mirror of
https://github.com/ansible/awx.git
synced 2026-02-02 01:58:09 -03:30
6aa2997dce
* Add TLS certificate auth for HashiCorp Vault Add support for AWX to authenticate with HashiCorp Vault using TLS client certificates. Also updates the documentation for the HashiCorp Vault secret management plugins to include both the new TLS options and the missing Kubernetes auth method options. Signed-off-by: Andrew Austin <aaustin@redhat.com> * Refactor docker-compose vault for TLS cert auth Add TLS configuration to the docker-compose Vault configuration and use that method by default in vault plumbing. This ensures that the result of bringing up the docker-compose stack with vault enabled and running the plumb-vault playbook is a fully working credential retrieval setup using TLS client cert authentication. Signed-off-by: Andrew Austin <aaustin@redhat.com> * Remove incorrect trailing space Co-authored-by: Hao Liu <44379968+TheRealHaoLiu@users.noreply.github.com> * Make vault init idempotent - improve error handling for vault_initialization - ignore error if vault cert auth is already configured - removed unused register * Add VAULT_TLS option Make TLS for HashiCorp Vault optional and configurable via VAULT_TLS env var * Add retries for vault init Sometime it took longer for vault to fully come up and init will fail --------- Signed-off-by: Andrew Austin <aaustin@redhat.com> Co-authored-by: Hao Liu <44379968+TheRealHaoLiu@users.noreply.github.com> Co-authored-by: Hao Liu <haoli@redhat.com>
101 lines
3.5 KiB
YAML
101 lines
3.5 KiB
YAML
---
|
|
- name: Set vault_addr
|
|
include_tasks: set_vault_addr.yml
|
|
|
|
- block:
|
|
- name: Start the vault
|
|
community.docker.docker_compose:
|
|
state: present
|
|
services: vault
|
|
project_src: "{{ sources_dest }}"
|
|
register: vault_start
|
|
|
|
- name: Run the initialization
|
|
community.docker.docker_container_exec:
|
|
command: vault operator init
|
|
container: tools_vault_1
|
|
env:
|
|
VAULT_ADDR: "{{ vault_addr }}"
|
|
VAULT_SKIP_VERIFY: "true"
|
|
register: vault_initialization
|
|
failed_when:
|
|
- vault_initialization.rc != 0
|
|
- vault_initialization.stderr.find("Vault is already initialized") == -1
|
|
changed_when:
|
|
- vault_initialization.rc == 0
|
|
retries: 5
|
|
delay: 5
|
|
|
|
- name: Write out initialization file
|
|
copy:
|
|
# lines 1-4 are the keys, 6 is the root token
|
|
content: |
|
|
{{ vault_initialization.stdout_lines[0] | regex_replace('Unseal Key ', 'Unseal_Key_') }}
|
|
{{ vault_initialization.stdout_lines[1] | regex_replace('Unseal Key ', 'Unseal_Key_') }}
|
|
{{ vault_initialization.stdout_lines[2] | regex_replace('Unseal Key ', 'Unseal_Key_') }}
|
|
{{ vault_initialization.stdout_lines[3] | regex_replace('Unseal Key ', 'Unseal_Key_') }}
|
|
{{ vault_initialization.stdout_lines[4] | regex_replace('Unseal Key ', 'Unseal_Key_') }}
|
|
{{ vault_initialization.stdout_lines[6] | regex_replace('Initial Root Token', 'Initial_Root_Token') }}
|
|
dest: "{{ vault_file }}"
|
|
when: (vault_initialization.stdout_lines | length) > 0
|
|
|
|
- name: Unlock the vault
|
|
include_role:
|
|
name: vault
|
|
tasks_from: unseal.yml
|
|
|
|
- name: Configure the vault with cert auth
|
|
block:
|
|
- name: Create a cert auth mount
|
|
flowerysong.hvault.write:
|
|
path: "sys/auth/cert"
|
|
vault_addr: "{{ vault_addr_from_host }}"
|
|
validate_certs: false
|
|
token: "{{ Initial_Root_Token }}"
|
|
data:
|
|
type: "cert"
|
|
register: vault_auth_cert
|
|
failed_when:
|
|
- vault_auth_cert.result.errors | default([]) | length > 0
|
|
- "'path is already in use at cert/' not in vault_auth_cert.result.errors | default([])"
|
|
changed_when:
|
|
- vault_auth_cert.result.errors | default([]) | length == 0
|
|
|
|
- name: Configure client certificate
|
|
flowerysong.hvault.write:
|
|
path: "auth/cert/certs/awx-client"
|
|
vault_addr: "{{ vault_addr_from_host }}"
|
|
validate_certs: false
|
|
token: "{{ Initial_Root_Token }}"
|
|
data:
|
|
name: awx-client
|
|
certificate: "{{ lookup('ansible.builtin.file', '{{ vault_client_cert }}') }}"
|
|
policies:
|
|
- root
|
|
when: vault_tls | bool
|
|
|
|
- name: Create an engine
|
|
flowerysong.hvault.engine:
|
|
path: "my_engine"
|
|
type: "kv"
|
|
vault_addr: "{{ vault_addr_from_host }}"
|
|
validate_certs: false
|
|
token: "{{ Initial_Root_Token }}"
|
|
|
|
- name: Create a demo secret
|
|
flowerysong.hvault.kv:
|
|
mount_point: "my_engine/my_root"
|
|
key: "my_folder"
|
|
value:
|
|
my_key: "this_is_the_secret_value"
|
|
vault_addr: "{{ vault_addr_from_host }}"
|
|
validate_certs: false
|
|
token: "{{ Initial_Root_Token }}"
|
|
|
|
always:
|
|
- name: Stop the vault
|
|
community.docker.docker_compose:
|
|
state: absent
|
|
project_src: "{{ sources_dest }}"
|
|
when: vault_start is defined and vault_start.changed
|