ansible-collections/hcp-ansible
ansible-collections/hcp-ansible
4
0
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

fix: allow override of the hashistack_ca_action via extra-vars flag

Browse Source
This commit is contained in:
Bertrand Lanson 2024-11-10 22:51:35 +01:00
parent 6a707800c1
commit 802e1fc16e
Signed by: lanson
SSH Key Fingerprint: SHA256:/nqc6HGqld/PS208F6FUOvZlUzTS0rGpNNwR5O2bQBw
1 changed files with 38 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
playbooks/group_vars/all/hashistack_ca.yml
View File

@ -2,7 +2,7 @@
# defaults
hashistack_ca_directory: "{{ hashistack_sub_configuration_directories['certificates'] }}"
hashistack_ca_use_cryptography: false
hashistack_ca_action: "noop"
# hashistack_ca_action: "noop"
hashistack_ca_domain: example.com
hashistack_ca_directory_owner: "{{ lookup('env', 'USER') }}"
@ -79,37 +79,52 @@ hashistack_ca_leaf_renew_threshold: 30d
############################
hashistack_ca_consul_org_name: "{{ hashistack_ca_root_org_name }}"
hashistack_ca_consul_common_name: "{{ inventory_hostname }}"
hashistack_ca_consul_csr_sans:
- "DNS:{{ inventory_hostname }}"
- "DNS:consul.service.consul"
- "DNS:localhost"
- "IP:{{ api_interface_address }}"
- "IP:127.0.0.1"
- "{{ 'DNS:server.' ~ consul_datacenter ~ '.' ~ consul_domain if consul_enable_server else omit }}"
hashistack_ca_consul_csr_sans: >
{{
[
"DNS:" + inventory_hostname,
"DNS:consul.service.consul",
"DNS:localhost",
"IP:" + api_interface_address,
"IP:127.0.0.1"
]
+ ([ "DNS:server." + consul_datacenter + "." + consul_domain ] if consul_enable_server else [])
}}
###########################
# Nomad Leaf Certificates #
###########################
hashistack_ca_nomad_org_name: "{{ hashistack_ca_root_org_name }}"
hashistack_ca_nomad_common_name: "{{ inventory_hostname }}"
hashistack_ca_nomad_csr_sans:
- "DNS:{{ inventory_hostname }}"
- "DNS:localhost"
- "IP:{{ api_interface_address }}"
- "IP:127.0.0.1"
- "{{ 'DNS:server.' ~ nomad_region ~ '.nomad' if nomad_enable_server else omit }}"
- "{{ 'DNS:nomad.service.consul' if (nomad_enable_server and enable_consul) else omit }}"
hashistack_ca_nomad_csr_sans: >
{{
[
"DNS:" + inventory_hostname,
"DNS:localhost",
"IP:" + api_interface_address,
"IP:127.0.0.1"
]
+ ([ "DNS:server." + nomad_region + ".nomad" ] if nomad_enable_server else [])
+ ([ "DNS:client." + nomad_region + ".nomad" ] if nomad_enable_client else [])
+ ([ "DNS:nomad.service.consul" ] if (nomad_enable_server and enable_consul) else [])
}}
###########################
# Vault Leaf Certificates #
###########################
hashistack_ca_vault_org_name: "{{ hashistack_ca_root_org_name }}"
hashistack_ca_vault_common_name: "{{ inventory_hostname }}"
hashistack_ca_vault_csr_sans:
- "DNS:{{ inventory_hostname }}"
- "{{ 'DNS:active.vault.service.consul' if enable_consul else omit }}"
- "{{ 'DNS:standby.vault.service.consul' if enable_consul else omit }}"
- "{{ 'DNS:vault.service.consul' if enable_consul else omit }}"
- "DNS:localhost"
- "IP:{{ api_interface_address }}"
- "IP:127.0.0.1"
hashistack_ca_vault_csr_sans: >
{{
[
"DNS:" + inventory_hostname,
"DNS:localhost",
"IP:" + api_interface_address,
"IP:127.0.0.1"
]
+ ([
"DNS:active.vault.service.consul",
"DNS:standby.vault.service.consul",
"DNS:vault.service.consul"
] if enable_consul else [])
}}