From 83f9c9748eff8ce63e15596ee5f131dd46d7ca18 Mon Sep 17 00:00:00 2001 From: Bertrand Lanson Date: Tue, 7 May 2024 19:23:48 +0200 Subject: [PATCH] feat(vault): enable consul service registration automatically if consul is also enabled --- .../etc/hashistack/globals.yml | 2 +- playbooks/group_vars/all/globals.yml | 8 +- playbooks/group_vars/all/vault.yml | 9 ++ playbooks/inventory/multinode.ini | 1 + playbooks/tasks/consul/consul_deploy.yml | 89 +++---------------- playbooks/tasks/consul/consul_vars.yml | 2 +- playbooks/tasks/vault/vault_deploy.yml | 37 ++++++++ 7 files changed, 64 insertions(+), 84 deletions(-) diff --git a/molecule/no_tls_multi_node/etc/hashistack/globals.yml b/molecule/no_tls_multi_node/etc/hashistack/globals.yml index e41c895..f35190a 100644 --- a/molecule/no_tls_multi_node/etc/hashistack/globals.yml +++ b/molecule/no_tls_multi_node/etc/hashistack/globals.yml @@ -6,7 +6,7 @@ # enable_haproxy: "yes" # enable_vault: "yes" # enable_consul: "yes" -# enable_nomad: "no" +enable_nomad: "no" # haproxy_version: "2.8" # nomad_version: "1.7.7" diff --git a/playbooks/group_vars/all/globals.yml b/playbooks/group_vars/all/globals.yml index 941414e..cd5f7af 100644 --- a/playbooks/group_vars/all/globals.yml +++ b/playbooks/group_vars/all/globals.yml @@ -174,12 +174,12 @@ vault_extra_listener_configuration: {} # service registration # ######################## -vault_enable_service_registration: false +vault_enable_service_registration: "{{ enable_consul | bool }}" vault_service_registration_configuration: consul: - address: "127.0.0.1:8500" - scheme: "http" - token: "" + address: "127.0.0.1:{{ hostvars[groups['consul_servers'][0]].consul_api_port[hostvars[groups['consul_servers'][0]].consul_api_scheme] }}" + scheme: "{{ hostvars[groups['consul_servers'][0]].consul_api_scheme }}" + token: "{{ _credentials.consul.tokens.vault.secret_id }}" ################# # vault plugins # diff --git a/playbooks/group_vars/all/vault.yml b/playbooks/group_vars/all/vault.yml index a92cc1e..d6094b8 100644 --- a/playbooks/group_vars/all/vault.yml +++ b/playbooks/group_vars/all/vault.yml @@ -49,6 +49,15 @@ vault_plugin_extra_files_dir: - src: "{{ sub_configuration_directories['vault_servers'] }}/plugin" dest: "{{ vault_plugin_directory }}" +############################## +# vault service registration # +############################## + +vault_service_registration_policy: | + service "vault" { + policy = "write" + } + ######################## # vault role variables # ######################## diff --git a/playbooks/inventory/multinode.ini b/playbooks/inventory/multinode.ini index 6acffb8..08734c2 100644 --- a/playbooks/inventory/multinode.ini +++ b/playbooks/inventory/multinode.ini @@ -14,6 +14,7 @@ consul03 [consul_agents:children] haproxy_servers +vault_servers [nomad_servers] nomad01 diff --git a/playbooks/tasks/consul/consul_deploy.yml b/playbooks/tasks/consul/consul_deploy.yml index 5552f26..2d3ac78 100644 --- a/playbooks/tasks/consul/consul_deploy.yml +++ b/playbooks/tasks/consul/consul_deploy.yml @@ -29,28 +29,6 @@ register: _consul_init_secret when: hashi_consul_configuration.acl.enabled - # - name: "Write consul configuration to file" # noqa: run-once[task] no-handler - # ansible.builtin.blockinfile: - # marker: "## -- {root_token} ANSIBLE MANAGED BLOCK ##" - # block: "{{ - # { - # 'root_token':{ - # 'accessor_id': _consul_init_secret.result.AccessorID, - # 'secret_id': _consul_init_secret.result.SecretID - # } - # } | to_nice_yaml - # }}" - # path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml" - # mode: "0644" - # when: _consul_init_secret.result is defined - # run_once: true - # delegate_to: localhost - - # - name: "Load consul cluster variables" - # ansible.builtin.include_vars: - # file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml" - # name: _consul_cluster_config - - name: "Create consul agents token" when: - _consul_init_secret.changed @@ -72,22 +50,18 @@ register: _consul_agent_policy - name: "Create consul agents token" - vars: - consul_token_body: - Description: "Consul agents token" - SecretID: "{{ _credentials.consul.tokens.agent }}" - Policies: - - ID: "{{ _consul_agent_policy.policy.ID }}" - ansible.builtin.uri: - url: "{{ consul_api_addr }}/v1/acl/token" - method: PUT - headers: - X-Consul-Token: "{{ _credentials.consul.root_token.secret_id }}" - body: "{{ consul_token_body | to_json }}" - status_code: - - 200 + community.general.consul_token: + token: "{{ _credentials.consul.root_token.secret_id }}" + host: "{{ api_interface_address }}" + port: "{{ consul_api_port[consul_api_scheme] }}" + scheme: "{{ consul_api_scheme }}" + validate_certs: false + accessor_id: "{{ _credentials.consul.tokens.agent.accessor_id }}" + secret_id: "{{ _credentials.consul.tokens.agent.secret_id }}" + policies: + - id: "{{ _consul_agent_policy.policy.ID }}" + state: present register: _consul_agent_token - changed_when: _consul_agent_token.status == 200 - name: "Restart consul service" ansible.builtin.service: @@ -95,44 +69,3 @@ state: restarted throttle: 1 when: _consul_agent_token.changed - - # - name: "Write consul agents token to file" # no-handler - # ansible.builtin.blockinfile: - # marker: "## -- {tokens} ANSIBLE MANAGED BLOCK ##" - # block: "{{ - # { - # 'tokens':{ - # 'agent': _consul_agent_token.json.SecretID - # } - # } | to_nice_yaml - # }}" - # path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml" - # mode: "0644" - # when: "'OK' in _consul_agent_token.msg" - - # - name: "Merge token configuration" - # delegate_to: localhost - # block: - # - name: "Stat consul secrets file" - # ansible.builtin.stat: - # path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml" - # register: _consul_config_file - # - # - name: "Load consul secrets file" - # ansible.builtin.include_vars: - # file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml" - # name: _consul_cluster_config - # when: _consul_config_file.stat.exists - # - # - name: "Merge token configuration" - # vars: - # _config_to_merge: - # acl: - # tokens: "{{ _consul_cluster_config.tokens }}" - # ansible.builtin.set_fact: - # hashi_consul_configuration: "{{ hashi_consul_configuration | default({}) | combine(_config_to_merge, recursive=true) }}" - # when: _consul_cluster_config.tokens is defined - - # - name: "Include ednz_cloud.hashistack.hashicorp_consul" - # ansible.builtin.include_role: - # name: ednz_cloud.hashistack.hashicorp_consul diff --git a/playbooks/tasks/consul/consul_vars.yml b/playbooks/tasks/consul/consul_vars.yml index 9458a95..a6b9e01 100644 --- a/playbooks/tasks/consul/consul_vars.yml +++ b/playbooks/tasks/consul/consul_vars.yml @@ -41,7 +41,7 @@ _config_to_merge: acl: tokens: - agent: "{{ _credentials.consul.tokens.agent }}" + agent: "{{ _credentials.consul.tokens.agent.secret_id }}" ansible.builtin.set_fact: hashi_consul_configuration: "{{ hashi_consul_configuration | default({}) | combine(_config_to_merge, recursive=true) }}" diff --git a/playbooks/tasks/vault/vault_deploy.yml b/playbooks/tasks/vault/vault_deploy.yml index 3d2de38..8561327 100644 --- a/playbooks/tasks/vault/vault_deploy.yml +++ b/playbooks/tasks/vault/vault_deploy.yml @@ -1,6 +1,43 @@ --- - name: "Vault" block: + - name: "Create consul token for service registration" + when: + - enable_consul + - vault_enable_service_registration + delegate_to: "{{ groups['consul_servers'] | first }}" + vars: + _consul_vault_sr_host: "{{ hostvars[groups['consul_servers'][0]].api_interface_address }}" + _consul_vault_sr_port: "{{ hostvars[groups['consul_servers'][0]].consul_api_port[hostvars[groups['consul_servers'][0]].consul_api_scheme] }}" + _consul_vault_sr_scheme: "{{ hostvars[groups['consul_servers'][0]].consul_api_scheme }}" + run_once: true + block: + - name: "Create consul vault policy" + community.general.consul_policy: + token: "{{ _credentials.consul.root_token.secret_id }}" + host: "{{ _consul_vault_sr_host }}" + port: "{{ _consul_vault_sr_port }}" + scheme: "{{ _consul_vault_sr_scheme }}" + validate_certs: false + state: present + name: vault-policy + rules: "{{ vault_service_registration_policy }}" + register: _consul_vault_policy + + - name: "Create consul vault token" + community.general.consul_token: + token: "{{ _credentials.consul.root_token.secret_id }}" + host: "{{ _consul_vault_sr_host }}" + port: "{{ _consul_vault_sr_port }}" + scheme: "{{ _consul_vault_sr_scheme }}" + validate_certs: false + accessor_id: "{{ _credentials.consul.tokens.vault.accessor_id }}" + secret_id: "{{ _credentials.consul.tokens.vault.secret_id }}" + policies: + - id: "{{ _consul_vault_policy.policy.ID }}" + state: present + when: _consul_vault_policy.changed + - name: "Include ednz_cloud.hashistack.hashicorp_consul" ansible.builtin.include_role: name: ednz_cloud.hashistack.hashicorp_vault