91 lines
3.7 KiB
YAML
91 lines
3.7 KiB
YAML
|
---
|
||
|
|
- name: "Vault control plane"
|
||
|
|
block:
|
||
|
|
- name: "Create consul token for service registration"
|
||
|
|
when:
|
||
|
|
- vault_init_server
|
||
|
|
- enable_consul
|
||
|
|
- vault_enable_service_registration
|
||
|
|
vars:
|
||
|
|
_consul_vault_sr_host: "{{ hostvars[groups['consul_servers'][0]].api_interface_address }}"
|
||
|
|
_consul_vault_sr_port: "{{ hostvars[groups['consul_servers'][0]].consul_api_port[hostvars[groups['consul_servers'][0]].consul_api_scheme] }}"
|
||
|
|
_consul_vault_sr_scheme: "{{ hostvars[groups['consul_servers'][0]].consul_api_scheme }}"
|
||
|
|
block:
|
||
|
|
- name: "Create consul vault policy"
|
||
|
|
community.general.consul_policy:
|
||
|
|
token: "{{ _credentials.consul.root_token.secret_id }}"
|
||
|
|
host: "{{ _consul_vault_sr_host }}"
|
||
|
|
port: "{{ _consul_vault_sr_port }}"
|
||
|
|
scheme: "{{ _consul_vault_sr_scheme }}"
|
||
|
|
validate_certs: false
|
||
|
|
state: present
|
||
|
|
name: vault-policy
|
||
|
|
rules: "{{ vault_service_registration_policy }}"
|
||
|
|
register: _consul_vault_policy
|
||
|
|
|
||
|
|
- name: "Create consul vault token" # noqa: no-handler
|
||
|
|
community.general.consul_token:
|
||
|
|
token: "{{ _credentials.consul.root_token.secret_id }}"
|
||
|
|
host: "{{ _consul_vault_sr_host }}"
|
||
|
|
port: "{{ _consul_vault_sr_port }}"
|
||
|
|
scheme: "{{ _consul_vault_sr_scheme }}"
|
||
|
|
validate_certs: false
|
||
|
|
accessor_id: "{{ _credentials.consul.tokens.vault.accessor_id }}"
|
||
|
|
secret_id: "{{ _credentials.consul.tokens.vault.secret_id }}"
|
||
|
|
policies:
|
||
|
|
- id: "{{ _consul_vault_policy.policy.ID }}"
|
||
|
|
state: present
|
||
|
|
when: _consul_vault_policy.changed
|
||
|
|
|
||
|
|
- name: "Include ednz_cloud.hashicorp_consul"
|
||
|
|
ansible.builtin.include_role:
|
||
|
|
name: ednz_cloud.hashicorp_vault
|
||
|
|
|
||
|
|
- name: "Initialize vault cluster" # noqa: run-once[task]
|
||
|
|
ednz_cloud.hashistack.vault_init:
|
||
|
|
api_url: "{{ hashicorp_vault_configuration['api_addr'] }}"
|
||
|
|
tls_verify: "{{ vault_tls_verify }}"
|
||
|
|
key_shares: "{{ vault_seal_configuration['key_shares'] }}"
|
||
|
|
key_threshold: "{{ vault_seal_configuration['key_threshold'] }}"
|
||
|
|
retries: 5
|
||
|
|
delay: 5
|
||
|
|
register: _vault_init_secret
|
||
|
|
until: not _vault_init_secret.failed
|
||
|
|
when: vault_init_server
|
||
|
|
|
||
|
|
- name: "Write vault configuration to file" # noqa: run-once[task] no-handler
|
||
|
|
ansible.builtin.copy:
|
||
|
|
content: "{{ _vault_init_secret.state | to_nice_yaml(indent=2) }}"
|
||
|
|
dest: "{{ sub_configuration_directories.secrets }}/vault.yml"
|
||
|
|
owner: "{{ lookup('env', 'USER') }}"
|
||
|
|
group: "{{ lookup('env', 'USER') }}"
|
||
|
|
mode: "0644"
|
||
|
|
when:
|
||
|
|
- vault_init_server
|
||
|
|
- _vault_init_secret.changed
|
||
|
|
delegate_to: localhost
|
||
|
|
|
||
|
|
- name: "Load vault cluster variables necessary for unseal operation"
|
||
|
|
ansible.builtin.import_tasks:
|
||
|
|
file: ../misc/load_credentials_vars.yml
|
||
|
|
|
||
|
|
- name: "Unseal the bootstrap node" # noqa: run-once[task] no-handler
|
||
|
|
ednz_cloud.hashistack.vault_unseal:
|
||
|
|
api_url: "{{ hashicorp_vault_configuration['api_addr'] }}"
|
||
|
|
tls_verify: "{{ vault_tls_verify }}"
|
||
|
|
key_shares: "{{ _credentials.vault['keys'] }}"
|
||
|
|
when:
|
||
|
|
- vault_init_server
|
||
|
|
- _vault_init_secret.changed
|
||
|
|
register: _vault_unseal_secret
|
||
|
|
|
||
|
|
- name: "Unseal all vault nodes"
|
||
|
|
ednz_cloud.hashistack.vault_unseal:
|
||
|
|
api_url: "{{ hashicorp_vault_configuration['api_addr'] }}"
|
||
|
|
tls_verify: "{{ vault_tls_verify }}"
|
||
|
|
key_shares: "{{ _credentials.vault['keys'] }}"
|
||
|
|
retries: 5
|
||
|
|
delay: 5
|
||
|
|
until: _unseal_status.changed or not _unseal_status.failed
|
||
|
|
register: _unseal_status
|