Torjus Håkestad
2f89d564f7
Some checks failed
Run nix flake check / flake-check (push) Has been cancelled
Add pn01 and pn02 to hosts-generated.tf for Vault AppRole access. Fix provision-approle.yml: the localhost play was skipped when using -l filter, since localhost didn't match the target. Merged into a single play using delegate_to: localhost for the bao commands. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
85 lines
2.5 KiB
YAML
85 lines
2.5 KiB
YAML
---
|
|
# Provision OpenBao AppRole credentials to a host
|
|
#
|
|
# Usage: ansible-playbook ansible/playbooks/provision-approle.yml -l <hostname>
|
|
# Requires: BAO_ADDR and BAO_TOKEN environment variables set
|
|
#
|
|
# IMPORTANT: This playbook must target exactly one host to prevent
|
|
# accidentally regenerating credentials for multiple hosts.
|
|
|
|
- name: Validate single host target
|
|
hosts: all
|
|
gather_facts: false
|
|
|
|
tasks:
|
|
- name: Fail if targeting multiple hosts
|
|
ansible.builtin.fail:
|
|
msg: |
|
|
This playbook must target exactly one host.
|
|
Use: ansible-playbook provision-approle.yml -l <hostname>
|
|
|
|
Targeting multiple hosts would regenerate credentials for all of them,
|
|
potentially breaking existing services.
|
|
when: ansible_play_hosts | length != 1
|
|
run_once: true
|
|
|
|
- name: Provision AppRole credentials
|
|
hosts: all
|
|
gather_facts: false
|
|
|
|
vars:
|
|
target_hostname: "{{ inventory_hostname.split('.')[0] }}"
|
|
|
|
tasks:
|
|
- name: Display target host
|
|
ansible.builtin.debug:
|
|
msg: "Provisioning AppRole credentials for: {{ target_hostname }}"
|
|
|
|
- name: Get role-id for host
|
|
ansible.builtin.command:
|
|
cmd: "bao read -field=role_id auth/approle/role/{{ target_hostname }}/role-id"
|
|
environment:
|
|
BAO_ADDR: "{{ vault_addr }}"
|
|
BAO_SKIP_VERIFY: "1"
|
|
register: role_id_result
|
|
changed_when: false
|
|
delegate_to: localhost
|
|
|
|
- name: Generate secret-id for host
|
|
ansible.builtin.command:
|
|
cmd: "bao write -field=secret_id -f auth/approle/role/{{ target_hostname }}/secret-id"
|
|
environment:
|
|
BAO_ADDR: "{{ vault_addr }}"
|
|
BAO_SKIP_VERIFY: "1"
|
|
register: secret_id_result
|
|
changed_when: true
|
|
delegate_to: localhost
|
|
|
|
- name: Create AppRole directory
|
|
ansible.builtin.file:
|
|
path: /var/lib/vault/approle
|
|
state: directory
|
|
mode: "0700"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Write role-id
|
|
ansible.builtin.copy:
|
|
content: "{{ role_id_result.stdout }}"
|
|
dest: /var/lib/vault/approle/role-id
|
|
mode: "0600"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Write secret-id
|
|
ansible.builtin.copy:
|
|
content: "{{ secret_id_result.stdout }}"
|
|
dest: /var/lib/vault/approle/secret-id
|
|
mode: "0600"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Display success
|
|
ansible.builtin.debug:
|
|
msg: "AppRole credentials provisioned to {{ inventory_hostname }}"
|