feat(module): vault operator init module somewhat working

This commit is contained in:
Bertrand Lanson 2023-12-28 22:38:26 +01:00
parent 23d2a44d50
commit f8ed7ff0df
3 changed files with 37 additions and 41 deletions

View File

@ -5,11 +5,20 @@
gather_facts: true gather_facts: true
become: true become: true
tasks: tasks:
# - name: "Include ednxzu.hashicorp_vault" - name: "Include ednxzu.hashicorp_vault"
# ansible.builtin.include_role: ansible.builtin.include_role:
# name: ednxzu.hashicorp_vault name: ednxzu.hashicorp_vault
- name: "Test module" - name: "Initialize vault cluster"
ednxzu.hashistack.vault_init: ednxzu.hashistack.vault_init:
name: "Test" api_url: "http://127.0.0.1:8200"
new: true key_shares: 3
key_threshold: 2
run_once: true
delegate_to: "{{ groups['vault_servers'] | first }}"
register: _vault_init_secret
- name: "Debug"
ansible.builtin.debug:
msg: "{{ _vault_init_secret }}"
when: _vault_init_secret is defined

View File

@ -11,6 +11,8 @@ deployment_method: "docker"
api_interface: "eth0" api_interface: "eth0"
api_interface_address: "{{ ansible_facts[api_interface]['ipv4']['address'] }}" api_interface_address: "{{ ansible_facts[api_interface]['ipv4']['address'] }}"
configuration_directory: "/tmp/hashistack-ansible"
########################## ##########################
# Support options ######## # Support options ########
########################## ##########################

View File

@ -68,6 +68,7 @@ message:
''' '''
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
import traceback
try: try:
import hvac import hvac
@ -79,70 +80,54 @@ else:
HAS_HVAC = True HAS_HVAC = True
def run_module(): def run_module():
# define available arguments/parameters a user can pass to the module
module_args = dict( module_args = dict(
api_url=dict(type='str', required=True), api_url=dict(type='str', required=True),
key_shares=dict(type='int', required=False,default=5), key_shares=dict(type='int', required=False, default=5),
key_treshold=dict(type='int',required=False,default=3) key_threshold=dict(type='int', required=False, default=3)
) )
# seed the result dict in the object
# we primarily care about changed and state
# changed is if this module effectively modified the target
# state will include any data that you want your module to pass back
# for consumption, for example, in a subsequent task
result = dict( result = dict(
changed=False, changed=False,
original_message='', original_message='',
message='' state=''
) )
# the AnsibleModule object will be our abstraction working with Ansible
# this includes instantiation, a couple of common attr would be the
# args/params passed to the execution, as well as if the module
# supports check mode
module = AnsibleModule( module = AnsibleModule(
argument_spec=module_args, argument_spec=module_args,
supports_check_mode=True supports_check_mode=True
) )
if not HAS_HVAC: if not HAS_HVAC:
module.fail_json( module.fail_json(
msg=missing_required_lib('hvac'), msg="missing_required_lib(hvac)",
exception=HVAC_IMPORT_ERROR exception=HVAC_IMPORT_ERROR
) )
# if the user is working with this module in only check mode we do not
# want to make any changes to the environment, just return the current
# state with no modifications
if module.check_mode: if module.check_mode:
module.exit_json(**result) module.exit_json(**result)
# manipulate or modify the state as needed (this is going to be the vault_init_result = None
# part where your module will do what it needs to do) client = hvac.Client(
result['original_message'] = module.params['name'] url=module.params['api_url']
result['message'] = 'goodbye' )
# use whatever logic you need to determine whether or not this module try:
# made any modifications to your target if not client.sys.is_initialized():
if module.params['new']: vault_init_result = client.sys.initialize(
module.params['key_shares'],
module.params['key_threshold']
)
result['state'] = vault_init_result
except Exception as e:
module.fail_json(msg=f"Vault initialization failed: {str(e)}")
if vault_init_result:
result['changed'] = True result['changed'] = True
# during the execution of the module, if there is an exception or a
# conditional state that effectively causes a failure, run
# AnsibleModule.fail_json() to pass in the message and the result
if module.params['name'] == 'fail me':
module.fail_json(msg='You requested this to fail', **result)
# in the event of a successful module execution, you will want to
# simple AnsibleModule.exit_json(), passing the key/value results
module.exit_json(**result) module.exit_json(**result)
def main(): def main():
run_module() run_module()
if __name__ == '__main__': if __name__ == '__main__':
main() main()