ansible-collections/hcp-ansible
ansible-collections/hcp-ansible
4
0
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

feature/generate-credentials #5

Merged
lanson merged 13 commits from feature/generate-credentials into main 2024-05-03 22:32:18 +00:00
Conversation 0 Commits 13 Files Changed 23 +11 -7
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 7ffa720824 - Show all commits

18
playbooks/tasks/vault/vault_deploy.yml
View File

@ -20,8 +20,8 @@
- name: "Write vault configuration to file" # noqa: run-once[task] no-handler - name: "Write vault configuration to file" # noqa: run-once[task] no-handler
ansible.builtin.copy: ansible.builtin.copy:
content: "{{ _vault_init_secret.state | to_nice_yaml}}" content: "{{ _vault_init_secret.state | to_nice_yaml(indent=2) }}"
dest: "{{ sub_configuration_directories.vault_servers }}/vault_config.yml" dest: "{{ sub_configuration_directories.secrets }}/vault.yml"
owner: "{{ lookup('env', 'USER') }}" owner: "{{ lookup('env', 'USER') }}"
group: "{{ lookup('env', 'USER') }}" group: "{{ lookup('env', 'USER') }}"
mode: "0644" mode: "0644"
@ -29,16 +29,20 @@
run_once: true run_once: true
delegate_to: localhost delegate_to: localhost
# - name: "Load vault cluster variables necessary for unseal operation"
# ansible.builtin.include_vars:
# file: "{{ sub_configuration_directories.vault_servers }}/vault_config.yml"
# name: _vault_cluster_config
- name: "Load vault cluster variables necessary for unseal operation" - name: "Load vault cluster variables necessary for unseal operation"
ansible.builtin.include_vars: ansible.builtin.import_tasks:
file: "{{ sub_configuration_directories.vault_servers }}/vault_config.yml" file: ../misc/load_credentials_vars.yml
name: _vault_cluster_config
- name: "Unseal the bootstrap node" # noqa: run-once[task] no-handler - name: "Unseal the bootstrap node" # noqa: run-once[task] no-handler
ednz_cloud.hashistack.vault_unseal: ednz_cloud.hashistack.vault_unseal:
api_url: "{{ hashi_vault_configuration['api_addr'] }}" api_url: "{{ hashi_vault_configuration['api_addr'] }}"
tls_verify: "{{ vault_tls_verify }}" tls_verify: "{{ vault_tls_verify }}"
key_shares: "{{ _vault_cluster_config['keys'] }}" key_shares: "{{ _credentials.vault['keys'] }}"
run_once: true run_once: true
delegate_to: "{{ groups['vault_servers'] | first }}" delegate_to: "{{ groups['vault_servers'] | first }}"
when: _vault_init_secret.changed when: _vault_init_secret.changed
@ -48,7 +52,7 @@
ednz_cloud.hashistack.vault_unseal: ednz_cloud.hashistack.vault_unseal:
api_url: "{{ hashi_vault_configuration['api_addr'] }}" api_url: "{{ hashi_vault_configuration['api_addr'] }}"
tls_verify: "{{ vault_tls_verify }}" tls_verify: "{{ vault_tls_verify }}"
key_shares: "{{ _vault_cluster_config['keys'] }}" key_shares: "{{ _credentials.vault['keys'] }}"
retries: 5 retries: 5
delay: 5 delay: 5
until: _unseal_status.changed or not _unseal_status.failed until: _unseal_status.changed or not _unseal_status.failed