7d56d3
  - ipareplica: Initialize dns.ip_addresses and dns.reverse_zones for dns setup
7d56d3
  - ipareplica_prepare: Properly initialize pin and cert_name variables
7d56d3
  - ipareplica: Fail with proper error messages
7d56d3
  - ipaserver: Properly set settings related to pkcs12 files
7d56d3
  - ipaclient: RawConfigParser is not always provided by six.moves.configparser
7d56d3
  - ipaclient_setup_nss: paths.GETENT is not available before
7d56d3
    freeipa-4.6.90.pre1
7d56d3
  - ipaserver_test: Initialize value from options.zonemgr
7d56d3
  - ipareplica_setup_custodia: create_replica only available in newer releases
7d56d3
  - ipaclient: Fix typo in dnsok assignment for ipaclient_setup_nss
7d56d3
  - ipa[server,replica]: Set _packages_adtrust for Ubuntu
7d56d3
  - New build script for galaxy release
7d56d3
  - New utils script to update module docs
7d56d3
- Changes from ansible-freeipa-0.1.5
7d56d3
  - Support for IPA 4.8.0
7d56d3
  - New user management module
7d56d3
  - New group management module
7d56d3
  - ipaserver: Support external signed CA
7d56d3
  - RHEL-8 specific vars files to be able to install needed modules
7d56d3
    automatically
7d56d3
  - ipareplica: Fixes for certmonger and kra setup
7d56d3
  - New tests folder
7d56d3
  - OTP related updates to README files
7d56d3
7d56d3
* Thu Jul  4 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.4-2
7d56d3
- ansible_ipa_client: Always set options.unattended (RHBZ#1726645)
7d56d3
- ipaserver_prepare: Properly report error, do show trace back (RHBZ#1726668)
7d56d3
- ipa[server,replica,client]: RHEL-8 specific vars files (RHBZ#1727095)
7d56d3
- ipatopology modules: Use ipaadmin_ prefix for principal and password
7d56d3
  (RHBZ#1727101)
7d56d3
7d56d3
* Mon Jun 17 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.4-1
7d56d3
- update to version 0.1.4
7d56d3
  - ipatopologysegment: Use commands, not command
7d56d3
7d56d3
* Mon Jun 17 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.3-1
7d56d3
- update to version 0.1.3
7d56d3
  - ipaclient_test: Fix Python2 decode use with Python3
7d56d3
  - Fixed: #86 (AttributeError: 'str' object has no attribute 'decode')
7d56d3
  - ipaclient_get_otp: Remove ansible_python_interpreter handling
7d56d3
  - ipaclient: Use omit (None) for password, keytab, no string length checks
7d56d3
  - ipaclient_join: Support to use ipaadmin_keytab without ipaclient_use_otp
7d56d3
  - ipaclient: Report error message if ipaclient_get_otp failed
7d56d3
  - Fixes #17 Improve how tasks manage package installation
7d56d3
  - ipareplica: The dm password is not needed for ipareplica_master_password
7d56d3
  - ipareplica: Use ipareplica_server if set
7d56d3
  - ipatopologysegment: Allow domain+ca suffix, new state: checked
7d56d3
  - Documentation updates
7d56d3
  - Cleanups
7d56d3
7d56d3
* Tue Jun 11 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.2-3
7d56d3
- bump release for functional test
7d56d3
7d56d3
* Tue Jun 11 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.2-2
7d56d3
- bump release for functional test
7d56d3
7d56d3
* Fri Jun  7 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.2-1
7d56d3
- update to version 0.1.2
7d56d3
  - Now a new Ansible Collection
7d56d3
  - Fix gssapi requirement for OTP: It is only needed if keytab is used with
7d56d3
    OTP now.
7d56d3
  - Fix wrong ansible argument types
7d56d3
  - Do not fail on textwrap for replica deployments with CA
7d56d3
  - Ansible lint and galaxy fixes
7d56d3
  - Disable automatic removal of replication agreements in uninstall
7d56d3
  - Enable freeipa-trust service if adtrust is enabled
7d56d3
  - Add support for hidden replica
7d56d3
  - New topology managament modules
7d56d3
  - Add support for pki_config_override
7d56d3
  - Fix host name setup in server deployment
7d56d3
  - Fix errors when ipaservers variable is not set
7d56d3
  - Fix ipaclient install role length typo
7d56d3
  - Cleanups
7d56d3
  
7d56d3
* Mon May  6 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.1-1
7d56d3
- Initial package