feat(module): vault operator init module somewhat working

This commit is contained in:
Bertrand Lanson 2023-12-28 22:38:26 +01:00
parent 23d2a44d50
commit f8ed7ff0df
3 changed files with 37 additions and 41 deletions

View File

@ -5,11 +5,20 @@
gather_facts: true
become: true
tasks:
# - name: "Include ednxzu.hashicorp_vault"
# ansible.builtin.include_role:
# name: ednxzu.hashicorp_vault
- name: "Include ednxzu.hashicorp_vault"
ansible.builtin.include_role:
name: ednxzu.hashicorp_vault
- name: "Test module"
- name: "Initialize vault cluster"
ednxzu.hashistack.vault_init:
name: "Test"
new: true
api_url: "http://127.0.0.1:8200"
key_shares: 3
key_threshold: 2
run_once: true
delegate_to: "{{ groups['vault_servers'] | first }}"
register: _vault_init_secret
- name: "Debug"
ansible.builtin.debug:
msg: "{{ _vault_init_secret }}"
when: _vault_init_secret is defined

View File

@ -11,6 +11,8 @@ deployment_method: "docker"
api_interface: "eth0"
api_interface_address: "{{ ansible_facts[api_interface]['ipv4']['address'] }}"
configuration_directory: "/tmp/hashistack-ansible"
##########################
# Support options ########
##########################

View File

@ -68,6 +68,7 @@ message:
'''
from ansible.module_utils.basic import AnsibleModule
import traceback
try:
import hvac
@ -79,70 +80,54 @@ else:
HAS_HVAC = True
def run_module():
# define available arguments/parameters a user can pass to the module
module_args = dict(
api_url=dict(type='str', required=True),
key_shares=dict(type='int', required=False,default=5),
key_treshold=dict(type='int',required=False,default=3)
key_shares=dict(type='int', required=False, default=5),
key_threshold=dict(type='int', required=False, default=3)
)
# seed the result dict in the object
# we primarily care about changed and state
# changed is if this module effectively modified the target
# state will include any data that you want your module to pass back
# for consumption, for example, in a subsequent task
result = dict(
changed=False,
original_message='',
message=''
state=''
)
# the AnsibleModule object will be our abstraction working with Ansible
# this includes instantiation, a couple of common attr would be the
# args/params passed to the execution, as well as if the module
# supports check mode
module = AnsibleModule(
argument_spec=module_args,
supports_check_mode=True
)
if not HAS_HVAC:
module.fail_json(
msg=missing_required_lib('hvac'),
msg="missing_required_lib(hvac)",
exception=HVAC_IMPORT_ERROR
)
# if the user is working with this module in only check mode we do not
# want to make any changes to the environment, just return the current
# state with no modifications
if module.check_mode:
module.exit_json(**result)
# manipulate or modify the state as needed (this is going to be the
# part where your module will do what it needs to do)
result['original_message'] = module.params['name']
result['message'] = 'goodbye'
vault_init_result = None
client = hvac.Client(
url=module.params['api_url']
)
# use whatever logic you need to determine whether or not this module
# made any modifications to your target
if module.params['new']:
try:
if not client.sys.is_initialized():
vault_init_result = client.sys.initialize(
module.params['key_shares'],
module.params['key_threshold']
)
result['state'] = vault_init_result
except Exception as e:
module.fail_json(msg=f"Vault initialization failed: {str(e)}")
if vault_init_result:
result['changed'] = True
# during the execution of the module, if there is an exception or a
# conditional state that effectively causes a failure, run
# AnsibleModule.fail_json() to pass in the message and the result
if module.params['name'] == 'fail me':
module.fail_json(msg='You requested this to fail', **result)
# in the event of a successful module execution, you will want to
# simple AnsibleModule.exit_json(), passing the key/value results
module.exit_json(**result)
def main():
run_module()
if __name__ == '__main__':
main()