playbooks/generate_certs.yml

@@ -1,5 +1,5 @@
 ---
-# hashistack generate certificates playbook
+# hashistack deployment playbook
 - name: "Generate certificates"
   hosts: all
   strategy: linear
@@ -272,4 +272,4 @@
                     group: "{{ lookup('env', 'USER') }}"
                     mode: "0644"
 
-    # - fail:
+    # - fail:

playbooks/generate_credentials.yml

@@ -10,24 +10,22 @@
       block:
         - name: "Generate consul root credentials"
           ansible.builtin.set_fact:
-            _consul_root_token: "{{ lookup('password', '/dev/null chars=ascii_letters,digits') | to_uuid }}"
+            _consul_root_token: "{{ lookup('uuid', namespace='00000000-0000-0000-0000-000000000000') }}"
 
         - name: "Generate consul agents credentials"
           ansible.builtin.set_fact:
-            _consul_agents_token: "{{ lookup('password', '/dev/null chars=ascii_letters,digits') | to_uuid }}"
+            _consul_agents_token: "{{ lookup('uuid', namespace='00000000-0000-0000-0000-000000000000') }}"
 
     - name: "Generate nomad credentials"
       block:
         - name: "Generate nomad root credentials"
           ansible.builtin.set_fact:
-            _nomad_root_token: "{{ lookup('password', '/dev/null chars=ascii_letters,digits') | to_uuid }}"
+            _nomad_root_token: "{{ lookup('uuid', namespace='00000000-0000-0000-0000-000000000000') }}"
 
     - name: "Write credentials file"
       ansible.builtin.template:
-        src: templates/credentials.yml.j2
-        dest: "{{ sub_configuration_directories['secrets'] }}/{{ configuration_credentials_vars_file }}"
-        owner: "{{ lookup('env', 'USER') }}"
-        group: "{{ lookup('env', 'USER') }}"
+        src: credentials.yml.j2
+        dest: credentials.yml
         mode: '0644'
 
-    # - fail:
+    - fail:

playbooks/tasks/consul/consul_deploy.yml

@@ -7,7 +7,7 @@
 
     - name: "Wait for consul cluster to initialize" # noqa: run-once[task]
       ansible.builtin.uri:
-        url: "http://{{ api_interface_address }}:8500" # TODO: this should be dynamic (http/https)
+        url: "http://{{ api_interface_address }}:8500"
         validate_certs: no
         return_content: yes
         status_code:
@@ -19,7 +19,6 @@
 
     - name: "Initialize consul cluster" # noqa: run-once[task]
       community.general.consul_acl_bootstrap:
-        bootstrap_secret: "{{ _credentials.consul.root_token.secret_id }}"
         host: "{{ hashi_consul_configuration['advertise_addr'] }}"
         port: 8500
         scheme: http
@@ -29,27 +28,27 @@
       register: _consul_init_secret
       when: hashi_consul_configuration.acl.enabled
 
-    # - name: "Write consul configuration to file" # noqa: run-once[task] no-handler
-    #   ansible.builtin.blockinfile:
-    #     marker: "## -- {root_token} ANSIBLE MANAGED BLOCK ##"
-    #     block: "{{
-    #       {
-    #       'root_token':{
-    #       'accessor_id': _consul_init_secret.result.AccessorID,
-    #       'secret_id': _consul_init_secret.result.SecretID
-    #       }
-    #       } | to_nice_yaml
-    #       }}"
-    #     path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
-    #     mode: "0644"
-    #   when: _consul_init_secret.result is defined
-    #   run_once: true
-    #   delegate_to: localhost
+    - name: "Write consul configuration to file" # noqa: run-once[task] no-handler
+      ansible.builtin.blockinfile:
+        marker: "## -- {root_token} ANSIBLE MANAGED BLOCK ##"
+        block: "{{
+          {
+          'root_token':{
+          'accessor_id': _consul_init_secret.result.AccessorID,
+          'secret_id': _consul_init_secret.result.SecretID
+          }
+          } | to_nice_yaml
+          }}"
+        path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
+        mode: "0644"
+      when: _consul_init_secret.result is defined
+      run_once: true
+      delegate_to: localhost
 
-    # - name: "Load consul cluster variables"
-    #   ansible.builtin.include_vars:
-    #     file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
-    #     name: _consul_cluster_config
+    - name: "Load consul cluster variables"
+      ansible.builtin.include_vars:
+        file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
+        name: _consul_cluster_config
 
     - name: "Create consul agents token"
       when:
@@ -58,14 +57,14 @@
       block:
         - name: "Create consul agents token" # noqa: run-once[task] no-handler
           run_once: true
+          delegate_to: localhost
           block:
             - name: "Create consul agent policy"
               community.general.consul_policy:
-                token: "{{ _credentials.consul.root_token.secret_id }}"
-                host: "{{ api_interface_address }}"
+                host: "{{ hashi_consul_configuration['advertise_addr'] }}"
+                token: "{{ _consul_cluster_config.root_token.secret_id }}"
                 port: 8500
-                scheme: http # TODO: this should be dynamic
-                validate_certs: false
+                scheme: http
                 state: present
                 name: agents-policy
                 rules: "{{ consul_default_agent_policy }}"
@@ -75,65 +74,55 @@
               vars:
                 consul_full_url: "http://{{ hashi_consul_configuration['advertise_addr'] }}:8500"
                 consul_token_body:
-                  Description: "Consul agents token"
-                  SecretID: "{{ _credentials.consul.tokens.agent }}"
                   Policies:
                     - ID: "{{ _consul_agent_policy.policy.ID }}"
               ansible.builtin.uri:
                 url: "{{ consul_full_url }}/v1/acl/token"
                 method: PUT
                 headers:
-                  X-Consul-Token: "{{ _credentials.consul.root_token.secret_id  }}"
+                  X-Consul-Token: "{{ _consul_cluster_config.root_token.secret_id }}"
                 body: "{{ consul_token_body | to_json }}"
                 status_code:
                   - 200
               register: _consul_agent_token
-              changed_when: _consul_agent_token.status == 200
 
