116 lines
4.0 KiB
YAML
116 lines
4.0 KiB
YAML
---
|
|
# hashistack deployment playbook
|
|
- name: "Deploy"
|
|
hosts: all
|
|
strategy: linear
|
|
gather_facts: true
|
|
become: true
|
|
tasks:
|
|
- name: "Debug"
|
|
ansible.builtin.debug:
|
|
msg: "{{ hashi_vault_configuration.listener }}"
|
|
|
|
- name: "Import variables"
|
|
ansible.builtin.import_tasks:
|
|
file: tasks/load_vars.yml
|
|
|
|
- name: "Debug"
|
|
ansible.builtin.debug:
|
|
msg: "{{ hashi_vault_configuration }}"
|
|
|
|
- name: "Debug"
|
|
ansible.builtin.debug:
|
|
msg: "{{ hashi_consul_configuration }}"
|
|
|
|
# - ansible.builtin.fail:
|
|
|
|
- name: "Consul"
|
|
when:
|
|
- enable_consul | bool
|
|
- "'consul_servers' in group_names"
|
|
tags:
|
|
- consul
|
|
block:
|
|
- name: "Include ednxzu.hashistack.hashicorp_consul"
|
|
ansible.builtin.include_role:
|
|
name: ednxzu.hashistack.hashicorp_consul
|
|
|
|
- name: "Initialize consul cluster" # noqa: run-once[task]
|
|
ednxzu.hashistack.consul_acl_bootstrap:
|
|
api_addr: "{{ hashi_consul_configuration['advertise_addr'] }}"
|
|
run_once: true
|
|
delegate_to: "{{ groups['consul_servers'] | first }}"
|
|
retries: 5
|
|
delay: 5
|
|
register: _consul_init_secret
|
|
until: not _consul_init_secret.failed
|
|
|
|
- name: "Write consul configuration to file" # noqa: run-once[task] no-handler
|
|
ansible.builtin.copy:
|
|
content: "{{ _consul_init_secret.state | to_nice_yaml}}"
|
|
dest: "{{ sub_configuration_directories.consul_servers }}/consul_config"
|
|
mode: '0644'
|
|
when: _consul_init_secret.changed
|
|
run_once: true
|
|
delegate_to: localhost
|
|
|
|
- name: "Load consul cluster variables"
|
|
ansible.builtin.include_vars:
|
|
file: "{{ sub_configuration_directories.consul_servers }}/consul_config"
|
|
name: _consul_cluster_config
|
|
|
|
|
|
- name: "Vault"
|
|
when:
|
|
- enable_vault | bool
|
|
- "'vault_servers' in group_names"
|
|
tags:
|
|
- vault
|
|
block:
|
|
- name: "Include ednxzu.hashistack.hashicorp_consul"
|
|
ansible.builtin.include_role:
|
|
name: ednxzu.hashistack.hashicorp_vault
|
|
|
|
- name: "Initialize vault cluster" # noqa: run-once[task]
|
|
ednxzu.hashistack.vault_init:
|
|
api_url: "{{ hashi_vault_configuration['api_addr'] }}"
|
|
key_shares: "{{ vault_seal_configuration['key_shares'] }}"
|
|
key_threshold: "{{ vault_seal_configuration['key_threshold'] }}"
|
|
run_once: true
|
|
retries: 5
|
|
delay: 5
|
|
delegate_to: "{{ groups['vault_servers'] | first }}"
|
|
register: _vault_init_secret
|
|
until: not _vault_init_secret.failed
|
|
|
|
- name: "Write vault configuration to file" # noqa: run-once[task] no-handler
|
|
ansible.builtin.copy:
|
|
content: "{{ _vault_init_secret.state | to_nice_yaml}}"
|
|
dest: "{{ sub_configuration_directories.vault_servers }}/vault_config"
|
|
mode: '0644'
|
|
when: _vault_init_secret.changed
|
|
run_once: true
|
|
delegate_to: localhost
|
|
|
|
- name: "Load vault cluster variables necessary for unseal operation"
|
|
ansible.builtin.include_vars:
|
|
file: "{{ sub_configuration_directories.vault_servers }}/vault_config"
|
|
name: _vault_cluster_config
|
|
|
|
- name: "Unseal the bootstrap node" # noqa: run-once[task] no-handler
|
|
ednxzu.hashistack.vault_unseal:
|
|
api_url: "{{ hashi_vault_configuration['api_addr'] }}"
|
|
key_shares: "{{ _vault_cluster_config['keys'] }}"
|
|
run_once: true
|
|
delegate_to: "{{ groups['vault_servers'] | first }}"
|
|
when: _vault_init_secret.changed
|
|
register: _vault_unseal_secret
|
|
|
|
- name: "Unseal all vault nodes"
|
|
ednxzu.hashistack.vault_unseal:
|
|
api_url: "{{ hashi_vault_configuration['api_addr'] }}"
|
|
key_shares: "{{ _vault_cluster_config['keys'] }}"
|
|
retries: 5
|
|
delay: 5
|
|
register: _unseal_status
|