Merge pull request 'feat/rolling-vault-unseal' (#20) from feat/rolling-vault-unseal into main

Reviewed-on: ansible-collections/hashistack#20

playbooks/tasks/vault/vault_control_plane.yml

@@ -45,6 +45,11 @@
     - name: "Include ednz_cloud.hashistack.vault"
       ansible.builtin.include_role:
         name: ednz_cloud.hashistack.vault
+      vars:
+        vault_enable_auto_unseal: true
+        vault_unseal_url: "{{ vault_configuration['api_addr'] }}"
+        vault_unseal_tls_verify: false
+        vault_unseal_keys: "{{ _credentials.vault['keys'] | default([]) }}"
 
     - name: "Vault | Initialize vault cluster" # noqa: run-once[task]
       ednz_cloud.hashistack.vault_init:

plugins/modules/consul_acl_bootstrap.py

@@ -11,7 +11,7 @@ module: ednz_cloud.hashistack.consul_acl_bootstrap
 
 short_description: Bootstraps ACL for a Consul cluster.
 
-version_added: "1.0.0"
+version_added: "0.1.0"
 
 description:
     - This module bootstraps ACL (Access Control List) for a Consul cluster. It performs the ACL bootstrap operation,

plugins/modules/vault_init.py

@@ -11,6 +11,8 @@ module: ednz_cloud.hashistack.vault_init
 
 short_description: Manages the initialization of HashiCorp Vault.
 
+version_added: "0.1.0"
+
 description:
     - This module initializes HashiCorp Vault, ensuring that it is securely set up for use.
 

plugins/modules/vault_unseal.py

@@ -7,66 +7,70 @@ __metaclass__ = type
 
 DOCUMENTATION = r"""
 ---
-module: my_test
+module: ednz_cloud.hashistack.vault_unseal
 
-short_description: This is my test module
+short_description: Unseals a Vault cluster.
 
-# If this is part of a collection, you need to use semantic versioning,
-# i.e. the version is of the form "2.5.0" and not "2.4".
-version_added: "1.0.0"
+version_added: "0.1.0"
 
-description: This is my longer description explaining my test module.
+description:
+    - This module unseals a Vault cluster by submitting the necessary unseal keys. It checks whether the Vault is sealed and performs the unseal operation if needed. The response will reflect the state after the last unseal key is submitted.
+
+requirements:
+- C(hvac) (L(Python library,https://hvac.readthedocs.io/en/stable/overview.html))
 
 options:
-    name:
-        description: This is the message to send to the test module.
+    api_url:
+        description: The URL of the Vault API.
         required: true
         type: str
-    new:
-        description:
-            - Control to demo if the result of this module is changed or not.
-            - Parameter description can be a list as well.
+    tls_verify:
+        description: Whether to verify TLS certificates.
         required: false
         type: bool
-# Specify this value according to your collection
-# in format of namespace.collection.doc_fragment_name
-# extends_documentation_fragment:
-#     - my_namespace.my_collection.my_doc_fragment_name
+        default: true
+    key_shares:
+        description: List of unseal keys required to unseal the Vault.
+        required: false
+        type: list
+        default: []
 
 author:
-    - Your Name (@yourGitHubHandle)
+    - Bertrand Lanson (@ednz_cloud)
 """
 
 EXAMPLES = r"""
-# Pass in a message
-- name: Test with a message
-  my_namespace.my_collection.my_test:
-    name: hello world
+# Example: Unseal a Vault cluster
+- name: Unseal Vault cluster
+  ednz_cloud.hashistack.vault_unseal:
+    api_url: "https://127.0.0.1:8200"
+    tls_verify: true
+    key_shares:
+        - "key1"
+        - "key2"
+        - "key3"
 
