53 lines
1.7 KiB
YAML
53 lines
1.7 KiB
YAML
---
|
|
# hashistack deployment playbook
|
|
- name: "Deploy"
|
|
hosts: all
|
|
gather_facts: true
|
|
become: true
|
|
tasks:
|
|
- name: "Include ednxzu.hashicorp_vault"
|
|
ansible.builtin.include_role:
|
|
name: ednxzu.hashistack.hashicorp_vault
|
|
|
|
- name: "Initialize vault cluster"
|
|
ednxzu.hashistack.vault_init:
|
|
api_url: "http://127.0.0.1:8200"
|
|
key_shares: 3
|
|
key_threshold: 2
|
|
run_once: true
|
|
delegate_to: "{{ groups['vault_servers'] | first }}"
|
|
register: _vault_init_secret
|
|
|
|
- name: "Write vault configuration to file"
|
|
ansible.builtin.copy:
|
|
content: "{{ _vault_init_secret.state | to_nice_yaml}}"
|
|
dest: "{{ configuration_directory }}/vault/vault_config"
|
|
mode: '0644'
|
|
when: _vault_init_secret.changed
|
|
run_once: true
|
|
delegate_to: localhost
|
|
|
|
- name: "Load vault cluster variables necessary for unseal operation"
|
|
ansible.builtin.include_vars:
|
|
file: "{{ configuration_directory }}/vault/vault_config"
|
|
name: _vault_cluster_config
|
|
|
|
- name: "Unseal the bootstrap node"
|
|
ednxzu.hashistack.vault_unseal:
|
|
api_url: "http://127.0.0.1:8200"
|
|
key_shares: "{{ _vault_cluster_config['keys'] }}"
|
|
max_retries: "{{ (_vault_cluster_config['keys'] | length) - 1 }}"
|
|
run_once: true
|
|
delegate_to: "{{ groups['vault_servers'] | first }}"
|
|
when: _vault_init_secret.changed
|
|
|
|
- name: "Unseal all vault nodes"
|
|
ednxzu.hashistack.vault_unseal:
|
|
api_url: "http://127.0.0.1:8200"
|
|
key_shares: "{{ _vault_cluster_config['keys'] }}"
|
|
max_retries: "{{ (_vault_cluster_config['keys'] | length) - 1 }}"
|
|
|
|
- name: "Debug"
|
|
ansible.builtin.debug:
|
|
msg: "{{ _vault_cluster_config }}"
|