---

#
# Generate the Presto Server cert/key
#
- name: Setup the server certificate/key
  block:
  - name: Generate an RSA private key for Presto
    openssl_privatekey:
      size: 2048
      type: RSA
      path: "{{ certificates_dir.path }}/presto_server.key"

  - name: Generate the Presto server CSR
    openssl_csr:
      path: "{{ certificates_dir.path }}/presto_server.csr"
      privatekey_path: "{{ certificates_dir.path }}/presto_server.key"
      common_name: "*.presto-nodes"
      subject_alt_name: "DNS:*.presto-nodes.{{ meta.namespace }}.svc.cluster.local,DNS:presto,DNS:*.presto-nodes"
      basicConstraints:
      - 'CA:FALSE'
      basicConstraints_critical: false
      key_usage:
      - digitalSignature
      - keyEncipherment
      extended_key_usage:
      - serverAuth

  - name: Generate the Presto server certificate
    openssl_certificate:
      path: "{{ certificates_dir.path }}/presto_server.crt"
      privatekey_path: "{{ certificates_dir.path }}/presto_server.key"
      csr_path: "{{ certificates_dir.path }}/presto_server.csr"
      provider: ownca
      ownca_path: "{{ certificates_dir.path }}/ca.crt"
      ownca_privatekey_path: "{{ certificates_dir.path }}/ca.key"
      selfsigned_digest: sha256
  when: not presto_tls_secret_exists

#
# Generate the Presto Client cert/key to enable client-side authentication
#
- name: Setup the client certificate/key
  block:
  - name: Generate an RSA private key for the Presto client
    openssl_privatekey:
      size: 2048
      type: RSA
      path: "{{ certificates_dir.path }}/presto_client.key"

  - name: Generate the Presto client CSR
    openssl_csr:
      path: "{{ certificates_dir.path }}/presto_client.csr"
      privatekey_path: "{{ certificates_dir.path }}/presto_client.key"
      common_name: "presto-clients"
      basicConstraints:
      - 'CA:FALSE'
      basicConstraints_critical: false
      key_usage:
      - digitalSignature
      - keyEncipherment
      extended_key_usage:
      - clientAuth

  - name: Generate the Presto client certificate
    openssl_certificate:
      path: "{{ certificates_dir.path }}/presto_client.crt"
      privatekey_path: "{{ certificates_dir.path }}/presto_client.key"
      csr_path: "{{ certificates_dir.path }}/presto_client.csr"
      provider: ownca
      ownca_path: "{{ certificates_dir.path }}/ca.crt"
      ownca_privatekey_path: "{{ certificates_dir.path }}/ca.key"
      selfsigned_digest: sha256
  when: not presto_auth_secret_exists or not presto_hive_tls_secret_exists
