Compare commits

..

No commits in common. "66a4f6b5daf5cb6072f3c12469d16db57f74a4db" and "1c47d232dacce2ad30a455aada55ddf70207dc32" have entirely different histories.

10 changed files with 67 additions and 104 deletions

View File

@ -45,11 +45,6 @@
- name: "Include ednz_cloud.hashistack.vault" - name: "Include ednz_cloud.hashistack.vault"
ansible.builtin.include_role: ansible.builtin.include_role:
name: ednz_cloud.hashistack.vault name: ednz_cloud.hashistack.vault
vars:
vault_enable_auto_unseal: true
vault_unseal_url: "{{ vault_configuration['api_addr'] }}"
vault_unseal_tls_verify: false
vault_unseal_keys: "{{ _credentials.vault['keys'] | default([]) }}"
- name: "Vault | Initialize vault cluster" # noqa: run-once[task] - name: "Vault | Initialize vault cluster" # noqa: run-once[task]
ednz_cloud.hashistack.vault_init: ednz_cloud.hashistack.vault_init:

View File

@ -11,7 +11,7 @@ module: ednz_cloud.hashistack.consul_acl_bootstrap
short_description: Bootstraps ACL for a Consul cluster. short_description: Bootstraps ACL for a Consul cluster.
version_added: "0.1.0" version_added: "1.0.0"
description: description:
- This module bootstraps ACL (Access Control List) for a Consul cluster. It performs the ACL bootstrap operation, - This module bootstraps ACL (Access Control List) for a Consul cluster. It performs the ACL bootstrap operation,

View File

@ -11,8 +11,6 @@ module: ednz_cloud.hashistack.vault_init
short_description: Manages the initialization of HashiCorp Vault. short_description: Manages the initialization of HashiCorp Vault.
version_added: "0.1.0"
description: description:
- This module initializes HashiCorp Vault, ensuring that it is securely set up for use. - This module initializes HashiCorp Vault, ensuring that it is securely set up for use.

View File

@ -7,70 +7,66 @@ __metaclass__ = type
DOCUMENTATION = r""" DOCUMENTATION = r"""
--- ---
module: ednz_cloud.hashistack.vault_unseal module: my_test
short_description: Unseals a Vault cluster. short_description: This is my test module
version_added: "0.1.0" # If this is part of a collection, you need to use semantic versioning,
# i.e. the version is of the form "2.5.0" and not "2.4".
version_added: "1.0.0"
description: description: This is my longer description explaining my test module.
- This module unseals a Vault cluster by submitting the necessary unseal keys. It checks whether the Vault is sealed and performs the unseal operation if needed. The response will reflect the state after the last unseal key is submitted.
requirements:
- C(hvac) (L(Python library,https://hvac.readthedocs.io/en/stable/overview.html))
options: options:
api_url: name:
description: The URL of the Vault API. description: This is the message to send to the test module.
required: true required: true
type: str type: str
tls_verify: new:
description: Whether to verify TLS certificates. description:
- Control to demo if the result of this module is changed or not.
- Parameter description can be a list as well.
required: false required: false
type: bool type: bool
default: true # Specify this value according to your collection
key_shares: # in format of namespace.collection.doc_fragment_name
description: List of unseal keys required to unseal the Vault. # extends_documentation_fragment:
required: false # - my_namespace.my_collection.my_doc_fragment_name
type: list
default: []
author: author:
- Bertrand Lanson (@ednz_cloud) - Your Name (@yourGitHubHandle)
""" """
EXAMPLES = r""" EXAMPLES = r"""
# Example: Unseal a Vault cluster # Pass in a message
- name: Unseal Vault cluster - name: Test with a message
ednz_cloud.hashistack.vault_unseal: my_namespace.my_collection.my_test:
api_url: "https://127.0.0.1:8200" name: hello world
tls_verify: true
key_shares:
- "key1"
- "key2"
- "key3"
# Example: Unseal Vault cluster with no TLS verification # pass in a message and have changed true
- name: Unseal Vault cluster without TLS verification - name: Test with a message and changed output
ednz_cloud.hashistack.vault_unseal: my_namespace.my_collection.my_test:
api_url: "https://127.0.0.1:8200" name: hello world
tls_verify: false new: true
key_shares:
- "key1" # fail the module
- "key2" - name: Test failure of the module
my_namespace.my_collection.my_test:
name: fail me
""" """
RETURN = r""" RETURN = r"""
state: # These are examples of possible return values, and in general should use other names for return values.
description: Information about the state of the Vault unseal operation. original_message:
type: dict description: The original name param that was passed in.
type: str
returned: always returned: always
sample: sample: 'hello world'
sealed: true, message:
t: 3, description: The output message that the test module generates.
n: 5, type: str
progress: 2, returned: always
version: "0.6.2" sample: 'goodbye'
""" """
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
import traceback import traceback

