07cc981971
* Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size
43 lines
1.4 KiB
YAML
43 lines
1.4 KiB
YAML
---
|
|
- name: create_role | Create a policy for the new role
|
|
hashivault_policy_set:
|
|
url: "{{ vault_leader_url }}"
|
|
token: "{{ vault_root_token }}"
|
|
ca_cert: "{{ vault_cert_dir }}/ca.pem"
|
|
name: "{{ create_role_name }}"
|
|
rules: >-
|
|
{%- if create_role_policy_rules|d("default") == "default" -%}
|
|
{{
|
|
{ 'path': {
|
|
create_role_mount_path + '/issue/' + create_role_name: {'policy': 'write'},
|
|
create_role_mount_path + '/roles/' + create_role_name: {'policy': 'read'}
|
|
}} | to_json + '\n'
|
|
}}
|
|
{%- else -%}
|
|
{{ create_role_policy_rules | to_json + '\n' }}
|
|
{%- endif -%}
|
|
|
|
- name: create_role | Create {{ create_role_name }} role in the {{ create_role_mount_path }} pki mount
|
|
hashivault_write:
|
|
url: "{{ vault_leader_url }}"
|
|
token: "{{ vault_root_token }}"
|
|
ca_cert: "{{ vault_cert_dir }}/ca.pem"
|
|
secret: "{{ create_role_mount_path }}/roles/{{ create_role_name }}"
|
|
data: |
|
|
{%- if create_role_options|d("default") == "default" -%}
|
|
{
|
|
allow_any_name: true
|
|
}
|
|
{%- else -%}
|
|
{{ create_role_options | to_json }}
|
|
{%- endif -%}
|
|
|
|
## Userpass based auth method
|
|
|
|
- include_tasks: gen_userpass.yml
|
|
vars:
|
|
gen_userpass_password: "{{ create_role_password }}"
|
|
gen_userpass_policies: "{{ create_role_name }}"
|
|
gen_userpass_role: "{{ create_role_name }}"
|
|
gen_userpass_username: "{{ create_role_name }}"
|