-# pass in a message and have changed true
-- name: Test with a message and changed output
-  my_namespace.my_collection.my_test:
-    name: hello world
-    new: true
-
-# fail the module
-- name: Test failure of the module
-  my_namespace.my_collection.my_test:
-    name: fail me
+# Example: Unseal Vault cluster with no TLS verification
+- name: Unseal Vault cluster without TLS verification
+  ednz_cloud.hashistack.vault_unseal:
+    api_url: "https://127.0.0.1:8200"
+    tls_verify: false
+    key_shares:
+        - "key1"
+        - "key2"
 """
 
 RETURN = r"""
-# These are examples of possible return values, and in general should use other names for return values.
-original_message:
-    description: The original name param that was passed in.
-    type: str
+state:
+    description: Information about the state of the Vault unseal operation.
+    type: dict
     returned: always
-    sample: 'hello world'
-message:
-    description: The output message that the test module generates.
-    type: str
-    returned: always
-    sample: 'goodbye'
+    sample:
+        sealed: true,
+        t: 3,
+        n: 5,
+        progress: 2,
+        version: "0.6.2"
 """
 from ansible.module_utils.basic import AnsibleModule
 import traceback

roles/vault/defaults/main.yml

@@ -42,6 +42,15 @@ vault_storage_configuration:
   file:
     path: "{{ vault_data_dir }}"
 
+#############################
+# auto-unseal configuration #
+#############################
+
+vault_enable_auto_unseal: false
+vault_unseal_url: "https://127.0.0.1:8200"
+vault_unseal_tls_verify: true
+vault_unseal_keys: []
+
 ##########################
 # listener configuration #
 ##########################

roles/vault/tasks/install.yml

@@ -36,8 +36,10 @@
       register: _vault_current_version
 
 - name: "Vault | Download and install vault binary"
-  when: _vault_current_version is not defined
+  when:
+    - _vault_current_version is not defined
       or _vault_wanted_version != (_vault_current_version.content|default('')|b64decode)
+    - not ansible_check_mode
   block:
     - name: "Vault | Set vault package name to download"
       ansible.builtin.set_fact:
@@ -77,7 +79,6 @@
       until: _vault_binary_archive is succeeded
       retries: 5
       delay: 2
-      check_mode: false
 
     - name: "Vault | Create temporary directory for archive decompression"
       ansible.builtin.file:

roles/vault/tasks/main.yml

@@ -36,8 +36,10 @@
   when: _vault_service_need_reload
 
 - name: "Vault | Start service: {{ vault_service_name }}"
-  ansible.builtin.service:
-    name: "{{ vault_service_name }}"
-    state: restarted
-  throttle: 1
-  when: _vault_service_need_restart
+  ansible.builtin.include_tasks: rolling_restart.yml
+  when:
+    - _vault_service_need_restart
+    - "hostvars[host_item].inventory_hostname == inventory_hostname"
+  with_items: "{{ ansible_play_batch }}"
+  loop_control:
+    loop_var: host_item

roles/vault/tasks/recursive_copy_extra_dirs.yml

@@ -5,13 +5,13 @@
     path: "{{ dir_source_item.dest }}"
     recurse: true
     state: directory
-    mode: "0775"
+    mode: "0755"
 
 - name: "Vault | Create extra directory sources"
   ansible.builtin.file:
     path: "{{ dir_source_item.dest }}/{{ item.path }}"
     state: directory
-    mode: "0775"
+    mode: "0755"
   with_community.general.filetree: "{{ dir_source_item.src }}/"
   when: item.state == 'directory'
 

roles/vault/tasks/rolling_restart.yml

@@ -0,0 +1,14 @@
+---
+- name: "Vault | Start service: {{ vault_service_name }}"
+  ansible.builtin.service:
+    name: "{{ vault_service_name }}"
+    state: restarted
+
+- name: "Vault | Unseal node"
+  ednz_cloud.hashistack.vault_unseal:
+    api_url: "{{ vault_unseal_url }}"
+    tls_verify: "{{ vault_unseal_tls_verify }}"
+    key_shares: "{{ vault_unseal_keys }}"
+  when:
+    - vault_enable_auto_unseal
+    - vault_unseal_keys|length > 0