Skip to content

Commit e322aca

Browse files
k-s-deank-s-dean
committed
Add vault playbooks
1 parent 9b22f06 commit e322aca

File tree

5 files changed

+306
-0
lines changed

5 files changed

+306
-0
lines changed

‎etc/kayobe/ansible/overcloud-update-trust-store.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
- name: Install CA into system trust store
3+
hosts: seed:overcloud
4+
tasks:
5+
- name: Copy the rootCA
6+
copy:
7+
content: |
8+
{{ secrets_vault_root_cert }}
9+
dest: "{{ '/etc/pki/ca-trust/source/anchors/rootCA.crt' if ansible_os_family == 'RedHat' else '/usr/local/share/ca-certificates/rootCA.crt' }}"
10+
mode: 0600
11+
become: true
12+
13+
- name: update system CA
14+
become: true
15+
shell: "{{ 'update-ca-trust' if ansible_os_family == 'RedHat' else 'update-ca-certificates' }}"

‎etc/kayobe/ansible/vault-seed-deploy.yml

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
---
2+
- name: Run hashicorp-vault role seed
3+
any_errors_fatal: true
4+
gather_facts: true
5+
hosts: seed
6+
vars:
7+
# Consul and Vault Server Options
8+
consul_bind_interface: "{{ ansible_default_ipv4.interface }}"
9+
consul_bind_ip: "{{ admin_oc_net_ips[ansible_hostname] }}"
10+
consul_vip_address: "{{ admin_oc_net_ips[ansible_hostname] }}"
11+
vault_bind_address: "{{ admin_oc_net_ips[ansible_hostname] }}"
12+
vault_api_addr: "http://{{ admin_oc_net_ips[ansible_hostname] }}:8200"
13+
vault_config_dir: "/opt/kayobe/vault"
14+
vault_cluster_name: "vault_{{ lookup('env', 'KAYOBE_ENVIRONMENT') }}"
15+
vault_vip_url: "{{ admin_oc_net_ips[ansible_hostname] }}"
16+
# Vault initalise keys
17+
vault_write_keys_file: true
18+
vault_write_keys_file_host: localhost
19+
vault_write_keys_file_path: "{{ lookup('env', 'KAYOBE_CONFIG_PATH') }}/environments/{{ lookup('env', 'KAYOBE_ENVIRONMENT') }}/keys.json"
20+
21+
tasks:
22+
- name: Set a fact about the virtualenv on the remote system
23+
set_fact:
24+
virtualenv: "{{ ansible_python_interpreter | dirname | dirname }}"
25+
when:
26+
- ansible_python_interpreter is defined
27+
- not ansible_python_interpreter.startswith('/bin/')
28+
- not ansible_python_interpreter.startswith('/usr/bin/')
29+
30+
- name: Ensure Python hvac module is installed
31+
pip:
32+
name: hvac
33+
state: latest
34+
virtualenv: "{{ virtualenv is defined | ternary(virtualenv, omit) }}"
35+
become: "{{ virtualenv is not defined }}"
36+
37+
- import_role:
38+
name: stackhpc.hashicorp.vault
39+
40+
- name: "Collect the vault keys"
41+
slurp:
42+
src: "{{ vault_write_keys_file_path }}"
43+
delegate_to: localhost
44+
register: vault_keys
45+
when:
46+
- secrets_vault_keys is not defined
47+
48+
- name: "Delete the vault keys from the file system"
49+
file:
50+
path: "{{ vault_write_keys_file_path }}"
51+
state: absent
52+
delegate_to: localhost
53+
when: not vault_keys.skipped | default('false') | bool
54+
55+
- name: Set Vault keys
56+
set_fact:
57+
new_secrets:
58+
secrets_vault_keys: "{{ vault_keys.content| b64decode | from_json | to_nice_json(indent=2) }}"
59+
when:
60+
- secrets_vault_keys is not defined
61+
62+
- name: Touch vault-secrets.yml
63+
file:
64+
path: "{{ lookup('env', 'KAYOBE_CONFIG_PATH') }}/environments/staging/vault-secrets.yml"
65+
state: touch
66+
mode: 0660
67+
delegate_to: localhost
68+
when:
69+
- new_secrets is defined
70+
71+
- name: "Store vault keys securely"
72+
copy:
73+
content: |
74+
{{ new_secrets | to_nice_yaml(default_style='|', explicit_start=True) }}
75+
dest: "{{ lookup('env', 'KAYOBE_CONFIG_PATH') }}/environments/staging/vault-secrets.yml"
76+
delegate_to: localhost
77+
when:
78+
- new_secrets is defined

