Skip to content

Commit dcfe83d

Browse files
jackhodgkissjackhodgkiss
committed
fix: add # noqa: fqcn to avoid errors with hashivault modules
1 parent 6eb4f4a commit dcfe83d

9 files changed

+27
-20
lines changed

‎etc/kayobe/ansible/openbao-deploy-barbican.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,15 @@
3030
https_proxy: ""
3131
block:
3232
- name: Enable AppRole auth module
33-
hashivault_auth_method:
33+
hashivault_auth_method: # noqa: fqcn
3434
url: "{{ openbao_api_addr }}"
3535
ca_cert: "{{ openbao_ca_cert }}"
3636
token: "{{ openbao_keys.root_token }}"
3737
method_type: approle
3838
state: enabled
3939

4040
- name: Enable barbican kv store
41-
hashivault_secret_engine:
41+
hashivault_secret_engine: # noqa: fqcn
4242
url: "{{ openbao_api_addr }}"
4343
ca_cert: "{{ openbao_ca_cert }}"
4444
token: "{{ openbao_keys.root_token }}"
@@ -47,7 +47,7 @@
4747
description: Barbican kv store
4848

4949
- name: Ensure barbican policy is defined
50-
hashivault_policy:
50+
hashivault_policy: # noqa: fqcn
5151
url: "{{ openbao_api_addr }}"
5252
ca_cert: "{{ openbao_ca_cert }}"
5353
token: "{{ openbao_keys.root_token }}"
@@ -59,7 +59,7 @@
5959
}
6060
6161
- name: Ensure barbican AppRole is defined
62-
hashivault_approle_role:
62+
hashivault_approle_role: # noqa: fqcn
6363
url: "{{ openbao_api_addr }}"
6464
ca_cert: "{{ openbao_ca_cert }}"
6565
token: "{{ openbao_keys.root_token }}"
@@ -70,7 +70,7 @@
7070
name: barbican
7171

7272
- name: Get barbican Approle ID
73-
hashivault_approle_role_id:
73+
hashivault_approle_role_id: # noqa: fqcn
7474
url: "{{ openbao_api_addr }}"
7575
ca_cert: "{{ openbao_ca_cert }}"
7676
token: "{{ openbao_keys.root_token }}"
@@ -89,7 +89,7 @@
8989
when: stackhpc_write_barbican_role_id_to_file | default(false) | bool
9090

9191
- name: Check if barbican Approle Secret ID is defined
92-
hashivault_approle_role_secret_get:
92+
hashivault_approle_role_secret_get: # noqa: fqcn
9393
url: "{{ openbao_api_addr }}"
9494
ca_cert: "{{ openbao_ca_cert }}"
9595
token: "{{ openbao_keys.root_token }}"
@@ -98,7 +98,7 @@
9898
register: barbican_approle_secret_get
9999

100100
- name: Ensure barbican AppRole Secret ID is defined
101-
hashivault_approle_role_secret:
101+
hashivault_approle_role_secret: # noqa: fqcn
102102
url: "{{ openbao_api_addr }}"
103103
ca_cert: "{{ openbao_ca_cert }}"
104104
token: "{{ openbao_keys.root_token }}"

‎etc/kayobe/ansible/openbao-generate-backend-tls.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
name: openbao_keys
4545

4646
- name: Issue a certificate for backend TLS
47-
hashivault_pki_cert_issue:
47+
hashivault_pki_cert_issue: # noqa: fqcn
4848
url: "{{ openbao_api_addr }}"
4949
ca_cert: "{{ '/etc/pki/tls/certs/ca-bundle.crt' if ansible_facts.os_family == 'RedHat' else '/usr/local/share/ca-certificates/OS-TLS-ROOT.crt' }}"
5050
token: "{{ openbao_keys.root_token }}"

‎etc/kayobe/ansible/openbao-generate-internal-tls.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
name: openbao_keys
1313

1414
- name: Issue a certificate for internal TLS
15-
hashivault_pki_cert_issue:
15+
hashivault_pki_cert_issue: # noqa: fqcn
1616
url: "{{ openbao_api_addr }}"
1717
ca_cert: "{{ '/etc/pki/tls/certs/ca-bundle.crt' if ansible_facts.os_family == 'RedHat' else '/usr/local/share/ca-certificates/OS-TLS-ROOT.crt' }}"
1818
token: "{{ openbao_keys.root_token }}"

‎etc/kayobe/ansible/openbao-generate-test-external-tls.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
name: openbao_keys
1414

1515
- name: Issue a certificate for external TLS
16-
hashivault_pki_cert_issue:
16+
hashivault_pki_cert_issue: # noqa: fqcn
1717
url: "{{ openbao_api_addr }}"
1818
ca_cert: "{{ '/etc/pki/tls/certs/ca-bundle.crt' if ansible_facts.os_family == 'RedHat' else '/usr/local/share/ca-certificates/OS-TLS-ROOT.crt' }}"
1919
token: "{{ openbao_keys.root_token }}"

