Merge pull request 'feat(vault): enable consul service registration automatically if consul is also enabled' (#9) from feat/vault-consul-integration into main

Reviewed-on: ansible-collections/hashistack#9

molecule/no_tls_multi_node/etc/hashistack/globals.yml

@@ -6,7 +6,7 @@
 # enable_haproxy: "yes"
 # enable_vault: "yes"
 # enable_consul: "yes"
-# enable_nomad: "no"
+enable_nomad: "no"
 
 # haproxy_version: "2.8"
 # nomad_version: "1.7.7"

playbooks/generate_credentials.yml

@@ -14,8 +14,14 @@
 
         - name: "Generate consul agents credentials"
           ansible.builtin.set_fact:
+            _cosul_agents_accessor: "{{ lookup('password', '/dev/null chars=ascii_letters,digits') | to_uuid }}"
             _consul_agents_token: "{{ lookup('password', '/dev/null chars=ascii_letters,digits') | to_uuid }}"
 
+        - name: "Generate consul vault credentials"
+          ansible.builtin.set_fact:
+            _cosul_vault_accessor: "{{ lookup('password', '/dev/null chars=ascii_letters,digits') | to_uuid }}"
+            _consul_vault_token: "{{ lookup('password', '/dev/null chars=ascii_letters,digits') | to_uuid }}"
+
     - name: "Generate nomad credentials"
       block:
         - name: "Generate nomad root credentials"

playbooks/group_vars/all/globals.yml

@@ -174,12 +174,12 @@ vault_extra_listener_configuration: {}
 # service registration #
 ########################
 
-vault_enable_service_registration: false
+vault_enable_service_registration: "{{ enable_consul | bool }}"
 vault_service_registration_configuration:
   consul:
-    address: "127.0.0.1:8500"
-    scheme: "http"
-    token: ""
+    address: "127.0.0.1:{{ hostvars[groups['consul_servers'][0]].consul_api_port[hostvars[groups['consul_servers'][0]].consul_api_scheme] }}"
+    scheme: "{{ hostvars[groups['consul_servers'][0]].consul_api_scheme }}"
+    token: "{{ _credentials.consul.tokens.vault.secret_id }}"
 
 #################
 # vault plugins #

playbooks/group_vars/all/vault.yml

@@ -49,6 +49,15 @@ vault_plugin_extra_files_dir:
   - src: "{{ sub_configuration_directories['vault_servers'] }}/plugin"
     dest: "{{ vault_plugin_directory }}"
 
+##############################
+# vault service registration #
+##############################
+
+vault_service_registration_policy: |
+  service "vault" {
+    policy = "write"
+  }
+
 ########################
 # vault role variables #
 ########################

playbooks/inventory/multinode.ini

@@ -14,6 +14,7 @@ consul03
 
 [consul_agents:children]
 haproxy_servers
+vault_servers
 
 [nomad_servers]
 nomad01

playbooks/tasks/consul/consul_deploy.yml

@@ -29,28 +29,6 @@
       register: _consul_init_secret
       when: hashi_consul_configuration.acl.enabled
 
-    # - name: "Write consul configuration to file" # noqa: run-once[task] no-handler
-    #   ansible.builtin.blockinfile:
-    #     marker: "## -- {root_token} ANSIBLE MANAGED BLOCK ##"
-    #     block: "{{
-    #       {
-    #       'root_token':{
-    #       'accessor_id': _consul_init_secret.result.AccessorID,
-    #       'secret_id': _consul_init_secret.result.SecretID
-    #       }
-    #       } | to_nice_yaml
-    #       }}"
-    #     path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
-    #     mode: "0644"
-    #   when: _consul_init_secret.result is defined
-    #   run_once: true
-    #   delegate_to: localhost
-
-    # - name: "Load consul cluster variables"
-    #   ansible.builtin.include_vars:
-    #     file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
-    #     name: _consul_cluster_config
-
     - name: "Create consul agents token"
       when:
         - _consul_init_secret.changed
@@ -72,22 +50,18 @@
               register: _consul_agent_policy
 
             - name: "Create consul agents token"
-              vars:
-                consul_token_body:
-                  Description: "Consul agents token"
-                  SecretID: "{{ _credentials.consul.tokens.agent }}"
-                  Policies:
-                    - ID: "{{ _consul_agent_policy.policy.ID }}"
-              ansible.builtin.uri:
-                url: "{{ consul_api_addr }}/v1/acl/token"
-                method: PUT
-                headers:
-                  X-Consul-Token: "{{ _credentials.consul.root_token.secret_id  }}"
-                body: "{{ consul_token_body | to_json }}"
-                status_code:
-                  - 200
+              community.general.consul_token:
+                token: "{{ _credentials.consul.root_token.secret_id }}"
+                host: "{{ api_interface_address }}"
+                port: "{{ consul_api_port[consul_api_scheme] }}"
+                scheme: "{{ consul_api_scheme }}"
+                validate_certs: false
+                accessor_id: "{{ _credentials.consul.tokens.agent.accessor_id }}"
+                secret_id: "{{ _credentials.consul.tokens.agent.secret_id }}"
+                policies:
+                  - id: "{{ _consul_agent_policy.policy.ID }}"
+                state: present
               register: _consul_agent_token
-              changed_when: _consul_agent_token.status == 200
 