View File

@ -42,15 +42,6 @@ vault_storage_configuration:
file: file:
path: "{{ vault_data_dir }}" path: "{{ vault_data_dir }}"
#############################
# auto-unseal configuration #
#############################
vault_enable_auto_unseal: false
vault_unseal_url: "https://127.0.0.1:8200"
vault_unseal_tls_verify: true
vault_unseal_keys: []
########################## ##########################
# listener configuration # # listener configuration #
########################## ##########################

View File

@ -36,10 +36,8 @@
register: _vault_current_version register: _vault_current_version
- name: "Vault | Download and install vault binary" - name: "Vault | Download and install vault binary"
when: when: _vault_current_version is not defined
- _vault_current_version is not defined
or _vault_wanted_version != (_vault_current_version.content|default('')|b64decode) or _vault_wanted_version != (_vault_current_version.content|default('')|b64decode)
- not ansible_check_mode
block: block:
- name: "Vault | Set vault package name to download" - name: "Vault | Set vault package name to download"
ansible.builtin.set_fact: ansible.builtin.set_fact:
@ -79,6 +77,7 @@
until: _vault_binary_archive is succeeded until: _vault_binary_archive is succeeded
retries: 5 retries: 5
delay: 2 delay: 2
check_mode: false
- name: "Vault | Create temporary directory for archive decompression" - name: "Vault | Create temporary directory for archive decompression"
ansible.builtin.file: ansible.builtin.file:

View File

@ -36,10 +36,8 @@
when: _vault_service_need_reload when: _vault_service_need_reload
- name: "Vault | Start service: {{ vault_service_name }}" - name: "Vault | Start service: {{ vault_service_name }}"
ansible.builtin.include_tasks: rolling_restart.yml ansible.builtin.service:
when: name: "{{ vault_service_name }}"
- _vault_service_need_restart state: restarted
- "hostvars[host_item].inventory_hostname == inventory_hostname" throttle: 1
with_items: "{{ ansible_play_batch }}" when: _vault_service_need_restart
loop_control:
loop_var: host_item

View File

@ -5,13 +5,13 @@
path: "{{ dir_source_item.dest }}" path: "{{ dir_source_item.dest }}"
recurse: true recurse: true
state: directory state: directory
mode: "0755" mode: "0775"
- name: "Vault | Create extra directory sources" - name: "Vault | Create extra directory sources"
ansible.builtin.file: ansible.builtin.file:
path: "{{ dir_source_item.dest }}/{{ item.path }}" path: "{{ dir_source_item.dest }}/{{ item.path }}"
state: directory state: directory
mode: "0755" mode: "0775"
with_community.general.filetree: "{{ dir_source_item.src }}/" with_community.general.filetree: "{{ dir_source_item.src }}/"
when: item.state == 'directory' when: item.state == 'directory'

View File

@ -1,14 +0,0 @@
---
- name: "Vault | Start service: {{ vault_service_name }}"
ansible.builtin.service:
name: "{{ vault_service_name }}"
state: restarted
- name: "Vault | Unseal node"
ednz_cloud.hashistack.vault_unseal:
api_url: "{{ vault_unseal_url }}"
tls_verify: "{{ vault_unseal_tls_verify }}"
key_shares: "{{ vault_unseal_keys }}"
when:
- vault_enable_auto_unseal
- vault_unseal_keys|length > 0