feat(trustee_quadlet): add Trustee quadlet deployment

The deployment of Trustee server includes quadlet and associated
configurations.

Signed-off-by: Li Tian <litian@redhat.com>

Author: litian1992

.ansible-lint

@@ -21,6 +21,6 @@ exclude_paths:
   - .markdownlint.yaml
   - examples/roles/
 mock_roles:
-  - linux-system-roles.template
+  - linux-system-roles.trustee_server
 supported_ansible_also:
   - "2.14.0"

README.md

@@ -1,10 +1,10 @@
-# Role Name
+# trustee_server
 
-[![ansible-lint.yml](https://github.com/linux-system-roles/template/actions/workflows/ansible-lint.yml/badge.svg)](https://github.com/linux-system-roles/template/actions/workflows/ansible-lint.yml) [![ansible-test.yml](https://github.com/linux-system-roles/template/actions/workflows/ansible-test.yml/badge.svg)](https://github.com/linux-system-roles/template/actions/workflows/ansible-test.yml) [![codespell.yml](https://github.com/linux-system-roles/template/actions/workflows/codespell.yml/badge.svg)](https://github.com/linux-system-roles/template/actions/workflows/codespell.yml) [![markdownlint.yml](https://github.com/linux-system-roles/template/actions/workflows/markdownlint.yml/badge.svg)](https://github.com/linux-system-roles/template/actions/workflows/markdownlint.yml) [![qemu-kvm-integration-tests.yml](https://github.com/linux-system-roles/template/actions/workflows/qemu-kvm-integration-tests.yml/badge.svg)](https://github.com/linux-system-roles/template/actions/workflows/qemu-kvm-integration-tests.yml) [![shellcheck.yml](https://github.com/linux-system-roles/template/actions/workflows/shellcheck.yml/badge.svg)](https://github.com/linux-system-roles/template/actions/workflows/shellcheck.yml) [![tft.yml](https://github.com/linux-system-roles/template/actions/workflows/tft.yml/badge.svg)](https://github.com/linux-system-roles/template/actions/workflows/tft.yml) [![tft_citest_bad.yml](https://github.com/linux-system-roles/template/actions/workflows/tft_citest_bad.yml/badge.svg)](https://github.com/linux-system-roles/template/actions/workflows/tft_citest_bad.yml) [![woke.yml](https://github.com/linux-system-roles/template/actions/workflows/woke.yml/badge.svg)](https://github.com/linux-system-roles/template/actions/workflows/woke.yml)
+[![ansible-lint.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/ansible-lint.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/ansible-lint.yml) [![ansible-test.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/ansible-test.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/ansible-test.yml) [![codespell.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/codespell.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/codespell.yml) [![markdownlint.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/markdownlint.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/markdownlint.yml) [![qemu-kvm-integration-tests.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/qemu-kvm-integration-tests.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/qemu-kvm-integration-tests.yml) [![shellcheck.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/shellcheck.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/shellcheck.yml) [![tft.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/tft.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/tft.yml) [![tft_citest_bad.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/tft_citest_bad.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/tft_citest_bad.yml) [![woke.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/woke.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/woke.yml)
 
-![template](https://github.com/linux-system-roles/template/workflows/tox/badge.svg)
+![trustee_server](https://github.com/linux-system-roles/trustee_server/workflows/tox/badge.svg)
 
-A template for an ansible role that configures some GNU/Linux subsystem or
+A trustee_server for an ansible role that configures some GNU/Linux subsystem or
 service. A brief description of the role goes here.
 
 ## Requirements
@@ -34,12 +34,12 @@ A description of all input variables (i.e. variables that are defined in
 `defaults/main.yml`) for the role should go here as these form an API of the
 role.  Each variable should have its own section e.g.
 
-### template_foo
+### trustee_server_foo
 
 This variable is required.  It is a string that lists the foo of the role.
 There is no default value.
 
-### template_bar
+### trustee_server_bar
 
 This variable is optional.  It is a boolean that tells the role to disable bar.
 The default value is `true`.
@@ -53,8 +53,8 @@ the lifetime.
 Example of setting the variables:
 
 ```yaml
-template_foo: "oof"
-template_bar: false
+trustee_server_foo: "oof"
+trustee_server_bar: false
 ```
 
 ## Variables Exported by the Role
@@ -63,12 +63,12 @@ This section is optional.  Some roles may export variables for playbooks to
 use later.  These are analogous to "return values" in Ansible modules.  For
 example, if a role performs some action that will require a system reboot, but
 the user wants to defer the reboot, the role might set a variable like
-`template_reboot_needed: true` that the playbook can use to reboot at a more
+`trustee_server_reboot_needed: true` that the playbook can use to reboot at a more
 convenient time.
 
