feat(consul): polish initial deployment of consul, and agent token generation

This commit is contained in:
Bertrand Lanson 2024-03-13 23:27:12 +01:00
parent d9ff21db6f
commit 29f26051d3
7 changed files with 190 additions and 163 deletions

4
.gitignore vendored
View File

@ -2,5 +2,5 @@
**/__pycache__ **/__pycache__
.vscode .vscode
roles/ednz_cloud.* roles/ednz_cloud.*
vault_config vault_config.yml
consul_config consul_config.yml

View File

@ -6,171 +6,24 @@
gather_facts: true gather_facts: true
become: true become: true
tasks: tasks:
- name: "Debug"
ansible.builtin.debug:
msg: "{{ hashi_vault_configuration.listener }}"
- name: "Import variables" - name: "Import variables"
ansible.builtin.import_tasks: ansible.builtin.import_tasks:
file: tasks/load_vars.yml file: tasks/load_vars.yml
- name: "Debug" - name: "Deploy Consul"
ansible.builtin.debug: ansible.builtin.import_tasks:
msg: "{{ hashi_vault_configuration }}" file: tasks/consul/consul_deploy.yml
# - ansible.builtin.fail:
- name: "Consul"
when: when:
- enable_consul | bool - enable_consul | bool
- "'consul_servers' in group_names" - "'consul_servers' in group_names"
tags: tags:
- consul - consul
block:
- name: "Include ednz_cloud.hashistack.hashicorp_consul"
ansible.builtin.include_role:
name: ednz_cloud.hashistack.hashicorp_consul
- name: "Wait for consul cluster to initialize" # noqa: run-once[task] - name: "Deploy Vault"
ansible.builtin.wait_for: ansible.builtin.import_tasks:
timeout: 15 file: tasks/vault/vault_deploy.yml
delegate_to: localhost
run_once: true
- name: "Initialize consul cluster" # noqa: run-once[task]
community.general.consul_acl_bootstrap:
host: "{{ hashi_consul_configuration['advertise_addr'] }}"
port: 8500
scheme: http
state: present
run_once: true
delegate_to: "{{ groups['consul_servers'] | first }}"
# retries: 5
# delay: 5
register: _consul_init_secret
# until: _consul_init_secret.result is defined
when: hashi_consul_configuration.acl.enabled
- name: "Write consul configuration to file" # noqa: run-once[task] no-handler
ansible.builtin.copy:
content: "{{
{
'root_token':{
'accessor_id': _consul_init_secret.result.AccessorID,
'secret_id': _consul_init_secret.result.SecretID
}
} | to_nice_yaml
}}"
dest: "{{ sub_configuration_directories.consul_servers }}/consul_config"
mode: '0644'
when: _consul_init_secret.result is defined
run_once: true
delegate_to: localhost
- name: "Load consul cluster variables"
ansible.builtin.include_vars:
file: "{{ sub_configuration_directories.consul_servers }}/consul_config"
name: _consul_cluster_config
- name: "Create consul agents token" # noqa: run-once[task] no-handler
# when:
# - _consul_init_secret.changed
# - consul_acl_configuration.enabled
run_once: true
delegate_to: localhost
block:
- name: "Create consul agent policy"
community.general.consul_policy:
host: "{{ hashi_consul_configuration['advertise_addr'] }}"
token: "{{ _consul_cluster_config.root_token.secret_id }}"
port: 8500
scheme: http
state: present
name: agents-policy
rules: "{{ consul_default_agent_policy }}"
register: _consul_agent_policy
- name: "Debug Policy"
ansible.builtin.debug:
msg: "{{ _consul_agent_policy }}"
# - fail:
- name: "Create consul agents token"
community.general.consul_token:
host: "localhost" # "{{ hashi_consul_configuration['advertise_addr'] }}"
token: "{{ _consul_cluster_config.root_token.secret_id }}"
port: 8500
scheme: http
state: present
local: true
policies:
- id: _consul_agent_policy.policy.ID
register: _consul_agent_token
- name: "Write consul agents token to file" # no-handler
ansible.builtin.copy:
content: "{{
{
'tokens':{
'agent': _consul_agent_token.token.SecretID
}
} | to_nice_yaml
}}"
dest: "{{ sub_configuration_directories.consul_servers }}/consul_config"
mode: '0644'
when: _consul_agent_token.changed
- name: "Vault"
when: when:
- enable_vault | bool - enable_vault | bool
- "'vault_servers' in group_names" - "'vault_servers' in group_names"
tags: tags:
- vault - vault
block:
- name: "Include ednz_cloud.hashistack.hashicorp_consul"
ansible.builtin.include_role:
name: ednz_cloud.hashistack.hashicorp_vault
- name: "Initialize vault cluster" # noqa: run-once[task]
ednz_cloud.hashistack.vault_init:
api_url: "{{ hashi_vault_configuration['api_addr'] }}"
key_shares: "{{ vault_seal_configuration['key_shares'] }}"
key_threshold: "{{ vault_seal_configuration['key_threshold'] }}"
run_once: true
retries: 5
delay: 5
delegate_to: "{{ groups['vault_servers'] | first }}"
register: _vault_init_secret
until: not _vault_init_secret.failed
- name: "Write vault configuration to file" # noqa: run-once[task] no-handler
ansible.builtin.copy:
content: "{{ _vault_init_secret.state | to_nice_yaml}}"
dest: "{{ sub_configuration_directories.vault_servers }}/vault_config"
mode: '0644'
when: _vault_init_secret.changed
run_once: true
delegate_to: localhost
- name: "Load vault cluster variables necessary for unseal operation"
ansible.builtin.include_vars:
file: "{{ sub_configuration_directories.vault_servers }}/vault_config"
name: _vault_cluster_config
- name: "Unseal the bootstrap node" # noqa: run-once[task] no-handler
ednz_cloud.hashistack.vault_unseal:
api_url: "{{ hashi_vault_configuration['api_addr'] }}"
key_shares: "{{ _vault_cluster_config['keys'] }}"
run_once: true
delegate_to: "{{ groups['vault_servers'] | first }}"
when: _vault_init_secret.changed
register: _vault_unseal_secret
- name: "Unseal all vault nodes"
ednz_cloud.hashistack.vault_unseal:
api_url: "{{ hashi_vault_configuration['api_addr'] }}"
key_shares: "{{ _vault_cluster_config['keys'] }}"
retries: 5
delay: 5
register: _unseal_status

