<commit_before>update_cnames:
  cmd.run:
    - name: /opt/salt/scripts/update_cnames.sh
    - env:
        - FPW: {{salt['pillar.get']('freeipa:password')}}
        - DOMAIN: {{salt['pillar.get']('freeipa:domain')}}
        - REALM: {{salt['pillar.get']('freeipa:realm')}}
        - ADMIN_USER: {{salt['pillar.get']('freeipa:admin_user')}}
    - require:
        - file: /opt/salt/scripts/update_cnames.sh

one_week_next_update_grace_period:
  cmd.run:
    - names:
      - service pki-tomcatd@pki-tomcat stop
      - sed -i 's/^ca[.]crl[.]MasterCRL[.]nextUpdateGracePeriod=.*/ca.crl.MasterCRL.nextUpdateGracePeriod=10080/' /var/lib/pki/pki-tomcat/ca/conf/CS.cfg
      - service pki-tomcatd@pki-tomcat start
    - unless: grep "^ca[.]crl[.]MasterCRL[.]nextUpdateGracePeriod=10080$" /var/lib/pki/pki-tomcat/ca/conf/CS.cfg

/usr/lib/python2.7/site-packages/ipaserver/plugins/getkeytab.py:
  file.managed:
    - makedirs: True
    - user: root
    - group: root
    - mode: 644
    - source: salt://freeipa/scripts/getkeytab.py
    - onlyif: test -f /etc/ipa/default.conf

restart_freeipa_after_plugin_change:
  service.running:
    - name: ipa
    - onlyif: test -f /etc/ipa/default.conf
    - watch:
      - file: /usr/lib/python2.7/site-packages/ipaserver/plugins/getkeytab.py

set_number_of_krb5kdc_workers:
  file.replace:
    - name: /etc/sysconfig/krb5kdc
    - pattern: ^KRB5KDC_ARGS=.*
    - repl: KRB5KDC_ARGS='-w 100'
    - unless: grep "^KRB5KDC_ARGS='-w 100'$" /etc/sysconfig/krb5kdc

restart_krb5kdc:
  service.running:
    - name: krb5kdc
    - watch:
      - file: /etc/sysconfig/krb5kdc

/etc/httpd/conf.d/ipa-rewrite.conf:
  file.managed:
    - template: jinja
    - user: root
    - group: root
    - mode: 644
    - source: salt://freeipa/templates/ipa-rewrite.conf.j2

/etc/httpd/conf/httpd-log-filter.sh:
  file.managed:
    - makedirs: True
    - user: root
    - group: root
    - mode: 700
    - source: salt://freeipa/scripts/httpd-log-filter.sh

configure_httpd_log_filter:
  file.replace:
    - name: /etc/httpd/conf/httpd.conf
    - pattern: ^ErrorLog.*
    - repl: ErrorLog "|/etc/httpd/conf/httpd-log-filter.sh"
    - unless: grep "httpd-log-filter.sh" /etc/httpd/conf/httpd.conf

disable_http_trace:
  file.append:
    - name: /etc/httpd/conf/httpd.conf
    - text: 'TraceEnable Off'

restart_httpd:
  service.running:
    - name: httpd
    - watch:
      - file: /etc/httpd/conf.d/ipa-rewrite.conf
      - file: /etc/httpd/conf/httpd.conf<commit_msg>CB-7557 configure entry_cache_timeout for SSSD on FreeIPA The default value of entry_cache_timeout is 90 mins and once a user is cached it may not be able to SSH to the FreeIPA node with the provided SSH key that is stored in UMS. This config is already set to 30 seconds on the Data Lake and Data Hub clusters. As part of this PR I'm making it consistent with the other clusters. It should not cause any performance issues since users are not expected to SSH to the FreeIPA instances that often. Mostly never.<commit_after>update_cnames:
  cmd.run:
    - name: /opt/salt/scripts/update_cnames.sh
    - env:
        - FPW: {{salt['pillar.get']('freeipa:password')}}
        - DOMAIN: {{salt['pillar.get']('freeipa:domain')}}
        - REALM: {{salt['pillar.get']('freeipa:realm')}}
        - ADMIN_USER: {{salt['pillar.get']('freeipa:admin_user')}}
    - require:
        - file: /opt/salt/scripts/update_cnames.sh

one_week_next_update_grace_period:
  cmd.run:
    - names:
      - service pki-tomcatd@pki-tomcat stop
      - sed -i 's/^ca[.]crl[.]MasterCRL[.]nextUpdateGracePeriod=.*/ca.crl.MasterCRL.nextUpdateGracePeriod=10080/' /var/lib/pki/pki-tomcat/ca/conf/CS.cfg
      - service pki-tomcatd@pki-tomcat start
    - unless: grep "^ca[.]crl[.]MasterCRL[.]nextUpdateGracePeriod=10080$" /var/lib/pki/pki-tomcat/ca/conf/CS.cfg

/usr/lib/python2.7/site-packages/ipaserver/plugins/getkeytab.py:
  file.managed:
    - makedirs: True
    - user: root
    - group: root
    - mode: 644
    - source: salt://freeipa/scripts/getkeytab.py
    - onlyif: test -f /etc/ipa/default.conf

restart_freeipa_after_plugin_change:
  service.running:
    - name: ipa
    - onlyif: test -f /etc/ipa/default.conf
    - watch:
      - file: /usr/lib/python2.7/site-packages/ipaserver/plugins/getkeytab.py

set_number_of_krb5kdc_workers:
  file.replace:
    - name: /etc/sysconfig/krb5kdc
    - pattern: ^KRB5KDC_ARGS=.*
    - repl: KRB5KDC_ARGS='-w 100'
    - unless: grep "^KRB5KDC_ARGS='-w 100'$" /etc/sysconfig/krb5kdc

restart_krb5kdc:
  service.running:
    - name: krb5kdc
    - watch:
      - file: /etc/sysconfig/krb5kdc

/etc/httpd/conf.d/ipa-rewrite.conf:
  file.managed:
    - template: jinja
    - user: root
    - group: root
    - mode: 644
    - source: salt://freeipa/templates/ipa-rewrite.conf.j2

/etc/httpd/conf/httpd-log-filter.sh:
  file.managed:
    - makedirs: True
    - user: root
    - group: root
    - mode: 700
    - source: salt://freeipa/scripts/httpd-log-filter.sh

configure_httpd_log_filter:
  file.replace:
    - name: /etc/httpd/conf/httpd.conf
    - pattern: ^ErrorLog.*
    - repl: ErrorLog "|/etc/httpd/conf/httpd-log-filter.sh"
    - unless: grep "httpd-log-filter.sh" /etc/httpd/conf/httpd.conf

disable_http_trace:
  file.append:
    - name: /etc/httpd/conf/httpd.conf
    - text: 'TraceEnable Off'

restart_httpd:
  service.running:
    - name: httpd
    - watch:
      - file: /etc/httpd/conf.d/ipa-rewrite.conf
      - file: /etc/httpd/conf/httpd.conf

/etc/sssd/sssd.conf:
  file.line:
    - mode: ensure
    - content: "entry_cache_timeout = 30"
    - after: "cache_credentials.*"

restart_sssd_if_reconfigured:
  service.running:
    - enable: True
    - name: sssd
    - watch:
      - file: /etc/sssd/sssd.conf
{'fraction_non_alphanumeric': 0.1464778884810348, 'fraction_numerical': 0.01538192623667191, 'mean_word_length': 2.7521311475409838, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1891915', 'n_tokens_mistral': 2315, 'n_tokens_neox': 2265, 'n_words': 377}