|
4 | 4 | gather_facts: True |
5 | 5 | hosts: controllers[0] |
6 | 6 | vars: |
7 | | - vault_api_addr: "https://{{ kolla_internal_fqdn }}:8200" |
| 7 | + vault_api_addr: "https://{{ internal_net_name | net_ip }}:8200" |
8 | 8 | vault_ca_cert: "{{ '/etc/pki/tls/certs/ca-bundle.crt' if ansible_facts.os_family == 'RedHat' else '/usr/local/share/ca-certificates/OS-TLS-ROOT.crt' }}" |
9 | 9 | tasks: |
10 | 10 | - name: Assert that secrets_barbican_approle_secret_id is defined |
|
25 | 25 | extra_args: "{% if pip_upper_constraints_file %}-c {{ pip_upper_constraints_file }}{% endif %}" |
26 | 26 | virtualenv: "{{ virtualenv_path }}/kayobe" |
27 | 27 |
|
28 | | - - name: Enable AppRole auth module |
29 | | - hashivault_auth_method: |
30 | | - url: "{{ vault_api_addr }}" |
31 | | - ca_cert: "{{ vault_ca_cert }}" |
32 | | - token: "{{ vault_keys.root_token }}" |
33 | | - method_type: approle |
34 | | - state: enabled |
| 28 | + - environment: |
| 29 | + https_proxy: '' |
| 30 | + block: |
| 31 | + - name: Enable AppRole auth module |
| 32 | + hashivault_auth_method: |
| 33 | + url: "{{ vault_api_addr }}" |
| 34 | + ca_cert: "{{ vault_ca_cert }}" |
| 35 | + token: "{{ vault_keys.root_token }}" |
| 36 | + method_type: approle |
| 37 | + state: enabled |
35 | 38 |
|
36 | | - - name: Enable barbican kv store |
37 | | - hashivault_secret_engine: |
38 | | - url: "{{ vault_api_addr }}" |
39 | | - ca_cert: "{{ vault_ca_cert }}" |
40 | | - token: "{{ vault_keys.root_token }}" |
41 | | - name: barbican |
42 | | - backend: kv |
43 | | - description: "Barbican kv store" |
| 39 | + - name: Enable barbican kv store |
| 40 | + hashivault_secret_engine: |
| 41 | + url: "{{ vault_api_addr }}" |
| 42 | + ca_cert: "{{ vault_ca_cert }}" |
| 43 | + token: "{{ vault_keys.root_token }}" |
| 44 | + name: barbican |
| 45 | + backend: kv |
| 46 | + description: "Barbican kv store" |
44 | 47 |
|
45 | | - - name: Ensure barbican policy is defined |
46 | | - hashivault_policy: |
47 | | - url: "{{ vault_api_addr }}" |
48 | | - ca_cert: "{{ vault_ca_cert }}" |
49 | | - token: "{{ vault_keys.root_token }}" |
50 | | - name: "barbican-policy" |
51 | | - state: present |
52 | | - rules: | |
53 | | - path "barbican/*" { |
54 | | - capabilities = ["create", "read", "update", "delete", "list"] |
55 | | - } |
| 48 | + - name: Ensure barbican policy is defined |
| 49 | + hashivault_policy: |
| 50 | + url: "{{ vault_api_addr }}" |
| 51 | + ca_cert: "{{ vault_ca_cert }}" |
| 52 | + token: "{{ vault_keys.root_token }}" |
| 53 | + name: "barbican-policy" |
| 54 | + state: present |
| 55 | + rules: | |
| 56 | + path "barbican/*" { |
| 57 | + capabilities = ["create", "read", "update", "delete", "list"] |
| 58 | + } |
56 | 59 |
|
57 | | - - name: Ensure barbican AppRole is defined |
58 | | - hashivault_approle_role: |
59 | | - url: "{{ vault_api_addr }}" |
60 | | - ca_cert: "{{ vault_ca_cert }}" |
61 | | - token: "{{ vault_keys.root_token }}" |
62 | | - bind_secret_id: true |
63 | | - secret_id_bound_cidrs: "{{ internal_net_name | net_cidr }}" |
64 | | - secret_id_ttl: 0 |
65 | | - token_policies: barbican-policy |
66 | | - name: barbican |
| 60 | + - name: Ensure barbican AppRole is defined |
| 61 | + hashivault_approle_role: |
| 62 | + url: "{{ vault_api_addr }}" |
| 63 | + ca_cert: "{{ vault_ca_cert }}" |