             - name: "Restart consul service"
               ansible.builtin.service:
@@ -95,44 +69,3 @@
                 state: restarted
               throttle: 1
               when: _consul_agent_token.changed
-
-    # - name: "Write consul agents token to file" # no-handler
-    #   ansible.builtin.blockinfile:
-    #     marker: "## -- {tokens} ANSIBLE MANAGED BLOCK ##"
-    #     block: "{{
-    #       {
-    #       'tokens':{
-    #       'agent': _consul_agent_token.json.SecretID
-    #       }
-    #       } | to_nice_yaml
-    #       }}"
-    #     path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
-    #     mode: "0644"
-    #   when: "'OK' in _consul_agent_token.msg"
-
-    #         - name: "Merge token configuration"
-    #           delegate_to: localhost
-    #           block:
-    #             - name: "Stat consul secrets file"
-    #               ansible.builtin.stat:
-    #                 path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
-    #               register: _consul_config_file
-    #
-    #             - name: "Load consul secrets file"
-    #               ansible.builtin.include_vars:
-    #                 file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
-    #                 name: _consul_cluster_config
-    #               when: _consul_config_file.stat.exists
-    #
-    #             - name: "Merge token configuration"
-    #               vars:
-    #                 _config_to_merge:
-    #                   acl:
-    #                     tokens: "{{ _consul_cluster_config.tokens }}"
-    #               ansible.builtin.set_fact:
-    #                 hashi_consul_configuration: "{{ hashi_consul_configuration | default({}) | combine(_config_to_merge, recursive=true) }}"
-    #               when: _consul_cluster_config.tokens is defined
-
-    # - name: "Include ednz_cloud.hashistack.hashicorp_consul"
-    #   ansible.builtin.include_role:
-    #     name: ednz_cloud.hashistack.hashicorp_consul

playbooks/tasks/consul/consul_vars.yml

@@ -41,7 +41,7 @@
         _config_to_merge:
           acl:
             tokens:
-              agent: "{{ _credentials.consul.tokens.agent }}"
+              agent: "{{ _credentials.consul.tokens.agent.secret_id }}"
       ansible.builtin.set_fact:
         hashi_consul_configuration: "{{ hashi_consul_configuration | default({}) | combine(_config_to_merge, recursive=true) }}"
 

playbooks/tasks/vault/vault_deploy.yml

@@ -1,6 +1,43 @@
 ---
 - name: "Vault"
   block:
+    - name: "Create consul token for service registration"
+      when:
+        - enable_consul
+        - vault_enable_service_registration
+      delegate_to: "{{ groups['consul_servers'] | first }}"
+      vars:
+        _consul_vault_sr_host: "{{ hostvars[groups['consul_servers'][0]].api_interface_address }}"
+        _consul_vault_sr_port: "{{ hostvars[groups['consul_servers'][0]].consul_api_port[hostvars[groups['consul_servers'][0]].consul_api_scheme] }}"
+        _consul_vault_sr_scheme: "{{ hostvars[groups['consul_servers'][0]].consul_api_scheme }}"
+      run_once: true
+      block:
+        - name: "Create consul vault policy"
+          community.general.consul_policy:
+            token: "{{ _credentials.consul.root_token.secret_id }}"
+            host: "{{ _consul_vault_sr_host }}"
+            port: "{{ _consul_vault_sr_port }}"
+            scheme: "{{ _consul_vault_sr_scheme }}"
+            validate_certs: false
+            state: present
+            name: vault-policy
+            rules: "{{ vault_service_registration_policy }}"
+          register: _consul_vault_policy
+
+        - name: "Create consul vault token"
+          community.general.consul_token:
+            token: "{{ _credentials.consul.root_token.secret_id }}"
+            host: "{{ _consul_vault_sr_host }}"
+            port: "{{ _consul_vault_sr_port }}"
+            scheme: "{{ _consul_vault_sr_scheme }}"
+            validate_certs: false
+            accessor_id: "{{ _credentials.consul.tokens.vault.accessor_id }}"
+            secret_id: "{{ _credentials.consul.tokens.vault.secret_id }}"
+            policies:
+              - id: "{{ _consul_vault_policy.policy.ID }}"
+            state: present
+          when: _consul_vault_policy.changed
+
     - name: "Include ednz_cloud.hashistack.hashicorp_consul"
       ansible.builtin.include_role:
         name: ednz_cloud.hashistack.hashicorp_vault

playbooks/templates/credentials.yml.j2

@@ -3,6 +3,11 @@ consul:
   root_token:
     secret_id: "{{ _consul_root_token }}"
   tokens:
-    agent: "{{ _consul_agents_token }}"
+    agent:
+      accessor_id: "{{ _consul_agents_accesor }}"
+      secret_id: "{{ _consul_agents_token }}"
+    vault:
+      accessor_id: "{{ _consul_vault_accessor }}"
+      secret_id: "{{ _consul_vault_token }}"
 nomad:
   root_token: "{{ _nomad_root_token }}"