View File

@ -0,0 +1,125 @@
- name: "Consul"
block:
- name: "Include ednz_cloud.hashistack.hashicorp_consul"
ansible.builtin.include_role:
name: ednz_cloud.hashistack.hashicorp_consul
- name: "Wait for consul cluster to initialize" # noqa: run-once[task]
ansible.builtin.wait_for:
timeout: 15
delegate_to: localhost
run_once: true
- name: "Initialize consul cluster" # noqa: run-once[task]
community.general.consul_acl_bootstrap:
host: "{{ hashi_consul_configuration['advertise_addr'] }}"
port: 8500
scheme: http
state: present
run_once: true
delegate_to: "{{ groups['consul_servers'] | first }}"
# retries: 5
# delay: 5
register: _consul_init_secret
# until: _consul_init_secret.result is defined
when: hashi_consul_configuration.acl.enabled
- name: "Write consul configuration to file" # noqa: run-once[task] no-handler
ansible.builtin.copy:
content: "{{
{
'root_token':{
'accessor_id': _consul_init_secret.result.AccessorID,
'secret_id': _consul_init_secret.result.SecretID
}
} | to_nice_yaml
}}"
dest: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
owner: "{{ lookup('env', 'USER') }}"
group: "{{ lookup('env', 'USER') }}"
mode: "0644"
when: _consul_init_secret.result is defined
run_once: true
delegate_to: localhost
- name: "Load consul cluster variables"
ansible.builtin.include_vars:
file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
name: _consul_cluster_config
- name: "Create consul agents token"
when:
- _consul_init_secret.changed
- consul_acl_configuration.enabled
block:
- name: "Create consul agents token" # noqa: run-once[task] no-handler
run_once: true
delegate_to: localhost
block:
- name: "Create consul agent policy"
community.general.consul_policy:
host: "{{ hashi_consul_configuration['advertise_addr'] }}"
token: "{{ _consul_cluster_config.root_token.secret_id }}"
port: 8500
scheme: http
state: present
name: agents-policy
rules: "{{ consul_default_agent_policy }}"
register: _consul_agent_policy
- name: "Create consul agents token"
vars:
consul_full_url: "http://{{ hashi_consul_configuration['advertise_addr'] }}:8500"
consul_token_body:
Policies:
- ID: "{{ _consul_agent_policy.policy.ID }}"
ansible.builtin.uri:
url: "{{ consul_full_url }}/v1/acl/token"
method: PUT
headers:
X-Consul-Token: "{{ _consul_cluster_config.root_token.secret_id }}"
body: "{{ consul_token_body | to_json }}"
status_code:
- 200
register: _consul_agent_token
- name: "Write consul agents token to file" # no-handler
ansible.builtin.blockinfile:
marker: "## -- {tokens} ANSIBLE MANAGED BLOCK ##"
block: "{{
{
'tokens':{
'agent': _consul_agent_token.json.SecretID
}
} | to_nice_yaml
}}"
path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
mode: "0644"
when: "'OK' in _consul_agent_token.msg"
- name: "Merge token configuration"
delegate_to: localhost
block:
- name: "Stat consul secrets file"
ansible.builtin.stat:
path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
register: _consul_config_file
- name: "Load consul secrets file"
ansible.builtin.include_vars:
file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
name: _consul_cluster_config
when: _consul_config_file.stat.exists
- name: "Merge token configuration"
vars:
_config_to_merge:
acl:
tokens: "{{ _consul_cluster_config.tokens }}"
ansible.builtin.set_fact:
hashi_consul_configuration: "{{ hashi_consul_configuration | default({}) | combine(_config_to_merge, recursive=true) }}"
when: _consul_cluster_config.tokens is defined
- name: "Include ednz_cloud.hashistack.hashicorp_consul"
ansible.builtin.include_role:
name: ednz_cloud.hashistack.hashicorp_consul