| 64 | + token: "{{ vault_keys.root_token }}" |
| 65 | + bind_secret_id: true |
| 66 | + secret_id_bound_cidrs: "{{ internal_net_name | net_cidr }}" |
| 67 | + secret_id_ttl: 0 |
| 68 | + token_policies: barbican-policy |
| 69 | + name: barbican |
67 | 70 |
|
68 | | - - name: Get barbican Approle ID |
69 | | - hashivault_approle_role_id: |
70 | | - url: "{{ vault_api_addr }}" |
71 | | - ca_cert: "{{ vault_ca_cert }}" |
72 | | - token: "{{ vault_keys.root_token }}" |
73 | | - name: barbican |
74 | | - register: barbican_role_id |
| 71 | + - name: Get barbican Approle ID |
| 72 | + hashivault_approle_role_id: |
| 73 | + url: "{{ vault_api_addr }}" |
| 74 | + ca_cert: "{{ vault_ca_cert }}" |
| 75 | + token: "{{ vault_keys.root_token }}" |
| 76 | + name: barbican |
| 77 | + register: barbican_role_id |
75 | 78 |
|
76 | | - - name: Print barbican Approle ID |
77 | | - debug: |
78 | | - msg: "barbican role id is {{ barbican_role_id.id }}" |
| 79 | + - name: Print barbican Approle ID |
| 80 | + debug: |
| 81 | + msg: "barbican role id is {{ barbican_role_id.id }}" |
79 | 82 |
|
80 | | - - name: Write barbican Approle ID to file if requested |
81 | | - delegate_to: localhost |
82 | | - copy: |
83 | | - content: "{{ barbican_role_id.id }}" |
84 | | - dest: "{{ stackhpc_barbican_role_id_file_path | default('~/barbican-role-id') }}" |
85 | | - when: stackhpc_write_barbican_role_id_to_file | default(false) | bool |
| 83 | + - name: Write barbican Approle ID to file if requested |
| 84 | + delegate_to: localhost |
| 85 | + copy: |
| 86 | + content: "{{ barbican_role_id.id }}" |
| 87 | + dest: "{{ stackhpc_barbican_role_id_file_path | default('~/barbican-role-id') }}" |
| 88 | + when: stackhpc_write_barbican_role_id_to_file | default(false) | bool |
86 | 89 |
|
87 | | - - name: Check if barbican Approle Secret ID is defined |
88 | | - hashivault_approle_role_secret_get: |
89 | | - url: "{{ vault_api_addr }}" |
90 | | - ca_cert: "{{ vault_ca_cert }}" |
91 | | - token: "{{ vault_keys.root_token }}" |
92 | | - secret: "{{ secrets_barbican_approle_secret_id }}" |
93 | | - name: barbican |
94 | | - register: barbican_approle_secret_get |
| 90 | + - name: Check if barbican Approle Secret ID is defined |
| 91 | + hashivault_approle_role_secret_get: |
| 92 | + url: "{{ vault_api_addr }}" |
| 93 | + ca_cert: "{{ vault_ca_cert }}" |
| 94 | + token: "{{ vault_keys.root_token }}" |
| 95 | + secret: "{{ secrets_barbican_approle_secret_id }}" |
| 96 | + name: barbican |
| 97 | + register: barbican_approle_secret_get |
95 | 98 |
|
96 | | - - name: Ensure barbican AppRole Secret ID is defined |
97 | | - hashivault_approle_role_secret: |
98 | | - url: "{{ vault_api_addr }}" |
99 | | - ca_cert: "{{ vault_ca_cert }}" |
100 | | - token: "{{ vault_keys.root_token }}" |
101 | | - secret: "{{ secrets_barbican_approle_secret_id }}" |
102 | | - name: barbican |
103 | | - when: barbican_approle_secret_get.status == "absent" |
| 99 | + - name: Ensure barbican AppRole Secret ID is defined |
| 100 | + hashivault_approle_role_secret: |
| 101 | + url: "{{ vault_api_addr }}" |
| 102 | + ca_cert: "{{ vault_ca_cert }}" |
| 103 | + token: "{{ vault_keys.root_token }}" |
| 104 | + secret: "{{ secrets_barbican_approle_secret_id }}" |
| 105 | + name: barbican |
| 106 | + when: barbican_approle_secret_get.status == "absent" |
0 commit comments