community / community.general / 6.6.8 / module / java_keystore Create a Java keystore in JKS format Authors: Guillaume Grossetie (@Mogztter), quidame (@quidame)community.general.java_keystore (6.6.8) — module
Install with ansible-galaxy collection install community.general:==6.6.8
collections: - name: community.general version: 6.6.8
Bundle a x509 certificate and its private key into a Java Keystore in JKS format.
- name: Create a keystore for the given certificate/private key pair (inline) community.general.java_keystore: name: example certificate: | -----BEGIN CERTIFICATE----- h19dUZ2co2fI/ibYiwxWk4aeNE6KWvCaTQOMQ8t6Uo2XKhpL/xnjoAgh1uCQN/69 MG+34+RhUWzCfdZH7T8/qDxJw2kEPKluaYh7KnMsba+5jHjmtzix5QIDAQABo4IB -----END CERTIFICATE----- private_key: | -----BEGIN RSA PRIVATE KEY----- DBVFTEVDVFJJQ0lURSBERSBGUkFOQ0UxFzAVBgNVBAsMDjAwMDIgNTUyMDgxMzE3 GLlDNMw/uHyME7gHFsqJA7O11VY6O5WQ4IDP3m/s5ZV6s+Nn6Lerz17VZ99 -----END RSA PRIVATE KEY----- password: changeit dest: /etc/security/keystore.jks
- name: Create a keystore for the given certificate/private key pair (with files on controller) community.general.java_keystore: name: example certificate: "{{ lookup('file', '/path/to/certificate.crt') }}" private_key: "{{ lookup('file', '/path/to/private.key') }}" password: changeit dest: /etc/security/keystore.jks
- name: Create a keystore for the given certificate/private key pair (with files on target host) community.general.java_keystore: name: snakeoil certificate_path: /etc/ssl/certs/ssl-cert-snakeoil.pem private_key_path: /etc/ssl/private/ssl-cert-snakeoil.key password: changeit dest: /etc/security/keystore.jks
dest: description: - Absolute path of the generated keystore. required: true type: path mode: description: - Mode the file should be. required: false type: raw name: description: - Name of the certificate in the keystore. - If the provided name does not exist in the keystore, the module will re-create the keystore. This behavior changed in community.general 3.0.0, before that the module would fail when the name did not match. required: true type: str force: default: false description: - Keystore is created even if it already exists. type: bool group: description: - Name of the group that should own jks file. required: false type: str owner: description: - Name of the user that should own jks file. required: false type: str serole: description: - The role part of the SELinux filesystem object context. - When set to V(_default), it will use the C(role) portion of the policy if available. type: str setype: description: - The type part of the SELinux filesystem object context. - When set to V(_default), it will use the C(type) portion of the policy if available. type: str seuser: description: - The user part of the SELinux filesystem object context. - By default it uses the V(system) policy, where applicable. - When set to V(_default), it will use the C(user) portion of the policy if available. type: str selevel: description: - The level part of the SELinux filesystem object context. - This is the MLS/MCS attribute, sometimes known as the C(range). - When set to V(_default), it will use the C(level) portion of the policy if available. type: str password: description: - Password that should be used to secure the keystore. - If the provided password fails to unlock the keystore, the module will re-create the keystore with the new passphrase. This behavior changed in community.general 3.0.0, before that the module would fail when the password did not match. required: true type: str attributes: aliases: - attr description: - The attributes the resulting filesystem object should have. - To get supported flags look at the man page for I(chattr) on the target system. - This string should contain the attributes in the same order as the one displayed by I(lsattr). - The C(=) operator is assumed as default, otherwise C(+) or C(-) operators need to be included in the string. type: str version_added: '2.3' version_added_collection: ansible.builtin certificate: description: - Content of the certificate used to create the keystore. - If the fingerprint of the provided certificate does not match the fingerprint of the certificate bundled in the keystore, the keystore is regenerated with the provided certificate. - Exactly one of I(certificate) or I(certificate_path) is required. type: str private_key: description: - Content of the private key used to create the keystore. - Exactly one of I(private_key) or I(private_key_path) is required. type: str ssl_backend: choices: - openssl - cryptography default: openssl description: - Backend for loading private keys and certificates. type: str version_added: 3.1.0 version_added_collection: community.general keystore_type: choices: - jks - pkcs12 description: - Type of the Java keystore. - When this option is omitted and the keystore doesn't already exist, the behavior follows C(keytool)'s default store type which depends on Java version; C(pkcs12) since Java 9 and C(jks) prior (may also be C(pkcs12) if new default has been backported to this version). - When this option is omitted and the keystore already exists, the current type is left untouched, unless another option leads to overwrite the keystore (in that case, this option behaves like for keystore creation). - When I(keystore_type) is set, the keystore is created with this type if it doesn't already exist, or is overwritten to match the given type in case of mismatch. type: str version_added: 3.3.0 version_added_collection: community.general unsafe_writes: default: false description: - Influence when to use atomic operation to prevent data corruption or inconsistent reads from the target filesystem object. - By default this module uses atomic operations to prevent data corruption or inconsistent reads from the target filesystem objects, but sometimes systems are configured or just broken in ways that prevent this. One example is docker mounted filesystem objects, which cannot be updated atomically from inside the container and can only be written in an unsafe manner. - This option allows Ansible to fall back to unsafe methods of updating filesystem objects when atomic operations fail (however, it doesn't force Ansible to perform unsafe writes). - IMPORTANT! Unsafe writes are subject to race conditions and can lead to data corruption. type: bool version_added: '2.2' version_added_collection: ansible.builtin certificate_path: description: - Location of the certificate used to create the keystore. - If the fingerprint of the provided certificate does not match the fingerprint of the certificate bundled in the keystore, the keystore is regenerated with the provided certificate. - Exactly one of I(certificate) or I(certificate_path) is required. type: path version_added: 3.0.0 version_added_collection: community.general private_key_path: description: - Location of the private key used to create the keystore. - Exactly one of I(private_key) or I(private_key_path) is required. type: path version_added: 3.0.0 version_added_collection: community.general private_key_passphrase: description: - Passphrase used to read the private key, if required. type: str version_added: 0.2.0 version_added_collection: community.general
cmd: description: Executed command to get action done returned: changed and failure sample: /usr/bin/openssl x509 -noout -in /tmp/user/1000/tmp8jd_lh23 -fingerprint -sha256 type: str err: description: Output from stderr of keytool/openssl command after error of given command. returned: failure sample: 'Keystore password is too short - must be at least 6 characters ' type: str msg: description: Output from stdout of keytool/openssl command after execution of given command or an error. returned: changed and failure sample: Unable to find the current certificate fingerprint in ... type: str rc: description: keytool/openssl command execution return value returned: changed and failure sample: '0' type: int