X-Git-Url: https://gerrit.opnfv.org/gerrit/gitweb?a=blobdiff_plain;f=puppet%2Fextraconfig%2Ftls%2Ffreeipa-enroll.yaml;h=9c6a402d9c91bec0140e4f1bbc405139425fd2a5;hb=HEAD;hp=44be7c657c25a82657c94fa55f0f5ee01180b6e1;hpb=08bc584cd600626bec5e1aeef0ddf91a49d1eb9c;p=apex-tripleo-heat-templates.git

diff --git a/puppet/extraconfig/tls/freeipa-enroll.yaml b/puppet/extraconfig/tls/freeipa-enroll.yaml
index 44be7c65..9c6a402d 100644
--- a/puppet/extraconfig/tls/freeipa-enroll.yaml
+++ b/puppet/extraconfig/tls/freeipa-enroll.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2015-10-15
+heat_template_version: pike
 
 description: Enroll nodes to FreeIPA
 
@@ -13,10 +13,12 @@ parameters:
     type: string
 
   FreeIPAOTP:
+    default: ''
     description: 'OTP that will be used for FreeIPA enrollment'
     type: string
     hidden: true
   FreeIPAServer:
+    default: ''
     description: 'FreeIPA server DNS name'
     type: string
   FreeIPAIPAddress:
@@ -36,18 +38,27 @@ resources:
         - name: ipa_ip
       config: |
         #!/bin/sh
-        sed -i "/${ipa_server}/d" /etc/hosts
-        # Optionally add the FreeIPA server IP to /etc/hosts
-        if [ -n "${ipa_ip}" ]; then
-            echo "${ipa_ip}    ${ipa_server}" >> /etc/hosts
+        # If no IPA server was given as a parameter, it will be assumed from
+        # DNS.
+        if [ -n "${ipa_server}" ]; then
+            sed -i "/${ipa_server}/d" /etc/hosts
+            # Optionally add the FreeIPA server IP to /etc/hosts
+            if [ -n "${ipa_ip}" ]; then
+                echo "${ipa_ip}    ${ipa_server}" >> /etc/hosts
+            fi
         fi
         # Set the node's domain if needed
         if [ ! $(hostname -f | grep "${ipa_domain}$") ]; then
             hostnamectl set-hostname "$(hostname).${ipa_domain}"
         fi
         yum install -y ipa-client
-        # Enroll. If there is already keytab, we have already done this.
+        # Enroll. If there is already keytab, we have already done this. If
+        # this node hasn't enrolled and the OTP is missing, fail.
         if [ ! -f /etc/krb5.keytab ]; then
+            if [ -z "${otp}" ]; then
+                echo "OTP is missing"
+                exit 1
+            fi
             ipa-client-install --server ${ipa_server} -w ${otp} \
                 --domain=${ipa_domain} -U
         fi