‎etc/kayobe/ansible/vault-deploy-barbican.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,15 @@
3030
https_proxy: ""
3131
block:
3232
- name: Enable AppRole auth module
33-
hashivault_auth_method:
33+
hashivault_auth_method: # noqa: fqcn
3434
url: "{{ vault_api_addr }}"
3535
ca_cert: "{{ vault_ca_cert }}"
3636
token: "{{ vault_keys.root_token }}"
3737
method_type: approle
3838
state: enabled
3939

4040
- name: Enable barbican kv store
41-
hashivault_secret_engine:
41+
hashivault_secret_engine: # noqa: fqcn
4242
url: "{{ vault_api_addr }}"
4343
ca_cert: "{{ vault_ca_cert }}"
4444
token: "{{ vault_keys.root_token }}"
@@ -47,7 +47,7 @@
4747
description: Barbican kv store
4848

4949
- name: Ensure barbican policy is defined
50-
hashivault_policy:
50+
hashivault_policy: # noqa: fqcn
5151
url: "{{ vault_api_addr }}"
5252
ca_cert: "{{ vault_ca_cert }}"
5353
token: "{{ vault_keys.root_token }}"
@@ -59,7 +59,7 @@
5959
}
6060
6161
- name: Ensure barbican AppRole is defined
62-
hashivault_approle_role:
62+
hashivault_approle_role: # noqa: fqcn
6363
url: "{{ vault_api_addr }}"
6464
ca_cert: "{{ vault_ca_cert }}"
6565
token: "{{ vault_keys.root_token }}"
@@ -70,7 +70,7 @@
7070
name: barbican
7171

7272
- name: Get barbican Approle ID
73-
hashivault_approle_role_id:
73+
hashivault_approle_role_id: # noqa: fqcn
7474
url: "{{ vault_api_addr }}"
7575
ca_cert: "{{ vault_ca_cert }}"
7676
token: "{{ vault_keys.root_token }}"
@@ -89,7 +89,7 @@
8989
when: stackhpc_write_barbican_role_id_to_file | default(false) | bool
9090

9191
- name: Check if barbican Approle Secret ID is defined
92-
hashivault_approle_role_secret_get:
92+
hashivault_approle_role_secret_get: # noqa: fqcn
9393
url: "{{ vault_api_addr }}"
9494
ca_cert: "{{ vault_ca_cert }}"
9595
token: "{{ vault_keys.root_token }}"
@@ -98,7 +98,7 @@
9898
register: barbican_approle_secret_get
9999

100100
- name: Ensure barbican AppRole Secret ID is defined
101-
hashivault_approle_role_secret:
101+
hashivault_approle_role_secret: # noqa: fqcn
102102
url: "{{ vault_api_addr }}"
103103
ca_cert: "{{ vault_ca_cert }}"
104104
token: "{{ vault_keys.root_token }}"

‎etc/kayobe/ansible/vault-generate-backend-tls.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@
4343
name: vault_keys
4444

4545
- name: Issue a certificate for backend TLS
46-
hashivault_pki_cert_issue:
46+
hashivault_pki_cert_issue: # noqa: fqcn
4747
url: "{{ vault_api_addr }}"
4848
ca_cert: "{{ '/etc/pki/tls/certs/ca-bundle.crt' if ansible_facts.os_family == 'RedHat' else '/usr/local/share/ca-certificates/OS-TLS-ROOT.crt' }}"
4949
token: "{{ vault_keys.root_token }}"

‎etc/kayobe/ansible/vault-generate-internal-tls.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
name: vault_keys
1313

1414
- name: Issue a certificate for internal TLS
15-
hashivault_pki_cert_issue:
15+
hashivault_pki_cert_issue: # noqa: fqcn
1616
url: "{{ vault_api_addr }}"
1717
ca_cert: "{{ '/etc/pki/tls/certs/ca-bundle.crt' if ansible_facts.os_family == 'RedHat' else '/usr/local/share/ca-certificates/OS-TLS-ROOT.crt' }}"
1818
token: "{{ vault_keys.root_token }}"

‎etc/kayobe/ansible/vault-generate-test-external-tls.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
name: vault_keys
1414

1515
- name: Issue a certificate for external TLS
16-
hashivault_pki_cert_issue:
16+
hashivault_pki_cert_issue: # noqa: fqcn
1717
url: "{{ vault_api_addr }}"
1818
ca_cert: "{{ '/etc/pki/tls/certs/ca-bundle.crt' if ansible_facts.os_family == 'RedHat' else '/usr/local/share/ca-certificates/OS-TLS-ROOT.crt' }}"
1919
token: "{{ vault_keys.root_token }}"

‎releasenotes/notes/add-openbao-for-tls-698ae3834ed5c67f.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,10 @@ features:
33
- |
44
Add support for deploying ``OpenBao`` across the ``seed`` and ``overcloud`` hosts
55
for the purpose of internal and backend TLS generation.
6+
deprecations:
7+
- |
8+
Hashicorp Vault for TLS generation is deprecated in favour of OpenBao.
9+
The ``openbao`` role is now used to deploy OpenBao on the seed and overcloud hosts.
10+
New deployments should use OpenBao for TLS generation.
11+
Existing deployments using Hashicorp Vault for TLS generation should be migrated
12+
to OpenBao once migration steps are available.

0 commit comments

Comments
 (0)