需要 ttr-release 版本 >= 2.2.3

Ambari 3.0.0 + Free IPA 统一认证体系 示例环境：Kylin V10 SP3 x86，Realm = TEST.COM

CA=/etc/ipa/ca.crt
TS_DIR=/etc/ranger/admin/conf
TS=$TS_DIR/ranger-admin-truststore.jks
PASS=changeit

# 1) 目录与权限
install -d -m 0750 "$TS_DIR"
chown -R ranger:ranger "$TS_DIR"

# 2) 删除旧 alias（如果不存在就忽略）
keytool -delete -alias ipa-ca -keystore "$TS" -storepass "$PASS" >/dev/null 2>&1 || true

# 3) 导入 FreeIPA CA
keytool -importcert -noprompt \
  -alias ipa-ca \
  -file "$CA" \
  -keystore "$TS" \
  -storepass "$PASS"

# 4) 收敛权限
chown ranger:ranger "$TS"
chmod 0640 "$TS"

# 5) 验证
echo "=== truststore created: $TS ==="
keytool -list -keystore "$TS" -storepass "$PASS" | egrep -i "ipa-ca|Owner:|Issuer:" || true