DAOSGCP-99 Added support for using transport certs

.gitignore

@@ -20,6 +20,7 @@ terraform.tfvars
 
 # Ignore terraform/examples/io500 active configuration symlink
 terraform/examples/io500/config/active_config.sh
+terraform/examples/io500/login
 
 # Ignore other files
 id_rsa*

docs/tutorials/example_daos_cluster.md

@@ -195,7 +195,8 @@ In order to begin using the storage you must issue a *format* command.
 To format the storage run
 
 ```bash
-dmg storage format
+sudo dmg storage format
+sudo dmg system query -v
 ```
 
 To learn more see [Storage Formatting](https://docs.daos.io/latest/admin/deployment/#storage-formatting)
@@ -209,31 +210,31 @@ Now that the system has been formatted you can create a Pool.
 First check to see how much free NVMe storage you have.
 
 ```bash
-dmg storage query usage
+sudo dmg storage query usage
 ```
 
-This will return something like
+This will return storage information for the servers.
+
+The output looks similar to
 
 ```
 Hosts            SCM-Total SCM-Free SCM-Used NVMe-Total NVMe-Free NVMe-Used
 -----            --------- -------- -------- ---------- --------- ---------
-daos-server-0001 107 GB    107 GB   0 %      3.2 TB     3.2 TB    0 %
+daos-server-0001 48 GB     48 GB    0 %      1.6 TB     1.6 TB    0 %
+daos-server-0002 48 GB     48 GB    0 %      1.6 TB     1.6 TB    0 %
+daos-server-0003 48 GB     48 GB    0 %      1.6 TB     1.6 TB    0 %
+daos-server-0004 48 GB     48 GB    0 %      1.6 TB     1.6 TB    0 %
 ```
 
-> If the values in the columns are showing zeros, wait for 1-2 minutes and run the command again.
->
-> Even though the `dmg storage format` command returned immediately it can sometimes take a few minutes for the storage system to be ready.
->
-> You will know it's ready when you no longer see zeros in the output > from the `dmg storage query usage` command.
 
-In the example output above there is one server with a total of 3.2TB > of free space.
+In the example output above there are 4 servers with a total of 6.4TB of free space.
 
-With that information you know you can create a 3TB pool.
+With that information you know you can safely create a 6TB pool.
 
 Create the pool.
 
 ```bash
-dmg pool create -z 3TB -t 3 -u ${USER} --label=daos_pool
+sudo dmg pool create -z 6TB -t 3 -u ${USER} --label=daos_pool
 ```
 
 For more information about pools see

images/daos-client-image.pkr.hcl

@@ -68,4 +68,18 @@ build {
     ]
   }
 
+  provisioner "file" {
+    source = "./scripts/cert_gen/sm_get_ca.sh"
+    destination = "/tmp/"
+  }
+
+  provisioner "shell" {
+    inline = [
+      "sudo mkdir -p /var/daos/cert_gen",
+      "sudo mv /tmp/sm_get_ca.sh /var/daos/cert_gen",
+      "sudo chown -R root:root /var/daos/cert_gen",
+      "sudo chmod +x /var/daos/cert_gen/*.sh"
+    ]
+  }
+
 }

images/daos-server-image.pkr.hcl

@@ -59,7 +59,7 @@ build {
   sources = ["source.googlecompute.daos-server-centos-7"]
 
   provisioner "shell" {
-    environment_vars = ["DAOS_REPO_BASE_URL=${var.daos_repo_base_url}", "DAOS_VERSION=${var.daos_version}", "DAOS_INSTALL_TYPE=server"]
+    environment_vars = ["DAOS_REPO_BASE_URL=${var.daos_repo_base_url}", "DAOS_VERSION=${var.daos_version}", "DAOS_INSTALL_TYPE=all"]
     execute_command  = "echo 'packer' | sudo -S env {{ .Vars }} {{ .Path }}"
     pause_before     = "5s"
     scripts          = [
@@ -68,4 +68,17 @@ build {
     ]
   }
 
+  provisioner "file" {
+    source = "./scripts/cert_gen"
+    destination = "/tmp/"
+  }
+
+  provisioner "shell" {
+    inline = [
+      "sudo mkdir -p /var/daos/",
+      "sudo mv /tmp/cert_gen /var/daos/",
+      "sudo chown -R root:root /var/daos/cert_gen",
+      "sudo chmod +x /var/daos/cert_gen/*.sh"
+    ]
+  }
 }

images/scripts/cert_gen/SConscript

@@ -0,0 +1,15 @@
+"""Build DAOS Certificate Generation"""
+import os
+
+def scons():
+    """Execute build"""
+    Import('env')
+
+    env.Install("$PREFIX/lib64/daos/certgen", ['admin.cnf',
+                                               'agent.cnf',
+                                               'ca.cnf',
+                                               'server.cnf',
+                                               'gen_certificates.sh'])
+
+if __name__ == "SCons.Script":
+    scons()

images/scripts/cert_gen/admin.cnf

@@ -0,0 +1,12 @@
+# OpenSSL client configuration file
+[ req ]
+prompt=no
+distinguished_name = distinguished_name
+basicConstraints = CA:FALSE
+
+[ distinguished_name ]
+organizationName = DAOS
+commonName = admin
+
+#In the future we can do username based certs for login
+#commonName = <username>

images/scripts/cert_gen/agent.cnf

@@ -0,0 +1,15 @@
+[ req ]
+prompt=no
+distinguished_name = distinguished_name
+basicConstraints = CA:FALSE
+#uncomment if you want to use per agent certificates
+#req_extensions = extensions
+
+[ distinguished_name ]
+organizationName = DAOS
+# Required value for commonName, do not change.
+commonName = agent
+
+[ extensions ]
+#uncomment if you want to use per agent certificates
+#subjectAltName = DNS:<node-hostname>,DNS:<node-domain>,IP:<IP Address>

images/scripts/cert_gen/ca.cnf

@@ -0,0 +1,50 @@
+ [ ca ]
+default_ca		= CA_daos
+
+[ CA_daos ]
+dir			= ./daosCA
+certs			= $dir/certs
+database		= $dir/index.txt
+serial			= $dir/serial.txt
+
+# Key and Certificate for the root
+certificate		= $dir/daosCA.crt
+private_key		= $dir/private/daosCA.key
+
+default_md		= sha512	# SAFE Crypto Requires SHA-512
+default_days		= 1095		# how long to certify for
+copy_extensions		= copy
+unique_subject		= no
+
+[ req ]
+prompt = no
+distinguished_name = ca_dn
+x509_extensions = ca_ext
+
+[ ca_dn ]
+organizationName 	= DAOS
+commonName		= DAOS CA
+
+[ ca_ext ]
+keyUsage = critical,digitalSignature,nonRepudiation,keyEncipherment,keyCertSign
+basicConstraints = critical,CA:true,pathlen:1
+
+[ signing_policy ]
+organizationName	= supplied
+commonName		= supplied
+
+[ signing_agent ]
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = clientAuth
+
+[ signing_server ]
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = serverAuth, clientAuth
+
+[ signing_admin ]
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = clientAuth
+
+[ signing_test ]
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = clientAuth