 Example:
 
-### template_reboot_needed
+### trustee_server_reboot_needed
 
 Default `false` - if `true`, this means a reboot is needed to apply the changes
 made by the role
@@ -79,13 +79,13 @@ Including an example of how to use your role (for instance, with variables
 passed in as parameters) is always nice for users too:
 
 ```yaml
-- name: Manage the template subsystem
+- name: Manage the trustee_server subsystem
   hosts: all
   vars:
-    template_foo: "foo foo!"
-    template_bar: false
+    trustee_server_foo: "foo foo!"
+    trustee_server_bar: false
   roles:
-    - linux-system-roles.template
+    - linux-system-roles.trustee_server
 ```
 
 More examples can be provided in the [`examples/`](examples) directory. These

contributing.md

@@ -1,4 +1,4 @@
-# Contributing to the template Linux System Role
+# Contributing to the trustee_server Linux System Role
 
 ## Where to start
 
@@ -12,12 +12,12 @@ This has all of the common information that all role developers need:
 * How to create git commits and submit pull requests
 
 **Bugs and needed implementations** are listed on
-[Github Issues](https://github.com/linux-system-roles/template/issues).
+[Github Issues](https://github.com/linux-system-roles/trustee_server/issues).
 Issues labeled with
-[**help wanted**](https://github.com/linux-system-roles/template/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22)
+[**help wanted**](https://github.com/linux-system-roles/trustee_server/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22)
 are likely to be suitable for new contributors!
 
-**Code** is managed on [Github](https://github.com/linux-system-roles/template), using
+**Code** is managed on [Github](https://github.com/linux-system-roles/trustee_server), using
 [Pull Requests](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-requests).
 
 ## Running CI Tests Locally

defaults/main.yml

@@ -3,6 +3,23 @@
 # Here is the right place to put the role's input variables.
 # This file also serves as a documentation for such a variables.
 
-# Examples of role input variables:
-template_foo: foo
-template_bar: true
+# Trustee Server Components Quadlet repository configuration
+trustee_server_trustee: true
+trustee_server_quadlet_repo_url: "https://github.com/litian1992/trustee-quadlet-rhel.git"
+trustee_server_quadlet_repo_path: "quadlet"
+trustee_server_quadlet_repo_branch: "main"
+trustee_server_quadlet_install_dir: "/etc/containers/systemd"
+trustee_attestation_server_config_dir: "/etc/trustee"
+
+# Secret registration service configuration
+trustee_server_secret_registration_service_enabled: false
+
+# SSL certificate generation (used with -config trustee_server.conf)
+trustee_server_ssl_bits: 4096
+trustee_server_ssl_md: sha256
+trustee_server_ssl_days: 3650
+trustee_server_ssl_cn: trustee-server
+trustee_server_ssl_org: Trustee
+trustee_server_ssl_country: US
+trustee_server_ssl_cert_path: /etc/trustee/kbs/server.crt
+trustee_server_ssl_key_path: /etc/trustee/kbs/server.key

examples/simple.yml

@@ -1,9 +1,13 @@
 # SPDX-License-Identifier: MIT
 ---
-- name: Example template role invocation
+- name: Deploy Trustee Server Components using Podman Quadlets from GitHub repository
   hosts: all
   vars:
-    template_foo: example variable value
-    template_bar: false
+    trustee_server_trustee: true
+    trustee_server_quadlet_repo_url: "https://github.com/litian1992/trustee-quadlet-rhel.git"
+    trustee_server_quadlet_repo_path: "quadlet"
+    trustee_server_quadlet_repo_branch: "main"
+    trustee_server_quadlet_install_dir: "/etc/containers/systemd"
+    trustee_server_secret_registration_service_enabled: false
   roles:
-    - linux-system-roles.template
+    - linux-system-roles.trustee-server

handlers/main.yml

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MIT
 ---
-- name: Handler for template to restart services
+- name: Handler for trustee_server to restart services
   service:
     name: "{{ item }}"
     state: restarted
-  loop: "{{ __template_services }}"
+  loop: "{{ __trustee_server_services }}"