‎etc/kayobe/ansible/vault-seed-gen-certs.yml

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
- name: Run hashicorp-vault role seed
2+
any_errors_fatal: true
3+
gather_facts: true
4+
hosts: seed
5+
vars:
6+
# Consul and Vault Server Options
7+
vault_api_addr: "http://{{ admin_oc_net_ips[ansible_hostname] }}:8200"
8+
vault_vip_url: "{{ admin_oc_net_ips[ansible_hostname] }}"
9+
vault_keys: "{{ secrets_vault_keys | from_json }}"
10+
11+
# Root CA Options
12+
vault_pki_root_create: false
13+
vault_pki_root_ca_name: "arcus-{{ lookup('env', 'KAYOBE_ENVIRONMENT') }}-internal-tls-root"
14+
15+
# Intermediate CA Options
16+
vault_pki_intermediate_create: false
17+
vault_pki_intermediate_ca_name: "arcus-{{ lookup('env', 'KAYOBE_ENVIRONMENT') }}-internal-tls-int"
18+
19+
# Certificate options
20+
vault_pki_generate_certificates: True
21+
vault_pki_write_certificate_files: True
22+
vault_pki_certificates_directory: "{{ lookup('env', 'KAYOBE_CONFIG_PATH') }}/environments/{{ lookup('env', 'KAYOBE_ENVIRONMENT') }}/"
23+
vault_pki_generate_pulp_cert: true
24+
# Certificates to create
25+
# Add additional certificates here
26+
# e.g.
27+
#vault_pki_certificate_subject:
28+
# - role: 'ClientServer'
29+
# common_name: "seed-tls-cert-test"
30+
# extra_params:
31+
# ttl: "8760h"
32+
# ip_sans: "{{ admin_oc_net_ips[ansible_hostname] }}"
33+
# alt_sans: "{{ admin_oc_net_ips[ansible_hostname] }}"
34+
35+
36+
tasks:
37+
- name: Set a fact about the virtualenv on the remote system
38+
set_fact:
39+
virtualenv: "{{ ansible_python_interpreter | dirname | dirname }}"
40+
when:
41+
- ansible_python_interpreter is defined
42+
- not ansible_python_interpreter.startswith('/bin/')
43+
- not ansible_python_interpreter.startswith('/usr/bin/')
44+
45+
- name: Unseal vault
46+
vars:
47+
vault_unseal_keys: "{{ vault_keys.keys_base64 }}"
48+
import_role:
49+
name: stackhpc.hashicorp.vault_unseal
50+
when:
51+
- vault_keys is defined
52+
53+
- name: Add the Pulp certificate attributes
54+
vars:
55+
pulp_cert:
56+
- role: 'ClientServer'
57+
common_name: "seed-tls-cert"
58+
extra_params:
59+
ttl: "8760h"
60+
ip_sans: "{{ admin_oc_net_ips[ansible_hostname] }}"
61+
alt_sans: "{{ admin_oc_net_ips[ansible_hostname] }}"
62+
set_fact:
63+
vault_pki_certificate_subject: "{{ vault_pki_certificate_subject | d([]) + [vault_pki_certificate_subject|combine(item)] }}"
64+
loop:
65+
- "{{ pulp_cert }}"
66+
when:
67+
- vault_pki_generate_pulp_cert | bool and secrets_pulp_tls_cert is not defined
68+
69+
- name: Create Certificates
70+
vars:
71+
vault_token: "{{ vault_keys.root_token }}"
72+
import_role:
73+
name: stackhpc.hashicorp.vault_pki
74+
when:
75+
- vault_pki_certificate_subject != none
76+
77+
- name: Set facts about pulp certificate and key
78+
vars:
79+
cert_name: "{{ item.item.common_name if item.item.common_name | length > 0 else item.item.extra_params.ip_sans }}"
80+
set_fact:
81+
new_secrets:
82+
secrets_pulp_tls_cert: |
83+
{{ item.data.certificate }}
84+
{{ item.data.issuing_ca }}
85+
secrets_pulp_tls_key: |
86+
{{ item.data.private_key }}
87+
loop: "{{ certificate_data.results }}"
88+
when:
89+
- vault_pki_generate_pulp_cert | bool and secrets_pulp_tls_cert is not defined
90+
- item.item.common_name == 'seed-tls-cert'
91+
92+
- name: "Add to vault secrets"
93+
blockinfile:
94+
content: |
95+
{{ new_secrets | to_nice_yaml(default_style='|') }}
96+
dest: "{{ vault_pki_certificates_directory }}vault-secrets.yml"
97+
marker: ""
98+
marker_begin: ""
99+
marker_end: ""
100+
insertafter: "EOF"
101+
mode: 0660
102+
delegate_to: localhost
103+
when: vault_pki_generate_pulp_cert | bool and secrets_pulp_tls_cert is not defined