View File

@ -25,24 +25,23 @@
block: block:
- name: "Consul | Stat consul secrets file" - name: "Consul | Stat consul secrets file"
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ sub_configuration_directories.consul_servers }}/consul_config" path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
register: _consul_config_file register: _consul_config_file
- name: "Consul | Load consul secrets file" - name: "Consul | Load consul secrets file"
ansible.builtin.include_vars: ansible.builtin.include_vars:
file: "{{ sub_configuration_directories.consul_servers }}/consul_config" file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
name: _consul_cluster_config name: _consul_cluster_config
when: _consul_config_file.stat.exists when: _consul_config_file.stat.exists
- name: "Consul | Merge token configuration" - name: "Merge token configuration"
vars: vars:
_config_to_merge: _config_to_merge:
acl: acl:
tokens: tokens: "{{ _consul_cluster_config.tokens }}"
agent: "{{ _consul_cluster_config.consul_agent_token }}"
ansible.builtin.set_fact: ansible.builtin.set_fact:
hashi_consul_configuration: "{{ hashi_consul_configuration | default({}) | combine(_config_to_merge, recursive=true) }}" hashi_consul_configuration: "{{ hashi_consul_configuration | default({}) | combine(_config_to_merge, recursive=true) }}"
when: _consul_cluster_config.consul_agent_token is defined when: _consul_cluster_config.tokens is defined
- name: Debug token config - name: Debug token config
ansible.builtin.debug: ansible.builtin.debug:

View File

@ -66,14 +66,14 @@
- name: "Merge consul configurations" - name: "Merge consul configurations"
ansible.builtin.import_tasks: ansible.builtin.import_tasks:
file: "consul_vars.yml" file: "consul/consul_vars.yml"
when: when:
- enable_consul | bool - enable_consul | bool
- "'consul_servers' in group_names" - "'consul_servers' in group_names"
- name: "Merge vault configurations" - name: "Merge vault configurations"
ansible.builtin.import_tasks: ansible.builtin.import_tasks:
file: "vault_vars.yml" file: "vault/vault_vars.yml"
when: when:
- enable_vault | bool - enable_vault | bool
- "'vault_servers' in group_names" - "'vault_servers' in group_names"

View File

@ -0,0 +1,50 @@
- name: "Vault"
block:
- name: "Include ednz_cloud.hashistack.hashicorp_consul"
ansible.builtin.include_role:
name: ednz_cloud.hashistack.hashicorp_vault
- name: "Initialize vault cluster" # noqa: run-once[task]
ednz_cloud.hashistack.vault_init:
api_url: "{{ hashi_vault_configuration['api_addr'] }}"
key_shares: "{{ vault_seal_configuration['key_shares'] }}"
key_threshold: "{{ vault_seal_configuration['key_threshold'] }}"
run_once: true
retries: 5
delay: 5
delegate_to: "{{ groups['vault_servers'] | first }}"
register: _vault_init_secret
until: not _vault_init_secret.failed
- name: "Write vault configuration to file" # noqa: run-once[task] no-handler
ansible.builtin.copy:
content: "{{ _vault_init_secret.state | to_nice_yaml}}"
dest: "{{ sub_configuration_directories.vault_servers }}/vault_config.yml"
owner: "{{ lookup('env', 'USER') }}"
group: "{{ lookup('env', 'USER') }}"
mode: "0644"
when: _vault_init_secret.changed
run_once: true
delegate_to: localhost
- name: "Load vault cluster variables necessary for unseal operation"
ansible.builtin.include_vars:
file: "{{ sub_configuration_directories.vault_servers }}/vault_config.yml"
name: _vault_cluster_config
- name: "Unseal the bootstrap node" # noqa: run-once[task] no-handler
ednz_cloud.hashistack.vault_unseal:
api_url: "{{ hashi_vault_configuration['api_addr'] }}"
key_shares: "{{ _vault_cluster_config['keys'] }}"
run_once: true
delegate_to: "{{ groups['vault_servers'] | first }}"
when: _vault_init_secret.changed
register: _vault_unseal_secret
- name: "Unseal all vault nodes"
ednz_cloud.hashistack.vault_unseal:
api_url: "{{ hashi_vault_configuration['api_addr'] }}"
key_shares: "{{ _vault_cluster_config['keys'] }}"
retries: 5
delay: 5
register: _unseal_status