6.6. 使用 RHEL 系统角色部署 Keylime 服务器

流程

1. 创建定义所需角色的 playbook:

   1. 创建新 YAML 文件，并在文本编辑器中打开，例如：

      # vi keylime-playbook.yml

      Copy to Clipboard Toggle word wrap

   2. 插入以下内容：

      ---
      - name: Manage keylime servers
        hosts: all
        vars:
          keylime_server_verifier_ip: "{{ ansible_host }}"
          keylime_server_registrar_ip: "{{ ansible_host }}"
          keylime_server_verifier_tls_dir: <ver_tls_directory>
          keylime_server_verifier_server_cert: <ver_server_certfile>
          keylime_server_verifier_server_key: <ver_server_key>
          keylime_server_verifier_server_key_passphrase: <ver_server_key_passphrase>
          keylime_server_verifier_trusted_client_ca: <ver_trusted_client_ca_list>
          keylime_server_verifier_client_cert: <ver_client_certfile>
          keylime_server_verifier_client_key: <ver_client_key>
          keylime_server_verifier_client_key_passphrase: <ver_client_key_passphrase>
          keylime_server_verifier_trusted_server_ca: <ver_trusted_server_ca_list>
          keylime_server_registrar_tls_dir: <reg_tls_directory>
          keylime_server_registrar_server_cert: <reg_server_certfile>
          keylime_server_registrar_server_key: <reg_server_key>
          keylime_server_registrar_server_key_passphrase: <reg_server_key_passphrase>
          keylime_server_registrar_trusted_client_ca: <reg_trusted_client_ca_list>
        roles:
          - rhel-system-roles.keylime_server

      Copy to Clipboard Toggle word wrap

      您可以在 keylime_server RHEL 系统角色的变量 中找到更多有关变量的信息。

2. 运行 playbook：

   $ ansible-playbook <keylime-playbook.yml>

   Copy to Clipboard Toggle word wrap

验证

1. 检查 keylime_verifier 服务是否活跃并在受管主机上运行：

   # systemctl status keylime_verifier
   ● keylime_verifier.service - The Keylime verifier
        Loaded: loaded (/usr/lib/systemd/system/keylime_verifier.service; disabled; vendor preset: disabled)
        Active: active (running) since Wed 2022-11-09 10:10:08 EST; 1min 45s ago

   Copy to Clipboard Toggle word wrap

2. 检查 keylime_registrar 服务是否活跃且在运行：

   # systemctl status keylime_registrar
   ● keylime_registrar.service - The Keylime registrar service
        Loaded: loaded (/usr/lib/systemd/system/keylime_registrar.service; disabled; vendor preset: disabled)
        Active: active (running) since Wed 2022-11-09 10:10:17 EST; 1min 42s ago
   ...

   Copy to Clipboard Toggle word wrap