mirror of
https://github.com/ansible/awx.git
synced 2026-02-01 17:48:10 -03:30
6aa2997dce
* Add TLS certificate auth for HashiCorp Vault Add support for AWX to authenticate with HashiCorp Vault using TLS client certificates. Also updates the documentation for the HashiCorp Vault secret management plugins to include both the new TLS options and the missing Kubernetes auth method options. Signed-off-by: Andrew Austin <aaustin@redhat.com> * Refactor docker-compose vault for TLS cert auth Add TLS configuration to the docker-compose Vault configuration and use that method by default in vault plumbing. This ensures that the result of bringing up the docker-compose stack with vault enabled and running the plumb-vault playbook is a fully working credential retrieval setup using TLS client cert authentication. Signed-off-by: Andrew Austin <aaustin@redhat.com> * Remove incorrect trailing space Co-authored-by: Hao Liu <44379968+TheRealHaoLiu@users.noreply.github.com> * Make vault init idempotent - improve error handling for vault_initialization - ignore error if vault cert auth is already configured - removed unused register * Add VAULT_TLS option Make TLS for HashiCorp Vault optional and configurable via VAULT_TLS env var * Add retries for vault init Sometime it took longer for vault to fully come up and init will fail --------- Signed-off-by: Andrew Austin <aaustin@redhat.com> Co-authored-by: Hao Liu <44379968+TheRealHaoLiu@users.noreply.github.com> Co-authored-by: Hao Liu <haoli@redhat.com>
61 lines
2.2 KiB
YAML
61 lines
2.2 KiB
YAML
---
|
|
compose_name: 'docker-compose.yml'
|
|
awx_image: 'ghcr.io/ansible/awx_devel'
|
|
pg_port: 5432
|
|
pg_username: 'awx'
|
|
pg_database: 'awx'
|
|
control_plane_node_count: 1
|
|
minikube_container_group: false
|
|
receptor_socket_file: /var/run/awx-receptor/receptor.sock
|
|
receptor_image: quay.io/ansible/receptor:devel
|
|
ingress_path: /
|
|
|
|
# Keys for signing work
|
|
receptor_rsa_bits: 4096
|
|
receptor_work_sign_reconfigure: false
|
|
sign_work: no # currently defaults to no because openssl version mismatch causes "unknown block type PRIVATE KEY"
|
|
work_sign_key_dir: '../_sources/receptor'
|
|
work_sign_private_keyfile: "{{ work_sign_key_dir }}/work_private_key.pem"
|
|
work_sign_public_keyfile: "{{ work_sign_key_dir }}/work_public_key.pem"
|
|
|
|
# SSO variables
|
|
enable_keycloak: false
|
|
|
|
enable_ldap: false
|
|
ldap_public_key_file_name: 'ldap.cert'
|
|
ldap_private_key_file_name: 'ldap.key'
|
|
ldap_cert_dir: '{{ sources_dest }}/ldap_certs'
|
|
ldap_diff_dir: '{{ sources_dest }}/ldap_diffs'
|
|
ldap_public_key_file: '{{ ldap_cert_dir }}/{{ ldap_public_key_file_name }}'
|
|
ldap_private_key_file: '{{ ldap_cert_dir }}/{{ ldap_private_key_file_name }}'
|
|
ldap_cert_subject: "/C=US/ST=NC/L=Durham/O=awx/CN="
|
|
|
|
# Hashicorp Vault
|
|
enable_vault: false
|
|
vault_tls: false
|
|
hashivault_cert_dir: '{{ sources_dest }}/vault_certs'
|
|
hashivault_server_cert_subject: "/C=US/ST=NC/L=Durham/O=awx/CN=tools-vault-1"
|
|
hashivault_server_cert_extensions:
|
|
- "subjectAltName = DNS:tools_vault_1, DNS:localhost"
|
|
- "keyUsage = digitalSignature, nonRepudiation"
|
|
- "extendedKeyUsage = serverAuth"
|
|
hashivault_client_cert_extensions:
|
|
- "subjectAltName = DNS:awx-vault-client"
|
|
- "keyUsage = digitalSignature, nonRepudiation"
|
|
- "extendedKeyUsage = serverAuth, clientAuth"
|
|
hashivault_client_cert_subject: "/C=US/ST=NC/L=Durham/O=awx/CN=awx-vault-client"
|
|
hashivault_server_public_keyfile: '{{ hashivault_cert_dir }}/server.crt'
|
|
hashivault_server_private_keyfile: '{{ hashivault_cert_dir }}/server.key'
|
|
hashivault_client_public_keyfile: '{{ hashivault_cert_dir }}/client.crt'
|
|
hashivault_client_private_keyfile: '{{ hashivault_cert_dir }}/client.key'
|
|
# Metrics
|
|
enable_splunk: false
|
|
enable_grafana: false
|
|
enable_prometheus: false
|
|
scrape_interval: '5s'
|
|
|
|
# pgbouncer
|
|
enable_pgbouncer: false
|
|
pgbouncer_port: 6432
|
|
pgbouncer_max_pool_size: 70
|