meta/main.yml

@@ -1,9 +1,9 @@
 # SPDX-License-Identifier: MIT
 ---
 galaxy_info:
-  author: John Doe <jdoe@corp.com>
-  description: Basic template for Linux system roles
-  company: John Doe, Inc.
+  author: Li Tian <litian@redhat.com>
+  description: Deploy Trustee Server Components using Podman Quadlets from GitHub repository
+  company: Red Hat, Inc.
   license: MIT
   min_ansible_version: "2.9"
   platforms:
@@ -14,13 +14,15 @@ galaxy_info:
       versions:
         - "9"
   galaxy_tags:
+    - trustee
+    - attestation
     - el9
     - el10
     - fedora
     # Support running this role in system container environments, and enable
     # tests. Remove if not applicable.
-    - container
+    # - container
     # Support running this role during container builds (mostly useful for
     # bootc), and enable tests. Remove if not applicable.
-    - containerbuild
+    # - containerbuild
 dependencies: []

plans/README-plans.md

@@ -1,6 +1,6 @@
 # Introduction CI Testing Plans
 
-Linux System Roles CI runs [tmt](https://tmt.readthedocs.io/en/stable/index.html) test plans in [Testing farm](https://docs.testing-farm.io/Testing%20Farm/0.1/index.html) with the [tft.yml](https://github.com/linux-system-roles/template/blob/main/.github/workflows/tft.yml) GitHub workflow.
+Linux System Roles CI runs [tmt](https://tmt.readthedocs.io/en/stable/index.html) test plans in [Testing farm](https://docs.testing-farm.io/Testing%20Farm/0.1/index.html) with the [tft.yml](https://github.com/linux-system-roles/trustee_server/blob/main/.github/workflows/tft.yml) GitHub workflow.
 
 The `plans/test_playbooks_parallel.fmf` plan is a test plan that runs test playbooks in parallel on multiple managed nodes.
 `plans/test_playbooks_parallel.fmf` is generated centrally from `https://github.com/linux-system-roles/.github/`.
@@ -16,7 +16,7 @@ The `plans/test_playbooks_parallel.fmf` plan does the following steps:
 2. Does the required preparation on systems.
 3. For the given role and the given PR, runs the general test from [test.sh](https://github.com/linux-system-roles/tft-tests/blob/main/tests/general/test.sh).
 
-The [tft.yml](https://github.com/linux-system-roles/template/blob/main/.github/workflows/tft.yml) workflow runs the above plan and uploads the results to our Fedora storage for public access.
+The [tft.yml](https://github.com/linux-system-roles/trustee_server/blob/main/.github/workflows/tft.yml) workflow runs the above plan and uploads the results to our Fedora storage for public access.
 This workflow uses Testing Farm's Github Action [Schedule tests on Testing Farm](https://github.com/marketplace/actions/schedule-tests-on-testing-farm).
 
 ## Running Tests
@@ -47,7 +47,7 @@ You can run tests locally with the `tmt try` cli or remotely in Testing Farm.
     $ TESTING_FARM_API_TOKEN=<your_api_token> \
         testing-farm request --pipeline-type="tmt-multihost" \
         --plan-filter="tag:playbooks_parallel" \
-        --git-url "https://github.com/<my_user>/template" \
+        --git-url "https://github.com/<my_user>/trustee_server" \
         --git-ref "<my_branch>" \
         --compose CentOS-Stream-9 \
         -e "SYSTEM_ROLES_ONLY_TESTS=tests_default.yml" \

tasks/main.yml

@@ -4,24 +4,11 @@
   include_tasks: tasks/set_vars.yml
 
 # Examples of some tasks:
-- name: Ensure required packages are installed
-  package:
-    name: "{{ __template_packages }}"
-    state: present
-    use: "{{ (__template_is_ostree | d(false)) |
-             ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
+- name: Deploy Trustee Server Components using Podman Quadlets
+  include_tasks: trustee_quadlet.yml
+  when: trustee_server_trustee | bool
 
-- name: Ensure required services are enabled and started
-  service:
-    name: "{{ item }}"
-    state: started
-    enabled: true
-  loop: "{{ __template_services }}"
+- name: Create Secret Registration Service
+  include_tasks: secret_registration_service.yml
+  when: trustee_server_secret_registration_service_enabled | bool
 
-- name: Generate /etc/{{ __template_foo_config }}
-  template:
-    src: "{{ __template_foo_config }}.j2"
-    dest: /etc/{{ __template_foo_config }}
-    backup: true
-    mode: "0400"
-  notify: Handler for template to restart services

tasks/secret_registration_service.yml

@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: MIT
+---