Define a new var to handle tls_subject (ansible-collections#497)

klando · c2main · web-flow · commit accfedf1b79b · 2021-10-22T17:22:43.000+02:00
Previously, the roles were incorrectly using the same parameter for tls_subject (for
web form/API) and tlsserversubject, thus the setup ending up being
incorrect.

Co-authored-by: Cédric Villemain &lt;Cedric.Villemain@Data-Bene.io&gt;
diff --git a/docs/UPGRADE.md b/docs/UPGRADE.md
@@ -24,10 +24,12 @@ This document provides an overview of all the changes that are needed to be appl
 
 The following properties are added in the `zabbix_agent` role.
 
+* `zabbix_agent_tls_subject = "{{ zabbix_agent_tlsservercertsubject }}"`
 * `zabbix_agent2_server = "{{ zabbix_agent_server }}"`
 * `zabbix_agent2_serveractive = "{{ zabbix_agent_serveractive }}"`
 * `zabbix_agent2_allow_key = "{{ zabbix_agent_allow_key }}"`
 * `zabbix_agent2_deny_key = "{{ zabbix_agent_deny_key }}"`
+* `zabbix_agent2_tls_subject = "{{ zabbix_agent2_tlsservercertsubject }}"`
 
 NOTE: The original properties can still be used but it's suggested to update to
 use the new ones.
@@ -47,6 +49,10 @@ new ones.
 
 #### Proxy
 
+The following properties are added in the `zabbix_proxy` role.
+
+* `zabbix_proxy_tls_subject = "{{ zabbix_proxy_tlsservercertsubject }}"`
+
 The following properties are renamed in the `zabbix_proxy` role.
 
 | From                       | To                              |
diff --git a/roles/zabbix_agent/defaults/main.yml b/roles/zabbix_agent/defaults/main.yml
@@ -148,6 +148,7 @@ zabbix_agent_tlscafile:
 zabbix_agent_tlscrlfile:
 zabbix_agent_tlsservercertissuer:
 zabbix_agent_tlsservercertsubject:
+zabbix_agent_tls_subject: "{{ zabbix_agent_tlsservercertsubject }}" # FIXME this is not correct and should be removed with 2.0.0, here only to prevent regression
 zabbix_agent_tlscertfile:
 zabbix_agent_tlskeyfile:
 zabbix_agent_tlspskidentity:
@@ -201,6 +202,7 @@ zabbix_agent2_tlscafile:
 zabbix_agent2_tlscrlfile:
 zabbix_agent2_tlsservercertissuer:
 zabbix_agent2_tlsservercertsubject:
+zabbix_agent2_tls_subject: "{{ zabbix_agent2_tlsservercertsubject }}" # FIXME this is not correct and should be removed with 2.0.0, here only to prevent regression
 zabbix_agent2_tlscertfile:
 zabbix_agent2_tlskeyfile:
 zabbix_agent2_tlspskidentity:
diff --git a/roles/zabbix_agent/tasks/api.yml b/roles/zabbix_agent/tasks/api.yml
@@ -52,7 +52,7 @@
     tls_psk: "{{ zabbix_agent_tlspsk_secret | default(omit) }}"
     tls_psk_identity: "{{ zabbix_agent_tlspskidentity | default(omit) }}"
     tls_issuer: "{{ zabbix_agent_tlsservercertissuer | default(omit) }}"
-    tls_subject: "{{ zabbix_agent_tlsservercertsubject | default(omit) }}"
+    tls_subject: "{{ zabbix_agent_tls_subject | default(omit) }}"
     tls_accept: "{{ zabbix_agent_tls_config[zabbix_agent_tlsaccept if zabbix_agent_tlsaccept else 'unencrypted'] }}"
     tls_connect: "{{ zabbix_agent_tls_config[zabbix_agent_tlsconnect if zabbix_agent_tlsconnect else 'unencrypted'] }}"
     validate_certs: "{{ zabbix_validate_certs | default(omit) }}"
@@ -92,7 +92,7 @@
     tls_psk: "{{ zabbix_agent2_tlspsk_secret | default(omit) }}"
     tls_psk_identity: "{{ zabbix_agent2_tlspskidentity | default(omit) }}"
     tls_issuer: "{{ zabbix_agent2_tlsservercertissuer | default(omit) }}"
-    tls_subject: "{{ zabbix_agent2_tlsservercertsubject | default(omit) }}"
+    tls_subject: "{{ zabbix_agent2_tls_subject | default(omit) }}"
     tls_accept: "{{ zabbix_agent_tls_config[zabbix_agent2_tlsaccept if zabbix_agent2_tlsaccept else 'unencrypted'] }}"
     tls_connect: "{{ zabbix_agent_tls_config[zabbix_agent2_tlsconnect if zabbix_agent2_tlsconnect else 'unencrypted'] }}"
     validate_certs: "{{ zabbix_validate_certs | default(omit) }}"
diff --git a/roles/zabbix_proxy/defaults/main.yml b/roles/zabbix_proxy/defaults/main.yml
@@ -140,6 +140,7 @@ zabbix_proxy_tlscafile:
 zabbix_proxy_tlscrlfile:
 zabbix_proxy_tlsservercertissuer:
 zabbix_proxy_tlsservercertsubject:
+zabbix_proxy_tls_subject: "{{ zabbix_proxy_tlsservercertsubject }}" # FIXME this is not correct and should be removed with 2.0.0, here only to prevent regression
 zabbix_proxy_tlscertfile:
 zabbix_proxy_tlskeyfile:
 zabbix_proxy_tlspskidentity:
diff --git a/roles/zabbix_proxy/tasks/main.yml b/roles/zabbix_proxy/tasks/main.yml
@@ -124,7 +124,7 @@
     interface: "{{ zabbix_proxy_interface }}"
     tls_psk: "{{ zabbix_proxy_tlspsk_secret | default(omit) }}"
     tls_psk_identity: "{{ zabbix_proxy_tlspskidentity | default(omit) }}"
-    tls_subject: "{{ zabbix_proxy_tlsservercertsubject | default(omit) }}"
+    tls_subject: "{{ zabbix_proxy_tls_subject | default(omit) }}"
     tls_accept: "{{ zabbix_proxy_tls_config[zabbix_proxy_tlsaccept if zabbix_proxy_tlsaccept else 'no_encryption'] }}"
     tls_connect: "{{ zabbix_proxy_tls_config[zabbix_proxy_tlsconnect if zabbix_proxy_tlsconnect else 'no_encryption'] }}"
     validate_certs: "{{ zabbix_validate_certs | default(omit) }}"
