diff --git a/playbooks/deploy.yml b/playbooks/deploy.yml index 43cdb3c..929ffa3 100644 --- a/playbooks/deploy.yml +++ b/playbooks/deploy.yml @@ -5,11 +5,20 @@ gather_facts: true become: true tasks: - # - name: "Include ednxzu.hashicorp_vault" - # ansible.builtin.include_role: - # name: ednxzu.hashicorp_vault + - name: "Include ednxzu.hashicorp_vault" + ansible.builtin.include_role: + name: ednxzu.hashicorp_vault - - name: "Test module" + - name: "Initialize vault cluster" ednxzu.hashistack.vault_init: - name: "Test" - new: true + api_url: "http://127.0.0.1:8200" + key_shares: 3 + key_threshold: 2 + run_once: true + delegate_to: "{{ groups['vault_servers'] | first }}" + register: _vault_init_secret + + - name: "Debug" + ansible.builtin.debug: + msg: "{{ _vault_init_secret }}" + when: _vault_init_secret is defined \ No newline at end of file diff --git a/playbooks/group_vars/all.yml b/playbooks/group_vars/all.yml index 84cac72..c709e8d 100644 --- a/playbooks/group_vars/all.yml +++ b/playbooks/group_vars/all.yml @@ -11,6 +11,8 @@ deployment_method: "docker" api_interface: "eth0" api_interface_address: "{{ ansible_facts[api_interface]['ipv4']['address'] }}" +configuration_directory: "/tmp/hashistack-ansible" + ########################## # Support options ######## ########################## diff --git a/plugins/modules/vault_init.py b/plugins/modules/vault_init.py index ec0621e..66fd63b 100644 --- a/plugins/modules/vault_init.py +++ b/plugins/modules/vault_init.py @@ -68,6 +68,7 @@ message: ''' from ansible.module_utils.basic import AnsibleModule +import traceback try: import hvac @@ -79,70 +80,54 @@ else: HAS_HVAC = True def run_module(): - # define available arguments/parameters a user can pass to the module module_args = dict( api_url=dict(type='str', required=True), - key_shares=dict(type='int', required=False,default=5), - key_treshold=dict(type='int',required=False,default=3) + key_shares=dict(type='int', required=False, default=5), + key_threshold=dict(type='int', required=False, default=3) ) - # seed the result dict in the object - # we primarily care about changed and state - # changed is if this module effectively modified the target - # state will include any data that you want your module to pass back - # for consumption, for example, in a subsequent task result = dict( changed=False, original_message='', - message='' + state='' ) - # the AnsibleModule object will be our abstraction working with Ansible - # this includes instantiation, a couple of common attr would be the - # args/params passed to the execution, as well as if the module - # supports check mode module = AnsibleModule( argument_spec=module_args, supports_check_mode=True ) - if not HAS_HVAC: module.fail_json( - msg=missing_required_lib('hvac'), + msg="missing_required_lib(hvac)", exception=HVAC_IMPORT_ERROR ) - # if the user is working with this module in only check mode we do not - # want to make any changes to the environment, just return the current - # state with no modifications if module.check_mode: module.exit_json(**result) - # manipulate or modify the state as needed (this is going to be the - # part where your module will do what it needs to do) - result['original_message'] = module.params['name'] - result['message'] = 'goodbye' + vault_init_result = None + client = hvac.Client( + url=module.params['api_url'] + ) - # use whatever logic you need to determine whether or not this module - # made any modifications to your target - if module.params['new']: + try: + if not client.sys.is_initialized(): + vault_init_result = client.sys.initialize( + module.params['key_shares'], + module.params['key_threshold'] + ) + result['state'] = vault_init_result + except Exception as e: + module.fail_json(msg=f"Vault initialization failed: {str(e)}") + + if vault_init_result: result['changed'] = True - # during the execution of the module, if there is an exception or a - # conditional state that effectively causes a failure, run - # AnsibleModule.fail_json() to pass in the message and the result - if module.params['name'] == 'fail me': - module.fail_json(msg='You requested this to fail', **result) - - # in the event of a successful module execution, you will want to - # simple AnsibleModule.exit_json(), passing the key/value results module.exit_json(**result) - def main(): run_module() - if __name__ == '__main__': main()