‎etc/kayobe/ansible/vault-seed-gen-roots.yml

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
---
2+
- name: Run hashicorp-vault role seed
3+
any_errors_fatal: true
4+
gather_facts: true
5+
hosts: seed
6+
vars:
7+
# Consul and Vault Server Options
8+
vault_api_addr: "http://{{ admin_oc_net_ips[ansible_hostname] }}:8200"
9+
vault_vip_url: "{{ admin_oc_net_ips[ansible_hostname] }}"
10+
vault_keys: "{{ secrets_vault_keys | from_json }}"
11+
12+
# Root CA Options
13+
vault_pki_root_create: true
14+
vault_pki_root_ca_name: "arcus-{{ lookup('env', 'KAYOBE_ENVIRONMENT') }}-internal-tls-root"
15+
vault_pki_root_ca_common_name: "{{ vault_pki_root_ca_name }}"
16+
vault_pki_write_root_ca_to_file: true
17+
vault_pki_certificates_directory: "{{ lookup('env', 'KAYOBE_CONFIG_PATH') }}/environments/{{ lookup('env', 'KAYOBE_ENVIRONMENT') }}/"
18+
vault_pki_root_default_lease_ttl: "43830h"
19+
vault_pki_root_max_lease_ttl: "43830h"
20+
vault_pki_root_ttl: "43830h"
21+
vault_pki_root_key_bits: 4096
22+
23+
# Intermediate CA Options
24+
vault_pki_intermediate_create: true
25+
vault_pki_intermediate_import: false
26+
vault_pki_intermediate_export: false
27+
vault_pki_intermediate_ca_name: "arcus-{{ lookup('env', 'KAYOBE_ENVIRONMENT') }}-internal-tls-int"
28+
vault_pki_intermediate_ca_common_name: "{{ vault_pki_intermediate_ca_name }}"
29+
vault_pki_intermediate_default_lease_ttl: "43830h"
30+
vault_pki_intermediate_max_lease_ttl: "43830h"
31+
vault_pki_intermediate_ttl: "43830h"
32+
vault_pki_intermediate_key_bits: 4096
33+
34+
# Certificate Roles to Create
35+
vault_pki_intermediate_roles:
36+
- name: 'ClientServer'
37+
config:
38+
max_ttl: "8760h"
39+
ttl: "8760h"
40+
require_cn: false
41+
allow_localhost: true
42+
allow_any_name: true
43+
allow_ip_sans: true
44+
server_flag: true
45+
client_flag: true
46+
key_type: rsa
47+
key_bits: 4096
48+
country: ["GB"]
49+
locality: ["England"]
50+
organization: ["arcus"]
51+
ou: ["ops"]
52+
53+
tasks:
54+
- name: Set a fact about the virtualenv on the remote system
55+
set_fact:
56+
virtualenv: "{{ ansible_python_interpreter | dirname | dirname }}"
57+
when:
58+
- ansible_python_interpreter is defined
59+
- not ansible_python_interpreter.startswith('/bin/')
60+
- not ansible_python_interpreter.startswith('/usr/bin/')
61+
62+
- name: Unseal vault
63+
vars:
64+
vault_unseal_keys: "{{ vault_keys.keys_base64 }}"
65+
import_role:
66+
name: stackhpc.hashicorp.vault_unseal
67+
68+
- name: Generate Roots
69+
vars:
70+
vault_token: "{{ vault_keys.root_token }}"
71+
import_role:
72+
name: stackhpc.hashicorp.vault_pki
73+
74+
- name: "Collect the root Cert"
75+
slurp:
76+
src: "{{vault_pki_certificates_directory}}{{vault_pki_root_ca_name}}.pem"
77+
delegate_to: localhost
78+
register: vault_root
79+
when:
80+
- secrets_vault_root_cert is not defined
81+
82+
- name: "Delete the root cert from the file system"
83+
file:
84+
path: "{{ vault_pki_certificates_directory }}{{vault_pki_root_ca_name}}.pem"
85+
state: absent
86+
delegate_to: localhost
87+
when: not vault_root.skipped | default('false') | bool
88+
89+
- name: Set root cert
90+
set_fact:
91+
new_secrets:
92+
secrets_vault_root_cert: "{{ vault_root.content| b64decode }}"
93+
when:
94+
- secrets_vault_root_cert is not defined
95+
96+
- name: add vault secrets
97+
blockinfile:
98+
content: |
99+
{{ new_secrets | to_nice_yaml(default_style='|') }}
100+
dest: "{{vault_pki_certificates_directory}}vault-secrets.yml"
101+
marker: ""
102+
marker_begin: ""
103+
marker_end: ""
104+
insertafter: "EOF"
105+
mode: 0660
106+
delegate_to: localhost
107+
when:
108+
- new_secrets is defined

‎requirements.txt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
kayobe@git+https://github.com/stackhpc/kayobe@stackhpc/yoga
2+
ansible-modules-hashivault==4.7.1
3+
hvac

0 commit comments

Comments
 (0)