-            - name: "Restart consul service"
-              ansible.builtin.service:
-                name: "consul_container"
-                state: restarted
-              throttle: 1
-              when: _consul_agent_token.changed
+            - name: "Write consul agents token to file" # no-handler
+              ansible.builtin.blockinfile:
+                marker: "## -- {tokens} ANSIBLE MANAGED BLOCK ##"
+                block: "{{
+                  {
+                  'tokens':{
+                  'agent': _consul_agent_token.json.SecretID
+                  }
+                  } | to_nice_yaml
+                  }}"
+                path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
+                mode: "0644"
+              when: "'OK' in _consul_agent_token.msg"
 
-    # - name: "Write consul agents token to file" # no-handler
-    #   ansible.builtin.blockinfile:
-    #     marker: "## -- {tokens} ANSIBLE MANAGED BLOCK ##"
-    #     block: "{{
-    #       {
-    #       'tokens':{
-    #       'agent': _consul_agent_token.json.SecretID
-    #       }
-    #       } | to_nice_yaml
-    #       }}"
-    #     path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
-    #     mode: "0644"
-    #   when: "'OK' in _consul_agent_token.msg"
+        - name: "Merge token configuration"
+          delegate_to: localhost
+          block:
+            - name: "Stat consul secrets file"
+              ansible.builtin.stat:
+                path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
+              register: _consul_config_file
 
-    #         - name: "Merge token configuration"
-    #           delegate_to: localhost
-    #           block:
-    #             - name: "Stat consul secrets file"
-    #               ansible.builtin.stat:
-    #                 path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
-    #               register: _consul_config_file
-    #
-    #             - name: "Load consul secrets file"
-    #               ansible.builtin.include_vars:
-    #                 file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
-    #                 name: _consul_cluster_config
-    #               when: _consul_config_file.stat.exists
-    #
-    #             - name: "Merge token configuration"
-    #               vars:
-    #                 _config_to_merge:
-    #                   acl:
-    #                     tokens: "{{ _consul_cluster_config.tokens }}"
-    #               ansible.builtin.set_fact:
-    #                 hashi_consul_configuration: "{{ hashi_consul_configuration | default({}) | combine(_config_to_merge, recursive=true) }}"
-    #               when: _consul_cluster_config.tokens is defined
+            - name: "Load consul secrets file"
+              ansible.builtin.include_vars:
+                file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
+                name: _consul_cluster_config
+              when: _consul_config_file.stat.exists
 
-    # - name: "Include ednz_cloud.hashistack.hashicorp_consul"
-    #   ansible.builtin.include_role:
-    #     name: ednz_cloud.hashistack.hashicorp_consul
+            - name: "Merge token configuration"
+              vars:
+                _config_to_merge:
+                  acl:
+                    tokens: "{{ _consul_cluster_config.tokens }}"
+              ansible.builtin.set_fact:
+                hashi_consul_configuration: "{{ hashi_consul_configuration | default({}) | combine(_config_to_merge, recursive=true) }}"
+              when: _consul_cluster_config.tokens is defined
+
+        - name: "Include ednz_cloud.hashistack.hashicorp_consul"
+          ansible.builtin.include_role:
+            name: ednz_cloud.hashistack.hashicorp_consul

playbooks/tasks/consul/consul_vars.yml

@@ -36,14 +36,35 @@
 - name: "Consul | Merge token configuration"
   delegate_to: localhost
   block:
+    - name: "Consul | Stat consul secrets file"
+      ansible.builtin.stat:
+        path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
+      register: _consul_config_file
+
+    - name: "Consul | Load consul secrets file"
+      ansible.builtin.include_vars:
+        file: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
+        name: _consul_cluster_config
+      when: _consul_config_file.stat.exists
+
     - name: "Consul | Merge token configuration"
       vars:
         _config_to_merge:
           acl:
-            tokens:
-              agent: "{{ _credentials.consul.tokens.agent }}"
+            tokens: "{{ _consul_cluster_config.tokens }}"
       ansible.builtin.set_fact:
         hashi_consul_configuration: "{{ hashi_consul_configuration | default({}) | combine(_config_to_merge, recursive=true) }}"
+      when: _consul_cluster_config.tokens is defined
+
+    - name: "Consul | Create secrets file if not present"
+      ansible.builtin.file:
+        path: "{{ sub_configuration_directories.consul_servers }}/consul_config.yml"
+        state: touch
+        owner: "{{ lookup('env', 'USER') }}"
+        group: "{{ lookup('env', 'USER') }}"
+        mode: "0644"
+      run_once: true
+      when: not _consul_config_file.stat.exists
 
 - name: "Consul | Merge extra configuration settings"
   vars: